Every time you renew your PTIN, the IRS asks you to confirm you know one thing. Paid tax preparers are required by law to keep a written information security plan. Plenty of small firms in Monterey County check "yes" and don't have one, or have a template they downloaded and never filled in. We've supported accounting offices, bookkeepers, and tax preparers on the Peninsula and in Salinas since 2008. Building and maintaining that plan, and the security behind it, is a big part of what we do for them.
The Federal Rules Tax Preparers Answer To
Under federal law, a tax preparer counts as a "financial institution." That puts your firm under the FTC Safeguards Rule. The updated rule took effect June 9, 2023. It asks for a named person in charge of security and a written risk assessment. Client data has to be encrypted. Anyone who reaches your systems needs multi-factor sign-in, and there has to be a written plan for handling a breach. IRS Publication 4557 on safeguarding taxpayer data says multi-factor sign-in is required for all companies regardless of size.
Since May 13, 2024, a breach that exposes unencrypted information on 500 or more people has to be reported to the FTC within 30 days. Small firms with fewer than 5,000 client records are excused from a few of the paperwork pieces. They still need the written plan and multi-factor sign-in.
The IRS has repeated this every summer. In August 2026 it told tax pros again that "Federal law requires tax and accounting professionals to create and maintain a Written Information Security Plan." It points firms to Publication 5708, a free template. The template is a good start, but it only helps if it describes what your office actually does.
California Adds Its Own Rules
The California Board of Accountancy regulates more than 116,000 CPAs and firms. Its rules reach into your IT in ways people don't expect.
Regulation 54.1 says you need a client's written permission before their confidential information goes to anyone outside the United States. That covers an offshore bookkeeping or preparation service. It can also cover a cloud or AI tool that processes data overseas, so it's worth knowing where your software keeps its data. Regulation 68 treats records in "machine sensible form" the same as paper. When a client asks for their records, you have to return them. Audit documentation has to be kept for seven years, in a form you can still open, under a written retention policy.
Financial advisors have a deadline of their own. Small registered investment advisers had to comply with the SEC's updated Regulation S-P by June 3, 2026. That means a written incident response program and notice to customers within 30 days of a breach.
We're not your attorney or your peer reviewer, and this isn't legal advice. What we do is put the technical controls in place and write down how they work, so you have proof when someone asks.
Tax Season Is When the Attacks Come
The IRS publishes a "Dirty Dozen" list of scams every year. Number 11 on the 2026 list is aimed at tax professionals. It's the "new client" or "document request" email with an attachment that installs malware. Another scam has fake tax software vendors asking preparers to fax over their EFIN. A stolen EFIN lets a criminal file fake returns under your firm's name.
Across all businesses, email compromise cost $3.05 billion in 2025, according to the FBI. Californians lost more to cybercrime that year than people in any other state. Accounting firms handle payroll, estimated tax payments, and wire instructions, which makes them an easy place to slip in a fake bank change.
Know the warning signs. The IRS lists e-filed returns rejected because the Social Security number was already used, and letters to clients you didn't file for. More returns under your EFIN than you sent, or computers that slow down or wake up on their own, are signs too. If you see any of them, call your IRS Stakeholder Liaison and call us.
When the Office Goes Dark in March
On the night of March 9, 2023, a single cypress fell on Del Monte Avenue and brought down the main power lines into Monterey, Pacific Grove, Pebble Beach, and Carmel. About 37,000 customers lost power, and full restoration took about 12 days. Our own neighborhood, New Monterey, lost power and internet. That was the middle of tax season.
That winter's storms also put Monterey, San Benito, and Santa Cruz counties in the IRS disaster area, and federal deadlines moved to November 16, 2023. A postponement moves the deadline, but clients still call. What keeps a firm working is tax software in the cloud and backups stored somewhere else. Add remote access that works from a kitchen table.
How We Support CPAs and Tax Preparers
We start with the plan. Our written security plans and audit-ready compliance documentation follow the elements in IRS Publication 5708 and the FTC rule, filled in with your real systems and people. We update it every year, before tax season.
Then we put the controls behind it. Multi-factor sign-in for tax software, email, and portals goes on every account, including IRS e-Services. Laptops get drive encryption. Client documents move through a secure portal or encrypted email for tax documents, never as plain attachments.
Staff get short phishing tests built around tax-season scams. That includes the seasonal help you bring on in January, who are often the easiest to fool. Remote work runs through secure remote access for preparers working from home, and every file gets copied to encrypted offsite backups of client files that we test by restoring.
What to Expect
We begin with a review of how your firm handles client data today, from intake to e-file to storage. You'll get a written gap list measured against the FTC rule, with prices before any work starts. We schedule the work for summer and fall, so nothing changes during filing season. The security basics come with the base managed plan. On April 14, a critical ticket still gets a technician within 15 minutes, and our emergency line answers 24/7.
Accounting is one of the professional practices we focus on most, and you can see how the others compare in our page on the industries we serve.
Frequently Asked Questions
Do small tax practices really need a written information security plan?
Yes. The FTC Safeguards Rule applies to paid tax preparers of every size, and the IRS says so plainly. Firms with fewer than 5,000 client records skip a few requirements, but the written plan and multi-factor sign-in still apply.
Can you write our WISP for us?
We write the technical parts and fill in the IRS template with how your systems actually work. The firm still owns the plan, names the person in charge, and signs off on it. We help you review it every year.
Which accounts need multi-factor sign-in?
All of them that touch client data. Start with email and your tax software, then client portals, remote access, and your IRS e-Services account.
What should we do if we think client data was stolen?
Call us first so we can contain it and preserve the evidence. Then contact your IRS Stakeholder Liaison and your insurer. If 500 or more people are affected, the FTC needs a report within 30 days, and California has its own notice rules.