Scale your CPA & accounting firm with elite offshore talent trusted by 1,000+ firms.
Thank you for your interest. Our due diligence checklist will be shared with you within 48 hours.
CPA and accounting firms are prime targets for cyberattacks because they hold exactly what criminals want: Social Security numbers, bank account details and complete tax returns. Many also run with small teams and no dedicated security staff.
The good news is that strong cybersecurity for accountants does not require a security department.
Most firms can close their biggest gaps with six proven safeguards: a Written Information Security Plan (WISP), multifactor authentication (MFA), staff training, encryption, reliable backups and a tested incident response plan.
This guide covers the threats, the rules and the practical steps that keep client data secure.
Criminals follow the data. One firm can hold thousands of tax returns, each with enough detail to file fraudulent returns, redirect refunds, or open accounts in a client's name.
Three factors raise the risk:
The financial stakes are real. IBM's Cost of a Data Breach Report 2026 puts the global average cost of a breach at $4.99 million, a record high. For a smaller practice, even a fraction of that means lost clients, legal fees and reputational damage.
That is why cybersecurity for accounting firms is now a business continuity issue, not just an IT task.
Phishing emails impersonate the IRS, software vendors, or clients to steal logins. The IRS and its Security Summit partners warn tax pros about spear phishing, clone phishing and whaling, which target firm partners directly. In "new client" scams, a fake prospect sends an infected attachment.
In business email compromise, attackers spoof or take over an email account to redirect payments or request sensitive payroll records.
Ransomware locks firm files and demands payment for the key. Many attackers also copy data first and threaten to publish it. Without clean backups, a firm can lose client files days before a deadline.
Criminals steal Electronic Filing Identification Numbers (EFINs), Preparer Tax Identification Numbers (PTINs) and CAF numbers to file fraudulent returns under a real preparer's name. Warning signs include returns rejected as duplicates, clients receiving IRS letters about returns they never filed and more returns filed under your EFIN than you submitted.
Former employees with active logins, shared passwords and vendors with weak controls can all expose client data. Every software provider, IT contractor and outsourcing partner with access to your systems is part of your security perimeter.
Read our complete guide on cybersecurity threats for CPA firms
Cybersecurity for tax professionals is a legal obligation, not just a best practice. These are the rules every US firm should know:
| Regulation | Who It Applies To | Key Requirement | Penalty or Risk |
|---|---|---|---|
| FTC Safeguards Rule (GLBA) | Tax preparation firms and other financial institutions | Written security program, risk assessments, MFA, encryption and FTC breach reporting within 30 days (500+ consumers) | FTC enforcement action |
| IRS WISP requirement (Publication 5708) | Tax and accounting professionals | Maintain and update a Written Information Security Plan | Federal noncompliance |
| IRS Publication 4557 | Tax professionals | Practical safeguards for taxpayer data | Weaker breach defense |
| IRC Section 7216 | Tax return preparers | Written client consent before using or sharing return data, including offshore | Fines up to $1,000 per violation and up to one year in prison |
| AICPA Code of Professional Conduct | AICPA members | Protect confidential client information | Disciplinary action |
| State breach notification laws | Firms holding resident data | Notify affected residents after a breach | State fines and lawsuits |
For a closer look, read our guides to the FTC Safeguards Rule for CPA firms and the IRS 7216 consent form.
Cybersecurity for accountants works best in layers. Each step closes a specific gap and together they cover most of what the FTC and IRS expect.
A WISP documents who is responsible for security, what data you hold, where it lives and how you protect it. IRS Publication 5708 includes a template sized for small practices. Review it yearly and after major staff or software changes.
Turn on MFA for email, tax software, cloud storage, remote access and IRS online accounts. The FTC Safeguards Rule requires MFA for anyone accessing customer information, so a stolen password alone is no longer enough to get in.
Many breaches start with a person, not a server. Run short training before tax season, send simulated phishing tests and teach one simple rule: verify any request for money, credentials, or data through a second channel.
Use a VPN or secure remote desktop, patch software promptly, install endpoint protection and encrypt every laptop. Avoid public wireless networks for client work.
Stop sending tax documents as email attachments. A secure client portal encrypts files in transit and at rest and it keeps an audit trail of who accessed what.
Keep three copies of your data, on two types of storage, with one copy offsite or offline. Test a full restore quarterly so you know recovery works.
Ask every vendor and outsourcing partner for proof of security, such as SOC 2 Type II reports or ISO 27001 certification. Confirm restricted access, signed confidentiality agreements and breach notification terms in the contract. Get 7216 consent before sharing any return data offshore.
See our best practices for offshoring in accounting firms for more.
Document who isolates systems, who calls your insurer and who contacts the IRS in the first 24 hours. Run a tabletop exercise yearly.
Many incidents trace back to a few avoidable habits:
Act quickly and follow your plan:
Help clients protect themselves: Recommend an Identity Protection PIN and, where appropriate, Form 14039. The IRS data theft guide for tax professionals lists every step.
Accounting firms do not need to become cybersecurity experts. They need practical safeguards, applied consistently: a current WISP, MFA everywhere, trained staff, encrypted file sharing, tested backups and a clear response plan.
Start with your highest risk gaps. Strong cybersecurity for accountants protects client data, keeps your firm compliant and preserves the trust your practice is built on.
Need help putting these controls in place? Talk to MYCPE ONE's cybersecurity team about protecting your firm.
Yes. Tax and accounting professionals who handle taxpayer data are legally required to maintain a Written Information Security Plan. IRS Publication 5708 offers a free template.
It is a federal rule under the Gramm Leach Bliley Act that requires tax preparation firms to run a written security program with risk assessments, MFA, encryption, training and vendor oversight and to report breaches affecting 500 or more consumers within 30 days.
Costs depend on headcount, software and how much is managed internally. Many core controls, such as MFA, are built into tools firms already use. Budget separately for training, backups, endpoint protection and testing.
It is not legally required, but it is strongly advisable, since professional liability policies often limit or exclude cyber events. Many insurers now expect MFA, backups and training before issuing coverage.
Yes, when the provider has strong controls. Look for SOC 2 or ISO 27001 credentials, restricted access, confidentiality agreements and monitored workstations and always get Section 7216 consent first.
Blaise Wabo is a cybersecurity and compliance expert with 12+ years of experience helping organizations meet security and regulatory requirements. As the Healthcare and Financial Services Lead at A-LIGN, he advises businesses on SOC, HIPAA, and HITRUST compliance. Since 2013, he has led more than 500 SOC reviews and 300 HITRUST/HIPAA assessments for Fortune 500 and growing companies. Blaise is recognized for simplifying complex compliance challenges into practical, scalable security solutions.
AI in Cybersecurity: What It Means for Small and Midsized Businesses in 2026
Blaise Wabo
How Can CPA and Accounting Firms Prevent Data Breaches and Cyberattacks?
Blaise Wabo
Cybersecurity Requirements for Tax Preparers and Accounting Firms in 2026
Blaise Wabo
