Cybersecurity Checklist for Enrolled Agents 2026

Why Enrolled Agents Face Elevated Cybersecurity Risk in 2026

Enrolled agents (EAs) are federally authorized tax practitioners licensed by the U.S. Department of the Treasury to represent taxpayers before the Internal Revenue Service. That authorization creates privileged access to some of the most valuable data criminals target: Social Security numbers, employer identification numbers, multi-year income and banking records, and IRS e-filing credentials for every client in the practice.

The IRS explicitly identifies tax professionals as a priority target for identity theft rings. A single compromised EA account can supply criminals with enough information to file fraudulent returns, open credit lines, or sell taxpayer records in bulk on the dark web. The IRS "Protect Your Clients; Protect Yourself" initiative, documented in IRS Publication 4557, was created precisely because tax practitioner data breaches have exposed hundreds of thousands of taxpayer records in recent years.

This cybersecurity checklist for enrolled agents consolidates the 2026 requirements from IRS Publication 4557, the Federal Trade Commission (FTC) Safeguards Rule, and National Institute of Standards and Technology (NIST) guidance into one actionable framework. Work through each section to identify gaps, assign ownership, and document your compliance status, all of which your Written Information Security Plan (WISP) must reflect.

For a broader view of security obligations across the tax profession, see our guide to cybersecurity for tax professionals.

IRS and FTC Requirements Enrolled Agents Must Meet

IRS Publication 4557: Safeguarding Taxpayer Data

IRS Publication 4557, "Safeguarding Taxpayer Data," is the primary compliance reference for all tax professionals, including enrolled agents. It outlines eight core security practices the IRS expects every practitioner to implement: creating a WISP, using strong authentication, encrypting data, training employees, restricting access, installing security software, backing up data, and establishing an incident response plan.

Publication 4557 is not a standalone advisory, it references the Gramm-Leach-Bliley Act (GLBA), under which the FTC's Safeguards Rule applies to tax return preparers who earn compensation. Failure to comply can result in IRS referrals, loss of e-filing privileges, and potential FTC enforcement action. Our detailed breakdown of tax safeguard compliance 4557 explains each requirement in depth.

FTC Safeguards Rule (Amended 2023)

The FTC Safeguards Rule, in its updated form effective since 2023, designates tax preparers, including enrolled agents, as "financial institutions" under GLBA. This classification carries specific information security program requirements that go beyond general best practices:

• Designate a qualified individual to oversee the information security program
• Conduct and document written risk assessments
• Implement technical safeguards including access controls, encryption, and multi-factor authentication (MFA)
• Monitor and test security controls on a regular schedule
• Maintain a written incident response plan
• Oversee service provider security arrangements through contracts or due diligence reviews

For enrolled agents operating as sole proprietors with fewer than 5,000 customer records, a simplified compliance path exists, but the core written program requirements still apply. Our FTC Safeguards Rule for tax preparers guide walks through every element of the amended rule.

PTIN Renewal and Security Obligations

Every enrolled agent must maintain a Preparer Tax Identification Number (PTIN). While PTIN renewal does not include a formal security audit, the IRS has indicated that practitioners who experience data breaches and cannot demonstrate an active security program face heightened scrutiny. Understanding the link between PTIN and WISP requirements for tax preparers protects both your license and your clients.

Technical Controls Every Enrolled Agent Needs in Place

Multi-Factor Authentication

MFA is the single most effective technical control against unauthorized account access. The IRS requires enrolled agents and all tax professionals to use MFA on tax preparation software, IRS e-services, and email. For 2026, NIST Special Publication 800-63B designates phishing-resistant MFA, hardware security keys (FIDO2/WebAuthn) or certificate-based authentication, as the preferred approach for accounts holding sensitive data. Our post on NIST phishing-resistant MFA security keys explains the options available to small practices.

At minimum, enable authenticator app-based MFA (such as Google Authenticator or Microsoft Authenticator) on every account that stores or processes taxpayer data. SMS-based one-time codes provide some protection, but the IRS and NIST recommend moving away from SMS for high-value accounts because SIM-swapping attacks have successfully bypassed SMS-based codes in documented incidents.

Endpoint Detection and Encryption

Every device that touches taxpayer data, desktop, laptop, tablet, and portable drive, must be encrypted. BitLocker (Windows) and FileVault (macOS) provide full-disk encryption at no additional cost. For portable media, hardware-encrypted USB drives add a physical layer of protection against loss or theft.

Beyond encryption, enrolled agents should deploy Endpoint Detection and Response (EDR) software rather than legacy antivirus alone. EDR monitors for behavioral indicators of compromise in real time and can isolate an infected device before malware spreads across the practice network. If your tax software vendor offers an agent-based security monitor, enable it, several major vendors now include basic endpoint security as part of their subscription.

Secure Tax Software Practices

Your tax preparation software is both your most valuable tool and one of your highest-risk access points. Follow these controls for every platform in your stack:

• Apply all security patches within 30 days of release, or sooner for vulnerabilities the vendor rates as high severity
• Use unique passwords of 16 or more characters for each platform, a password manager is the most practical way to manage this, as outlined in our CISA password manager guidance post
• Audit user access lists quarterly; revoke credentials immediately when staff leave or change roles
• Review vendor security documentation annually to verify that your software transmits and stores data using current encryption standards

For a detailed look at how major platforms handle client data, see our analysis of whether tax preparation software is secure for personal information in 2025-2026.

Building a WISP That Satisfies IRS and FTC Requirements

A Written Information Security Plan is the foundation of your compliance program. The IRS published a sample WISP in IRS Publication 5708 specifically to help tax professionals, including enrolled agents, create plans that satisfy both Publication 4557 and the FTC Safeguards Rule. Your WISP must address six core areas:

1. Scope and purpose: Define which data, systems, and personnel the plan covers
2. Risk assessment: Identify and document threats to the confidentiality, integrity, and availability of taxpayer data
3. Safeguards: Map technical, administrative, and physical controls to each identified risk
4. Employee training: Describe how and when staff receive security training and who is responsible for delivering it
5. Service provider oversight: List vendors who access your systems and document how you verify their security posture
6. Incident response: Define what constitutes a breach, who is notified, the notification timeline, and how the practice recovers

For enrolled agents running solo practices, the IRS offers a simplified WISP format. Our WISP template for sole proprietors adapts the Publication 5708 sample to single-preparer practices with fillable sections for every required element. You can also access our broader guide to creating an IRS Written Information Security Plan for step-by-step instructions.

Update your WISP whenever you add a service provider, change your software stack, hire or terminate employees with system access, or experience a security incident. At minimum, review the document annually and record the review with a dated signature. The FTC Safeguards Rule requires evidence that the program is actively managed, an undated, unreviewed WISP does not satisfy the rule's requirements.

Incident Response: What Enrolled Agents Must Do After a Breach

When a data breach occurs, whether through phishing, ransomware, unauthorized access, or a vendor compromise, enrolled agents face a narrow response window. The IRS requires tax professionals to report a breach to their IRS Stakeholder Liaison within 24 hours of discovery. Delays in notification can result in additional regulatory scrutiny and expose clients to preventable harm during the window when fraudulent returns could still be filed.

A sound incident response sequence for enrolled agents looks like this:

1. Contain immediately: Disconnect affected systems from the internet and your practice network. Do not attempt to clean the system yourself before preserving forensic evidence, premature remediation can destroy the information needed to determine what was accessed.
2. Assess scope: Determine which client records were accessed or exfiltrated, the estimated timeframe of unauthorized access, and the likely attack vector (phishing link, stolen credentials, unpatched vulnerability).
3. Report to the IRS within 24 hours: Contact your local IRS Stakeholder Liaison and provide your name, EFIN, contact information, the number of potentially affected clients, and a brief description of what occurred.
4. Notify affected clients: State data breach notification laws govern client notification timelines, most states require notification within 30 to 90 days. Consult legal counsel before sending notifications to ensure you meet applicable state law requirements.
5. File a police report: A police report documents the incident for cyber insurance claims and regulatory purposes.
6. Remediate and update your WISP: After the investigation, close the vulnerability that enabled the breach, update your WISP to reflect lessons learned, and document every step taken with timestamps.

Enrolled agents who discover unauthorized use of their Electronic Filing Identification Number (EFIN) should also submit IRS Form 14157, Complaint: Tax Return Preparer. Our tax season cybersecurity preparation guide for CPA firms includes an incident response checklist template you can adapt to your EA practice. For a broader look at protecting client portal data, see our analysis of security of tax client portals and sensitive data.