Accounting Firm Security in Central MA: The Plan the IRS Expects from Tax and Bookkeeping Offices

TL;DR: Federal law treats a tax preparation firm as a financial institution, so even a one-person practice needs a written information security plan. The FTC Safeguards Rule spells out what goes in it: a named owner, multi-factor authentication, encryption, secure disposal and a breach plan. IRS Publications 4557 and 5708 show how to build an accounting firm security plan.

Accounting firm security is not a nice-to-have for a Central MA tax or bookkeeping office. It is written into federal rules, it shows up on the form you sign to renew your PTIN, and the IRS spends every summer reminding preparers about it. The good news is that the accounting firm security plan the IRS expects is specific, and most of it can be put in place before the next filing season opens.

Does a small tax or bookkeeping practice really need a written security plan?

If you prepare tax returns, yes. The FTC's Safeguards Rule, 16 CFR Part 314, lists "tax preparation firms" by name among the businesses it treats as financial institutions. (16 CFR Part 314, eCFR)

The IRS is blunter. Publication 5708, the Security Summit's guide to building a plan, says that "tax and accounting professionals are considered financial institutions, regardless of size," and that "a requirement of the Safeguards Rule is implementing and maintaining a WISP." (IRS Publication 5708, Rev. 8-2024)

You have already attested to this. Line 11 of Form W-12, the PTIN application and renewal, asks every paid preparer to check a box confirming: "I am aware that paid tax return preparers are required by law to create and maintain a written information security plan that provides data and system security protections for all taxpayer information." (IRS Form W-12, Rev. October 2025)

If your firm only does bookkeeping and never prepares a return, ask your attorney whether the federal rule reaches you. Massachusetts does not leave a gap in accounting firm security. Under 201 CMR 17.00, every person that "owns or licenses personal information about a resident of the Commonwealth" must keep a written information security program, and its safeguards must be consistent with any federal rules that already apply to you. (201 CMR 17.03, via Cornell LII) Amelia, my wife and Kief Studio's co-founder and CEO, covers the state layer in Massachusetts WISP requirements under 201 CMR 17.00. One well-built accounting firm security plan can serve both.

What does the FTC Safeguards Rule require for accounting firm security?

Section 314.4 lists the elements. In plain words:

1. Name one person in charge, the Qualified Individual. It can be an outside provider, but you keep responsibility and name a senior person to oversee them.
2. Write down your risks, and limit each person to the client data their job needs.
3. Encrypt. Customer information has to be protected by encryption "both in transit over external networks and at rest."
4. Turn on multi-factor authentication "for any individual accessing any information system," unless your Qualified Individual approves an equivalent control in writing.
5. Dispose of old data. Securely, "no later than two years after the last date the information is used" for that client, unless a law or a real business need says keep it.
6. Train your people, and require vendors by contract to protect the data.
7. Test. Either continuous monitoring, or annual penetration testing plus vulnerability scans "at least every six months."
8. Have a written incident response plan, and have the Qualified Individual report on the program in writing at least once a year.
9. Tell the FTC within 30 days if unencrypted information about 500 or more consumers is taken.

The FTC's business guide says the same in shorter form. (FTC, Safeguards Rule: What Your Business Needs to Know)

There is one accounting firm security break for small practices. Section 314.6 says the written risk assessment, the testing schedule, the written incident response plan and the annual report do not apply to firms that keep customer information about "fewer than five thousand consumers." Everything else still applies. Count the people whose information is still in your files, not just this season's clients.

Write the incident response plan anyway; it is two pages. For the official texts in one place, MyRHC indexes the GLBA framework and its source documents.

Where does accounting firm security need multi-factor authentication?

Everywhere client data can be reached. Publication 4557 says the requirement applies "for all companies regardless of size." (IRS Publication 4557, Rev. 6-2024) It is also one of the IRS Security Six basics. (IRS, IR-2026-85, August 2026)

For accounting firm security, list every system and mark each one yes or no:

• Email, for every staff account and the shared inbox.
• Your professional tax software and its cloud storage.
• The client portal.
• Your accounting and payroll platforms, including client files you log into.
• The firm's bank and any payment processor.
• IRS e-Services, your PTIN account and state tax accounts.
• Remote access: the VPN or remote desktop tool you use from home in March.
• The password manager itself.

Every "no" is a task, and most take ten minutes. Prefer an authenticator app or hardware key over text messages. A password manager ends reused passwords across all of them.

Why should client documents come through a portal instead of email?

Because email is where tax offices get hurt. The IRS tells preparers to "send only password-protected and encrypted documents if you must share files with clients via email or use Secure File Transfer Protocol (SFTP) to transmit files instead of email." (IRS Publication 4557)

The IRS's 2026 Dirty Dozen list adds that by "gaining access to a hacked email account, scammers can locate a genuine email from a previous victim's email account sent to their tax professional." (IRS, IR-2026-30, March 2026) An inbox full of W-2s is what a thief hopes to find.

A portal encrypts files on the way in, puts them in one place you control instead of six inboxes, and shows who opened what. Check five accounting firm security basics when you choose one:

1. It requires MFA for staff, and offers it to clients.
2. It encrypts files in transit and at rest.
3. It keeps a log of uploads, downloads and logins.
4. You can set files to expire and delete on a schedule that matches your retention policy.
5. The vendor will put its safeguards in the contract.

Then make it the only way in. One line in the engagement letter does it: "We never accept tax documents by email. Please use the portal link we send you."

How long should a tax practice keep client records?

Two rules pull in opposite directions. Keep long enough: federal law requires a preparer to keep a completed copy of each return, or a list of names and taxpayer identification numbers, "for the period ending 3 years after the close of the return period." (26 U.S.C. 6107(b), via Cornell LII) Electronic return originators must also keep signed Forms 8879 and 8878 for three years. (IRS Publication 1345, Rev. 12-2025) For the Massachusetts side, I wrote up how long to keep business records by record type.

Do not keep forever. The Safeguards Rule's two-year disposal clock starts after you last use a client's information, unless a law requires keeping it. A 2017 client's scanned driver's license on a shared drive is an accounting firm security risk with no benefit.

Publication 5708 includes a sample retention policy as Attachment A, with a blank for the maximum years and instructions to destroy paper "by cross-cut shredding or incineration" and to wipe or destroy drives. (IRS Publication 5708) Fill in your number with your liability carrier's input and put a purge date on the calendar each May. I wrote a separate guide to disposing of old business computers in Massachusetts.

What do phishing attacks on tax preparers look like?

They look like a new client. In the script of an IRS security awareness webinar, IRS staff called it "the most prevalent spear phishing scam that we see that targets tax professionals." The first email usually has no link. The sender wants a reply, and the next message carries the payload, often "a commodity Remote Access Trojan" that lets the attacker browse files and capture passwords. (IRS, National Tax Security Awareness Week script)

The 2026 summer series repeated the warning and added phishing aimed at a preparer's EFIN, PTIN and CAF numbers. (IRS, IR-2026-81, July 2026) The scale is real: in the first half of 2025, the IRS reported "nearly 300 data breaches reported impacting as many as 250,000 clients." (IRS, IR-2025-88, August 2025)

Accounting firm security habits that work in a busy office:

• New clients start on the phone. Publication 4557 says to make contact "by phone" before opening attachments from a potential client. Then send them your portal link.
• Check the domain, not the display name. The IRS example is irs.com instead of IRS.gov.
• Report fakes. Forward IRS-themed phishing to [email protected]. For a second opinion, the free kief.dev phishing analyzer checks a suspicious email for warning signs.
• Watch your numbers weekly. Publication 4557 says to check returns filed under your EFIN and PTIN every week.
• Train in December, with real examples, before the season starts.

How should an accounting firm back up client data?

Publication 4557 is specific: back up "to a safe and secure external source not connected fulltime to a network," encrypt the backups, and "consider a monthly backup schedule, or more often during the filing season." CISA says the same for every business: "Maintain offline, encrypted backups of critical data, and regularly test the availability and integrity of backups." (CISA, #StopRansomware Guide)

Monthly is the floor. For accounting firm security in a tax office I would set:

• Nightly automatic backups from January through the October extension deadline, monthly the rest of the year.
• At least one copy that ransomware on your network cannot reach: offline, or in storage that cannot be changed or deleted for a set period.
• A timed test restore of a real client folder every December.
• The backup accounts behind MFA, with a different password from everything else.

What should a tax practice do in the first day after a breach?

Call the IRS first. Its data theft page tells preparers to "report client data theft to your local IRS stakeholder liaison," because "speed is critical. If reported quickly, the IRS can take steps to block fraudulent returns from being filed using your clients' personal information." IRS phone assistors cannot take these reports. (IRS, Data theft information for tax professionals)

The rest of the IRS list, in order:

1. Your local FBI office, the Secret Service if directed, and a police report.
2. Each state where you prepare returns, through the Federation of Tax Administrators' "Report a Data Breach" page.
3. The FTC, if 500 or more people are affected, within 30 days of discovery.
4. A security expert, to find the cause and scope and stop it.
5. Your insurance company.
6. Your clients, with an individual letter, timed with law enforcement.

Early signs include unusual computer activity, client e-filed returns "rejected because a Social Security number was already used," and IRS authentication letters clients did not expect. (IRS, IR-2026-111, September 2026) Massachusetts adds its own notice duties, covered in Massachusetts data breach notification requirements. For the technical side of accounting firm security after a breach, see what happens in the first 24 hours after a breach.

How many accounting and tax offices are in Worcester County?

Enough to be a real local industry, mostly in offices too small to hire someone just for accounting firm security. Census County Business Patterns counted 244 establishments with employees in accounting, tax preparation, bookkeeping and payroll services in Worcester County in 2023, employing 1,977 people. (U.S. Census Bureau, County Business Patterns 2023)

• 99 were offices of CPAs.
• 65 were tax preparation services.
• 65 were other accounting services, the category that includes bookkeepers' offices.
• 15 were payroll services.

Size is the story. 161 of the 244 had fewer than five employees, and 228, about 93%, had fewer than 20. Those counts leave out the sole practitioners with no payroll, so the real number of practices holding client tax data in the county is higher.

What does accounting firm security look like in a small office?

Take a hypothetical three-person tax and bookkeeping office in Holden with about 900 clients, one cloud tax platform and documents arriving by email. The small-firm exception trims some paperwork, not the core accounting firm security plan. Its first 30 days of accounting firm security work might look like this:

1. Day 1: The owner names herself the Qualified Individual in writing.
2. Days 2 to 5: List every system and device that touches client data. Turn on MFA on every one.
3. Week 2: Pick a client portal, encrypt all three laptops, and set nightly encrypted backups with one copy offline.
4. Week 3: Fill in Publication 5708's template and get each vendor's security terms in writing.
5. Week 4: One hour of staff training on the new client scam, with signed acknowledgments.
6. Every week after: Check EFIN and PTIN return counts.

None of this needs new hardware, just a month of evenings and an owner. Passing a checklist and being hard to break into are not the same thing, which is why we keep a separate note on compliance versus security.

This article is general information, not legal advice. Kief Studio is not a law firm, and reading it does not create an attorney-client relationship. Laws and regulations change, so check the current text and talk with a licensed Massachusetts attorney about your situation.