Reviewed by Dallas Stewart, President & Owner, CMIT Solutions of Bellevue. Last updated: October 2026.
Cybersecurity for accounting firms means protecting client tax returns, bank details and financial records from theft, fraud and ransomware. The basics are multi-factor authentication (MFA), email security and encrypted devices. Tested backups, staff training and a written security plan complete the foundation.
Accounting and CPA firms hold exactly the data criminals want, and tax season brings a wave of targeted scams. This guide to cybersecurity for CPA firms explains the biggest risks and the security rules for tax professionals. It also lists the steps firms on Seattle’s Eastside and beyond should take.
Why are accounting firms targeted by cybercriminals?
Accounting firms store Social Security numbers, bank account details, payroll data and tax returns for many clients at once. That information can be used for identity theft and fraudulent tax refunds. Firms also move money and handle payment instructions, which makes them targets for wire fraud. Many small firms have limited IT staff, so attackers expect weaker defenses.
What are the biggest cyber threats to accounting firms?
- Phishing and fake client emails. Criminals pose as new clients or the IRS to get staff to open malware.
- Business email compromise. Hacked or spoofed email accounts are used to change payment instructions.
- Ransomware. Attackers encrypt client files and tax software, often during busy season.
- Account takeover. Stolen passwords give criminals access to tax software, portals and email.
- Lost or stolen devices. Laptops and phones often hold client files.
Which security rules apply to accounting and tax firms?
What does the FTC Safeguards Rule require?
Under the Gramm-Leach-Bliley Act, the FTC Safeguards Rule applies to many tax preparers and accounting firms. It covers firms that handle customer financial information. The rule requires a written information security program with safeguards such as access controls, encryption, MFA, monitoring and staff training. Firms must also notify the FTC of certain security events that affect the information of 500 or more consumers.
What is a Written Information Security Plan (WISP)?
The IRS expects tax professionals to keep a written plan that describes how they protect taxpayer data. IRS Publication 4557, Safeguarding Taxpayer Data, and the IRS sample WISP explain what to include.
What are the IRS “Security Six”?
The IRS recommends six basic protections for tax professionals. They are antivirus software, a firewall, multi-factor authentication and backup software. The list also includes drive encryption and a virtual private network (VPN) for remote access.
What should an accounting firm cybersecurity plan include?
- MFA on email, tax software, client portals and remote access
- Email filtering and DMARC to block spoofed messages
- Encrypted laptops, phones and backups
- Daily backups with one copy kept offline or isolated, and regular restore tests
- Automatic security updates and endpoint protection
- Unique logins and access based on each person’s role
- Security awareness training before tax season
- A written incident response plan and a WISP
How can accounting firms prevent wire and payment fraud?
Confirm any new or changed payment instructions by phone, using a number already on file. Never rely on contact details in the email that requested the change. Require a second approval for large transfers, and tell clients that your firm will never change bank details by email.
How should firms share files with clients securely?
Avoid sending tax returns and financial documents as regular email attachments. Use a secure client portal or encrypted file sharing, turn on MFA for client accounts and set links to expire. Delete shared copies when they are no longer needed.
How should firms prepare for tax season?
Tax season is when attacks peak and downtime hurts most. Before it starts, update all systems and test your backups. Review who has access to tax software, and run a short phishing refresher for every staff member. Make sure your IT provider knows your busiest weeks.
How should accounting firms protect remote and hybrid work?
Many accountants work from home during busy season. Remote access should go through a secure connection such as a VPN or a managed remote desktop, with MFA on every login. Firm laptops should be encrypted and managed, so they can be locked or wiped if lost. Avoid using personal computers for client work unless they meet the same standards.
What should a firm do if client data is exposed?
Act fast and follow your incident response plan. Isolate affected devices, reset compromised passwords and call your IT provider. If taxpayer data was stolen, contact your IRS stakeholder liaison so the IRS can help protect affected clients. Review your obligations under the FTC Safeguards Rule and state breach notification laws, and keep records of every step.
How do you train staff on accounting firm cybersecurity?
Training works best when it is short, regular and specific to accounting. Show real examples of fake client emails, IRS impersonation and payment change requests. Run simulated phishing tests before and during tax season. Make it easy to report suspicious messages, and recognize staff who catch them.
What else do firms ask about accounting firm cybersecurity?
Does the FTC Safeguards Rule apply to small accounting firms?
It applies to many tax preparers and accounting firms that handle customer financial information, regardless of size. Check with your advisors to confirm how it applies to your firm.
What is the most important first step?
Turn on MFA for email and tax software. It blocks most attacks that rely on stolen passwords.
How much does cybersecurity cost for a CPA firm?
It depends on the number of users and systems. Many firms use a managed IT provider for a predictable monthly fee that covers monitoring, security tools, backups and support.
How can CMIT Solutions of Bellevue help accounting firms?
CMIT Solutions of Bellevue helps accounting and CPA firms on Seattle’s Eastside protect client data. We provide MFA, email security, encrypted backups, monitoring and help with security planning.
Call (425) 495-2214 to talk with our local team about cybersecurity for your accounting firm.
