Is a written information security plan really required for a small firm?

Yes. The IRS says tax professionals are treated as financial institutions under the Gramm-Leach-Bliley Act and must have a data security plan, written and reviewed regularly. Publication 5708 is the IRS template for smaller practices.

Is IRS Publication 4557 a legal requirement?

No, Publication 4557 is IRS guidance on safeguarding taxpayer data. The binding obligations come from the FTC Safeguards Rule and, for e-file providers, the IRS e-file security standards. Use Publication 4557 as a checklist for the controls.

When must a breach be reported to the FTC?

When unencrypted information of at least 500 consumers was acquired without authorization, report to the FTC as soon as possible and no later than 30 days after discovery. Separately, e-file providers must report incidents to the IRS by the next business day after confirmation.

How long should we keep Form 8879 and other client files?

Keep Form 8879 for 3 years from the due date or IRS receipt date, whichever is later. For other client information, the Safeguards Rule says to dispose of it within two years of last use unless you have a business or legal reason to keep it.

Does a client portal replace the security plan?

No. A portal like Usual gives each client a personal link to upload documents, which replaces emailed attachments, but the plan, access controls, training and incident steps stay your responsibility.

Accounting firm security checklist: WISP and Pub 4557

01Ownership and the written plan

Name a Qualified IndividualPut one named person in the plan as the owner of the security program. The FTC says this person can be an employee or an outside provider and needs no particular degree or title.TipIn a five-person firm this is usually the owner. If you hire an outside IT provider, you still name someone inside the firm who answers for it.
Start from IRS Publication 5708Publication 5708, Creating a Written Information Security Plan for Your Tax & Accounting Practice, is the IRS template aimed at smaller practices. Publication 5709 is the companion guide to how to build the plan.
A written risk assessmentThe Safeguards Rule says the risk assessment must be written. List where client data lives (tax software, email, scanner, laptops, phones, cloud storage, paper files) and the threat to each.
Check the 5,000-consumer exemption honestlyThe FTC says institutions holding customer information on fewer than 5,000 consumers are exempt from certain provisions. Count prior-year clients and their dependents, not just this year's returns, and confirm which provisions you are exempt from.TipThe exemption does not remove the duty to have a plan, so write the whole plan anyway.
Annual written report and plan reviewThe Qualified Individual reports in writing at least annually to the board or a senior officer. For a sole owner, a dated one-page review that notes changes in staff, software and incidents is the practical equivalent.TipDo it in the same week each year, for example right after the filing season ends.

02Accounts and access

Multi-factor authentication everywhere client data livesThe Safeguards Rule requires at least two authentication factors. Turn it on for tax software, email, cloud storage, the practice management system, payroll portals and IRS e-Services, and test that no shared login bypasses it.
One login per personRemove shared preparer logins. Each person gets a unique account in tax software and storage, so the access log shows who opened which return.
Offboarding on the last day OptionalOn the day someone leaves, disable their email, tax software, cloud storage and remote access, and collect laptops and phones. Add this as a written step in the plan.
Seasonal and contract staff access OptionalGive temporary preparers access only to the clients assigned to them, with an end date on the account. Have them sign the plan acknowledgment before their first login.

03Technical controls

Encrypt data stored and in transitThe Rule says encrypt customer information on your system and in transit. Turn on full-disk encryption on every laptop and phone, and use encrypted email or a portal when sending returns and source documents.TipIf encryption is not feasible for something, the Qualified Individual must approve alternative controls in writing.
Security Six baselineThe IRS Security Six are anti-virus software, firewalls, two-factor authentication, backup software or services, drive encryption and a VPN for remote staff. The IRS describes these as steps to take, so record each one in the plan with the product name.
Backups you have restored onceBack up client files and the tax software database to encrypted storage kept apart from the office network. Restore one return from backup each year and note the date in the plan.
Annual penetration test and six-month scans OptionalThe Rule calls for annual penetration testing and system-wide vulnerability scans every six months, unless continuous monitoring is in place. Ask your IT provider to confirm, in writing, whether this applies to your setup.
Warning signs logWatch for more returns filed under your Electronic Filing Identification Number than you submitted, as the IRS lists. Check the EFIN return counts in e-Services each week from January through the filing deadline.

04Client documents and records

Stop receiving tax documents by plain emailGive clients a secure upload route for W-2s, 1099s, prior returns and ID copies. Reply to any document that arrives by plain email with the secure link, then delete the email attachment.
Form 8879 retentionThe ERO keeps each Form 8879 for 3 years from the return due date or 3 years from IRS receipt, whichever is later. Store it as a tamper-proof record in access-controlled storage.TipFor tax year 2026 returns filed in 2027, put the earliest destruction date in the client file at signing.
Disposal schedule for everything elseThe Rule says dispose of customer information no later than two years after last use unless a business or legal reason requires keeping it. Write a retention table by document type and run it once a year.TipCheck state record-keeping requirements and your malpractice insurer before shortening anything.
Paper and scanner hygiene OptionalLock paper files, shred what the retention table lets you destroy and clear the scanner and copier of stored images. Many office scanners keep documents on an internal drive.
Identity checks before changing bank detailsBefore changing refund bank account or contact details, call the client on a number already in the file. Email requests can come from a compromised mailbox.

05People and vendors

Security awareness training with refreshersThe Rule requires security awareness training for staff with regular refreshers. Log the date, attendees and topics, and run a refresher before January and before the October extension deadline.
Phishing and spoofed client emailsTeach staff the common attack: a new client email with a link to a file, or a client email that suddenly changes a payment instruction. The IRS checklist asks firms to educate themselves on phishing and ransomware.
Vendor contract reviewThe Rule says contracts with service providers must spell out your security expectations. Keep a list of every vendor that touches client data: tax software, e-signature, storage, payroll, scanning, IT support and offshore preparers.
Offshore or outsourced preparers OptionalIf returns are prepared outside your office, get a written agreement covering access controls and data handling. Keep their access limited to assigned returns.

06Incident response

Written incident response planThe Rule calls for a written incident response plan with a post-incident review. List who decides, who calls the IT provider, and where the contact numbers are kept offline.
IRS Stakeholder Liaison, first callAfter client data theft, report to your local IRS Stakeholder Liaison right away. The IRS says speed is critical, because the liaison alerts IRS Criminal Investigation and others.
E-file incident ruleIRS e-file standard 6 requires all providers to report security incidents as soon as possible and not later than the next business day after confirming the incident.
FTC report at 500 consumersIf unencrypted information of at least 500 consumers was acquired without authorization, notify the FTC through its online form as soon as possible and no later than 30 days after discovery. The requirement began May 13, 2024.
States, FBI, insurer and clientsContact the attorney general in each state where you prepare returns, file with the FBI Internet Crime Complaint Center, and notify your insurer. Then notify affected clients individually, with timing coordinated with law enforcement.
Client guidance on Form 14039 and IP PINTell affected clients that Form 14039 is for those who believe they are tax identity theft victims and not for anyone who already has an IRS letter. Any taxpayer can request an IP PIN, which cannot be dropped once enrolled.

Accounting firm security checklist

01Ownership and the written plan

02Accounts and access

03Technical controls

04Client documents and records

05People and vendors

06Incident response

What firms get wrong

Get this checklist when it changes

Questions about this checklist

Sources

Ready to stop chasing?

01Ownership and the written plan

02Accounts and access

03Technical controls

04Client documents and records

05People and vendors

06Incident response

What firms get wrong

Get this checklist when it changes

Questions about this checklist

Related checklists

Bookkeeping client onboarding checklist

Accounting client offboarding checklist

Tax preparer due diligence checklist for Form 8867

Related guides

Secure client portal for accountants: what a US tax firm must check

Accounting automation software: what to automate in a small firm

Accounting firm workflow management software: tax calendars

Sources

Ready to stop chasing?