What Federal Cybersecurity Laws Require of CPAs
A practical breakdown of the FTC Safeguards Rule, IRS Publication 4557, and GLBA mandates: what tax practices are legally obligated to do, why non-compliance is catastrophic, and how to protect your firm.
What the Laws Explicitly Require You to Do
Tax preparers, CPAs, and accounting practices are legally designated as non-bank financial institutions under the Gramm-Leach-Bliley Act (GLBA). Federal regulations enforce strict cybersecurity and policy standards.
The FTC Safeguards Rule (Revised Mandates)
"Financial institutions, including those significantly engaged in providing financial activities such as tax preparation and accounting, must develop, implement, and maintain a comprehensive information security program written in one or more readily accessible parts."
— Federal Trade Commission, 16 CFR § 314.3(a)
Under the FTC Safeguards Rule, every tax preparation and CPA firm holding nonpublic personal information (NPI) of clients must implement nine distinct administrative, technical, and physical safeguards:
Designate a Qualified Individual
Assign a qualified person (internal partner or external security coordinator) responsible for overseeing, implementing, and enforcing the firm's security program.
Conduct a Written Risk Assessment
Identify reasonably foreseeable internal and external cybersecurity risks to client information across software, hardware, networks, and personnel.
Technical Access Controls
Enforce role-based access controls to client files, inventory all systems handling customer data, and re-evaluate permissions at least annually.
Data Encryption at Rest & in Transit
All client files, tax returns, emails, and backups containing SSNs, EINs, or financial data MUST be encrypted both in transit and at rest using modern encryption (e.g. AES-256).
Multi-Factor Authentication (MFA)
MFA is strictly mandatory for ANY individual accessing any information system containing customer data (tax software, cloud storage, email, remote desktop).
Secure Disposal of Client Data
Establish automated or documented procedures for securely wiping digital drives and shredding paper tax files within two years after retention justification expires.
Continuous Monitoring & Testing
Regularly test controls via annual penetration testing or ongoing vulnerability scans of firm networks and client portals.
Mandatory Staff Security Training
Provide verified, recurring cybersecurity awareness training to all personnel. The FTC explicitly mandates that staff be trained to recognize social engineering, phishing, and wire fraud.
Incident Response & 30-Day Notice
Maintain a written Incident Response Plan (IRP). Effective 2024, firms MUST notify the FTC within 30 calendar days of discovering a breach affecting 500+ consumers.
IRS Publication 4557 & The "Security Six"
"Federal law requires all professional tax return preparers to have and maintain a Written Information Security Plan (WISP). Having a written plan is not optional—it is a legal requirement under the Gramm-Leach-Bliley Act and a condition of maintaining an IRS Electronic Filing Identification Number (EFIN)."
— Internal Revenue Service, Pub 4557 (Rev. 10-2020)
To protect taxpayer identity and prevent fraudulent refund filings, the IRS Security Summit established the "Security Six" baseline safeguards that all tax practitioners must deploy:
1. Anti-Virus Software
Automated definition updates and active endpoint threat scanning on every PC and laptop.
2. Firewalls
Both operating system software firewalls and hardware router firewalls enabled at all office locations.
3. Multi-Factor (MFA)
Mandatory 2-factor authentication for tax software, cloud drives, email, and client portals.
4. Encrypted Backups
Regularly tested off-site and cloud backups encrypted with independent access credentials.
5. Drive Encryption
BitLocker or FileVault full-disk encryption active on all desktop computers, laptops, and flash drives.
6. Virtual Private Network
Encrypted VPN required whenever staff connect from home, hotels, or public Wi-Fi networks.
Why They Must Be Done: The Catastrophic Costs of Inaction
Failing to maintain a Written Information Security Plan and employee training is no longer a harmless paperwork oversight. The legal, operational, and financial repercussions can destroy a firm.
FTC Civil Penalties Up to $53,088 Per Violation
Under Section 5(m)(1)(A) of the FTC Act, the Federal Trade Commission has statutory authority to levy civil penalties of up to $53,088 per violation (each day of a continuing violation can count separately; 16 CFR § 1.98) against financial institutions that fail to implement Safeguards Rule mandates. Consent decrees routinely mandate 20 years of federal auditing oversight at the firm's expense.
Immediate Revocation of IRS EFIN & PTIN
Every tax preparer signs an annual agreement certifying compliance with IRS electronic filing standards. When the IRS discovers that a firm experienced a security incident without having an active, updated WISP and staff training, the IRS Electronic Tax Administration Advisory Committee (ETAAC) immediately suspends the firm's EFIN.
Cyber Insurance Claim Denial Risk
In 2024–2026, cyber insurance carriers require firm partners to complete strict warranty questionnaires: "Does your firm have a written security policy? Do all staff undergo annual training? Is MFA enforced on all portals?"
Following a ransomware event or wire transfer diversion, forensic investigators inspect your WISP and timestamped training records. If you cannot produce signed proof of training (Appendix C) and formal policy documentation, underwriters void the policy for material misrepresentation and deny coverage for ransom, business interruption, and legal defense.
State Breach Notification Laws & Mandatory Forensics
All 50 states have mandatory data breach notification laws. If taxpayer data is exposed without proof of encryption and reasonable security safeguards, the firm must:
- Send formal breach notification letters to all affected clients and State Attorneys General
- Pay for 1–2 years of credit monitoring services for every compromised taxpayer ($50 to $200 per client)
- Defend against civil class-action lawsuits under common law negligence and state consumer protection statutes
Instant CPA Compliance Self-Assessment
Check off the 7 essential controls below to evaluate your practice's audit readiness right now.
Your firm is missing essential legal safeguards required under FTC 16 CFR Part 314 and IRS Pub 4557. You are at severe risk of EFIN suspension and cyber insurance invalidation.
Achieve 100% Federal Compliance in Under 48 Hours
Don't wait for an IRS audit notice, a ransomware incident, or an insurance dispute. CPA Security gives you an automated, legally vetted WISP, complete employee security training, and audit-ready proof in one platform.