Accounting firms hold financial data, tax IDs, and banking information for hundreds of clients. The FTC Safeguards Rule now requires a formal information security program for all financial institutions.
Accounting firms hold some of the most valuable data a cybercriminal can access. The IRS, FTC, and state CPA boards hold accounting firms accountable for protecting client data through a Written Information Security Program (WISP).
Free Interactive Tool · 2 min
What's your IT Security Score?
Answer 10 questions, get an instant 0–100 score and your top gaps.
FTC Safeguards Rule Requirements
The FTC Safeguards Rule requires accounting firms to designate a qualified security officer, conduct risk assessments, implement safeguards to control identified risks, train employees, monitor controls, and oversee service providers with access to client data. Failure to comply risks FTC enforcement and potential IRS PTIN revocation.
Tax Software Security
Related Service
Need expert help with Compliance? CloudTechForce delivers enterprise-grade compliance services to businesses worldwide.
Explore Compliance ServicesYour tax preparation software contains your most sensitive client data. Requirements include MFA on all access, encrypted storage (cloud or on-premises server), role-based access (not all staff need access to all returns), and session timeouts for idle sessions.
Client Portal Security
Sharing tax documents via email violates your WISP. Use encrypted client portals (ShareFile, SmartVault, or your tax software's built-in portal) for all document sharing.
Updated . This update covers structure, reference context and company-claim corrections.
