Accounting & Tax Firms
We find out whether your email, client portal, tax software and workstations are safe from attackers, and fix what we find. A tax or accounting practice holds Social Security numbers, bank details and returns for hundreds of families and businesses, and attackers know the calendar as well as you do. We lock down sign-in, write the security plan the rules expect and keep the practice running through the busiest weeks.
A tax and accounting practice is a small business holding what identity thieves want most: Social Security numbers, bank accounts, prior-year returns and payroll data. The work is seasonal, deadlines are fixed and one compromised mailbox in March can touch hundreds of clients. Staff are experts in the law and the numbers, and rarely in IT.
Our team secures the places where the work happens: email, the client portal, tax and practice software, e-signature and the file server. We train staff on the messages that arrive in season and put a written plan on paper. Nothing here is legal advice; your counsel and the regulators decide what applies to you.
What we see in your industry
- Tax professionals are covered by the FTC Safeguards Rule. It requires a written information security program, and the IRS publishes Publication 4557 and a Written Information Security Plan template to help small firms start. Whether and how the rule applies to you is a question for your counsel.
- Tax season is phishing season. Fake client emails, document-share links and lookalike sign-in pages arrive in volume, and a stolen session can outlast a password reset. Phishing-resistant sign-in and trained staff close the common doors.
- Client portals and e-signature tools hold the most sensitive files. Each needs strong sign-in, expiring links, access limited to the people who need it and a log you can read when a client asks who opened a return.
- Data retention cuts both ways. Keep records as long as the law and your engagement letters require, and dispose of the rest on a schedule, because data you no longer need is data an attacker can still steal.
Sign-in comes first. Passkeys or FIDO2 security keys for partners and anyone who handles client documents replace passwords and codes that phishing kits relay in real time. Conditional Access blocks unfamiliar devices, and we can revoke stolen sessions quickly.
The written plan comes second. The FTC Safeguards Rule, 16 CFR Part 314, applies to many tax preparers as financial institutions. It asks for a written information security program, a qualified individual in charge, a risk assessment, access controls, encryption, multi-factor authentication, an incident response plan and oversight of service providers. IRS Publication 4557 and the IRS Written Information Security Plan template are a sound starting point. We help you build the plan and the evidence behind it, and your counsel reads the rule against your facts.
Client portals and e-signature come third. Each client sees only their own files, links expire, uploads are scanned and every download is logged. For e-file signature authorizations and engagement letters, keep the signed records with the return, protected like the return itself.
Retention and disposal come fourth. Set a schedule that follows your professional and legal retention duties, then dispose of what you no longer need. The Safeguards Rule generally expects customer information to be disposed of within two years of last use unless you have a business or legal reason to keep it.
Season readiness comes last. Tested backups, a restore order agreed with the partners and a rehearsed call list mean a failure in March is a procedure instead of a crisis. See our ransomware checklist and our guidance on session hijacking and token theft.
Every firm's reference material, forms and client files can run offline. Our Apocalypse IT Package is an on-premises continuity kit with a local reference library, document scanning, a private AI desk, chat and battery backup, offered to every customer.
Related work on our track record: an accounting firm's adversary-in-the-middle phishing incident in tax season (illustrative) and an accounting firm's Active Directory recovery after ransomware (illustrative).
Session Hijacking and Token Theft: Why MFA Alone Is Not Enough
Attackers can now phish a login, relay your MFA prompt and steal the session that results. Ordinary MFA is still worth having, but it is no longer the end of the job.
Work like yours
Adversary-in-the-middle phishing and session token theft at an accounting firm in tax season, contained and closed off
The attacker's access was cut within hours, the rogue rules were gone and the firm knew which mailboxes were touched.
Read the caseAn accounting firm's Active Directory, rebuilt and re-tiered after ransomware reached the domain admins
Mail, files and line-of-business systems returned in priority order, each verified before rejoining the network.
Read the caseA 600‑person firm's single sign-on offboarding and quarterly access reviews: SCIM deprovisioning, orphaned accounts and privileged role reviews
Ending a person in the HR system now removes access across the connected applications the same day, and the manual steps are tracked to completion.
Read the caseHow we help
Cybersecurity
We find out whether everything you run is safe from attackers, then we fix it.
Learn moreSecurity Awareness Training
Train your people to stop the phish, the fake voice and the wire request before money moves.
Learn moreEmail Security, Archiving & Continuity
Filter threats out of mail, keep every message in an immutable archive you can search, and keep email working when the mail platform goes down.
Learn moreManaged IT Services
We run your IT day to day so it stays secure: help desk, devices, Microsoft 365, Exchange, Active Directory, backups, networks and monitoring.
Learn moreDisaster Recovery Planning
Know how long you can be down, and prove you can come back before the day you must.
Learn moreFrequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageDo tax preparers need a written information security plan?
Generally yes. The FTC Safeguards Rule (16 CFR Part 314) treats paid tax preparers as financial institutions and requires a written information security program with a designated qualified individual, a written risk assessment, access controls, encryption, multi-factor authentication, staff training and an incident response plan. IRS Publication 4557 explains the safeguards, and the IRS offers a written information security plan template for small practices. This is general information, not legal advice; confirm how the rule applies to your firm with counsel.
How do we stop tax-season phishing?
Combine technical blocks with a verification habit. Enforce SPF, DKIM and DMARC and filter links and attachments; use phishing-resistant MFA for staff who touch client data; and tell staff that any request to change bank details, send returns or log in through an emailed link is confirmed by a call to a known number. Prospective-client emails with attachments are a common lure, so open them in a protected viewer or portal. Report suspected data theft promptly to the IRS and your state tax agency.
How do we secure a client portal and e-signature?
Use a portal instead of email for returns and source documents, and require MFA for every client and staff login. Send one-time or expiring links, turn on audit logs, and encrypt files at rest and in transit. For e-signature, use a provider that records identity checks and produces a tamper-evident audit trail, and confirm identity for first-time clients before sending anything. Review who has access after each season and remove accounts that are no longer needed.
What should a small tax or accounting firm do first?
Start with the written security plan and an inventory of where client data lives: tax software, laptops, email, scanners, cloud storage and paper. Then enforce MFA on email and tax software, encrypt laptops, patch devices, test a restore of your backups, and train staff before the filing season starts. These steps cover most of what the Safeguards Rule expects and most of what attackers exploit.
Can Clayton Cybernetics help us write the security plan?
Yes. We help firms build the written information security plan, run the risk assessment, configure MFA, encryption, backups and monitoring, and train staff. The plan and your legal obligations remain yours, and we do not provide legal advice, so we work alongside your counsel or compliance adviser where interpretation is needed.