Accounting firms in New Jersey: protect client data before tax season
- Tax preparers are covered by the FTC Safeguards Rule, which requires a written information security program.
- The IRS says to protect client data with basics like antivirus, firewalls, backups, encrypted drives, MFA and a VPN.
- The FTC Safeguards Rule also asks for a risk assessment, MFA, encryption, staff training and a written incident response plan.
- Do it in the off season. By January you are too busy.
Free 30-minute review
Tell us about your office. We tell you what we would fix first, in plain words, whether or not you hire us.
In tax season, you hold the keys to your clients' lives. Social Security numbers, bank details, dependents, income. For a thief, it is a gold mine. For you, it is the work.
This guide is a calm, off-season plan for New Jersey accountants and tax preparers. It is not legal advice. Check the rules that apply to you.
What does the FTC Safeguards Rule say?
The FTC explains that businesses it oversees as "financial institutions" must follow the rule, and the list includes tax preparation firms. See the FTC's Safeguards Rule guide. In short, you need:
- A written information security program that fits your size and the sensitivity of the data.
- A Qualified Individual to run it.
- A written risk assessment, repeated as things change.
- Safeguards such as reviewed access controls, an inventory of where client data lives, encryption, and multi-factor authentication.
- Staff training.
- Oversight of service providers.
- A written incident response plan.
What does the IRS say?
The IRS publishes Publication 4557, Safeguarding Taxpayer Data, with a checklist for a data security plan. The IRS also says a written plan is federal law, and points preparers to its other guides on data security.
The IRS's "Security Six" are basic protections: antivirus software, firewalls, backup software or services, encrypted drives, multi-factor authentication and virtual private networks. See the IRS Security Summit release.
A pre-season checklist
- Write the plan. Use IRS Pub 4557 as your template. One owner, one date for review.
- Map your client data. Where do tax files, scans and emails live? Laptops, cloud drives, a portal, paper?
- Turn on MFA on email, tax software, cloud storage and remote access.
- Encrypt laptops and external drives.
- Back up, keep one copy offline, and test a restore.
- Update computers, tax software and routers.
- Train seasonal staff before day one. Fake emails that pretend to be clients are common in busy weeks.
- Set up secure ways to receive documents. Do not ask clients to email Social Security numbers in plain messages.
- Review who has access. Remove last year's seasonal accounts.
- Write down your breach steps. Who to call and what to report.
What if there is a breach?
The FTC says a "notification event" is unauthorized acquisition of unencrypted information for at least 500 consumers. You must report it to the FTC as soon as possible, and no later than 30 days after discovery. New Jersey's breach law also applies to New Jersey residents' data. See our NJ breach law guide.
What is a written information security plan?
It is a short document that says what client data you hold, who can reach it and how you protect it. The IRS explains what tax pros need to know in its data security plan page. The FTC Safeguards Rule has related duties for covered firms, so ask your adviser which apply to you.
How do tax preparers protect client data?
Use MFA on tax software and email. Encrypt laptops and drives. Send documents through a secure portal. Limit who can see what, and remove seasonal staff access the day they finish. Back up client files and test a restore before the rush.
Seasonal staff and tax season security
- Give each person their own login. Never share one.
- Give the least access they need.
- Train them on day one about fake emails and payment changes.
- Turn off their access when the season ends.
See also our guide to the NJ breach law and backup plan.
Why do this in October?
Because in January you will not do it. The plan takes a few focused sessions now. Training new staff takes an hour. Compare that to losing a season to a breach.
How we can help
We help New Jersey firms with MFA, encryption, backups and training, and we can draft the written plan with you. Book a free 30-minute review. See our cybersecurity service.
Common questions
Does the FTC Safeguards Rule apply to tax preparers?
The FTC lists tax preparation firms among the businesses that can be financial institutions under the rule. Check how it applies to you.
What does a written information security program include?
The FTC lists a Qualified Individual, a written risk assessment, safeguards such as access controls, encryption and MFA, testing, staff training, service provider oversight and a written incident response plan.
What is IRS Publication 4557?
It is the IRS guide, Safeguarding Taxpayer Data, with a checklist for building a data security plan. It also helps with the FTC Safeguards Rule.
When must I tell the FTC about a breach?
The FTC says a notification event, which is unauthorized acquisition of unencrypted information of at least 500 consumers, must be reported as soon as possible and no later than 30 days after discovery.
What is a written information security plan?
A short document that says what client data you hold, who can reach it and how you protect it. The IRS explains what tax pros need to know.
Book a free 30-minute review
Tell us what is not working. We will look at your setup and tell you what we would change, whether or not you hire us.
Book the review ●●● ●●●-●●●●