Why Enrolled Agents Face Elevated Cybersecurity Risk in 2026
Enrolled agents hold Social Security numbers, employer identification numbers, multi-year income records, and IRS e-filing credentials for every client on their roster, which makes a single compromised EA account valuable to identity theft rings. This cybersecurity checklist for enrolled agents 2026 consolidates current IRS Publication 4557, FTC Safeguards Rule, and NIST requirements into one list you can use to find gaps, assign ownership, and document compliance in your Written Information Security Plan (WISP).
The Internal Revenue Service, an agency within the U.S. Department of the Treasury, names tax professionals as a priority target for identity theft rings because one practitioner breach can expose data from an entire client roster at once. According to IBM's Cost of a Data Breach Report 2024, the average global breach cost $4.88 million, and Verizon's 2024 Data Breach Investigations Report found that 68% of breaches involved a human element such as a phishing click or a stolen credential. The IRS built its "Protect Your Clients; Protect Yourself" campaign, documented in IRS Publication 4557, after repeated tax preparer breaches exposed hundreds of thousands of taxpayer records.
Enrolled agents, federally authorized by the Treasury Department to represent taxpayers before the IRS, carry that same exposure whether they run a solo practice or a multi-preparer firm. For a broader view of the risks EAs share with other preparers, see our guide to identity theft prevention for tax professionals.
Quick Answer
A 2026 cybersecurity checklist for enrolled agents covers eight requirements drawn from IRS Publication 4557 and the FTC Safeguards Rule: a written WISP, phishing-resistant MFA on every account, patching within 30 days, full-disk encryption, annual security training, role-based access controls, encrypted off-site backups tested monthly, and a tested incident response plan with 24-hour IRS breach notification. Enrolled agents who prepare returns for compensation are classified as financial institutions under the Gramm-Leach-Bliley Act, so the written program requirement is not optional.
Key Takeaway
Enrolled agents need a written WISP, phishing-resistant MFA, full-disk encryption, annual staff training, role-based access controls, and encrypted backups tested monthly. Any breach must be reported to the IRS Stakeholder Liaison within 24 hours. The FTC Safeguards Rule, effective since 2023, classifies paid preparers as financial institutions under the Gramm-Leach-Bliley Act, which makes these controls a written program requirement rather than a suggestion.
The Cost of Inaction: Data Breach Risk by the Numbers
IRS and FTC Requirements Enrolled Agents Must Meet in 2026
IRS Publication 4557: Safeguarding Taxpayer Data
IRS Publication 4557, "Safeguarding Taxpayer Data," is the IRS's primary compliance reference for every paid tax return preparer, including enrolled agents. According to the IRS, it outlines eight practices every practitioner should implement: a WISP, strong authentication, data encryption, employee training, restricted access, security software, data backups, and an incident response plan.
Publication 4557 points to the Gramm-Leach-Bliley Act (GLBA), a federal law that regulates how financial institutions handle consumer data, as the basis for applying the FTC Safeguards Rule to tax preparers who earn compensation. A practitioner who ignores these requirements risks an IRS referral, loss of e-filing privileges, or FTC enforcement action.
FTC Safeguards Rule (Amended 2023)
The FTC Safeguards Rule, updated in 2023, classifies tax preparers, including enrolled agents, as financial institutions under GLBA. That classification requires a written information security program with specific elements:
FTC Safeguards Rule Program Elements
- Designate a qualified individual to oversee the information security program
- Conduct and document a written risk assessment
- Implement access controls, encryption, and multi-factor authentication
- Monitor and test security controls on a regular schedule
- Maintain a written incident response plan
- Oversee service provider security through contracts or due-diligence reviews
Enrolled agents operating as sole proprietors with fewer than 5,000 customer records can use a simplified compliance path, but the written program requirement still applies. Our guide to the qualified individual requirement under the FTC Safeguards Rule covers how small practices can satisfy this role without a dedicated security hire.
PTIN Renewal and Security Obligations
Every enrolled agent must maintain a Preparer Tax Identification Number (PTIN), the IRS-issued identifier required to prepare returns for compensation. PTIN renewal itself does not include a security audit, but the IRS has indicated that practitioners who suffer a breach and cannot show an active security program face heightened scrutiny during any related review.
Does Your EA Practice Have a Compliance Gap?
Tap the ones that sound like you.
Tap every statement that applies to you.
A WISP Is a Legal Requirement, Not a Best Practice
The FTC Safeguards Rule classifies tax return preparers as financial institutions under the Gramm-Leach-Bliley Act and requires a written information security program for any practitioner who handles client financial data for compensation. Enrolled agents without a documented WISP are not meeting this federal requirement. The IRS separately requires practitioners to report a data breach to their IRS Stakeholder Liaison within 24 hours of discovery.
Need a WISP Built for Your Practice?
Bellator Cyber Guard builds a custom Written Information Security Plan starting at $749 for practices with up to 5 users, with a custom quote for larger firms; most practices recover that cost through 20 to 40 hours of billable time saved versus building a WISP from scratch.
Your 2026 Compliance Checklist
Tap each step as you finish it. Your progress is saved on this device.
0 of 8 done
Technical Controls Every Enrolled Agent Needs in Place
Multi-Factor Authentication
Multi-factor authentication (MFA) requires a second proof of identity beyond a password, and it is the single most effective technical control against unauthorized account access. The IRS requires MFA on tax preparation software, IRS e-services accounts, and email. NIST Special Publication 800-63B, the federal digital identity guideline, names phishing-resistant MFA, hardware security keys using the FIDO2/WebAuthn standard or certificate-based authentication, as the preferred method for accounts holding sensitive data in 2026.
At minimum, enable authenticator app MFA, such as Google Authenticator or Microsoft Authenticator, on every account that stores or processes taxpayer data. SIM-swapping attacks have bypassed SMS-based codes in documented incidents, which is why the IRS and NIST both recommend moving away from SMS for high-value accounts. Our guide to setting up MFA on your IRS Tax Pro Account walks through the enrollment steps.
Endpoint Detection and Encryption
Every device that touches taxpayer data, desktop, laptop, tablet, or portable drive, needs full-disk encryption. BitLocker on Windows and FileVault on macOS provide this at no added cost, and hardware-encrypted USB drives add a physical safeguard for portable media.
Legacy antivirus alone is no longer sufficient. Endpoint Detection and Response (EDR) software monitors for behavioral indicators of compromise in real time and can isolate an infected device before malware spreads across the practice network. Our overview of EDR for small business explains how it differs from traditional antivirus.
Secure Tax Software Practices
Tax preparation software is both your most valuable tool and one of your highest-risk access points. When comparing tax software for enrolled agents, security configuration deserves the same weight as price or feature set. Apply these controls across every platform in your stack:
Tax Software Security Controls
- Apply security patches within 30 days of release, sooner for anything the vendor rates high severity
- Use unique passwords of 16 or more characters per platform, managed through a password manager
- Audit user access lists quarterly and revoke credentials immediately when staff leave or change roles
- Review vendor security documentation annually to confirm current encryption standards
A password manager, software that generates and stores unique credentials so staff never reuse passwords across platforms, is the most practical way to meet the 16-character requirement at scale. Our comparison of password managers for compliance auditing covers options suited to small practices.
Building a WISP That Satisfies IRS and FTC Requirements
A WISP is the foundation of your compliance program. The IRS published a sample plan in Publication 5708 to help tax professionals build a plan that satisfies both Publication 4557 and the FTC Safeguards Rule. Your WISP needs to cover six areas:
Six Required WISP Components
Scope and purpose
Define which data, systems, and personnel the plan covers.
Risk assessment
Identify and document threats to the confidentiality, integrity, and availability of taxpayer data.
Safeguards
Map technical, administrative, and physical controls to each identified risk.
Employee training
Describe how and when staff receive security training and who delivers it.
Service provider oversight
List vendors who access your systems and how you verify their security posture.
Incident response
Define what counts as a breach, who gets notified, the timeline, and how the practice recovers.
Update your WISP whenever you add a service provider, change your software stack, hire or terminate staff with system access, or experience an incident, and review it at least annually with a dated signature. The FTC Safeguards Rule requires evidence that the program is actively managed; an undated, unreviewed WISP does not satisfy that requirement. See our broader look at building a WISP for small and medium businesses for additional detail.
Incident Response: What Enrolled Agents Must Do After a Breach
Whether a breach starts with phishing, ransomware, unauthorized access, or a vendor compromise, enrolled agents have a narrow response window. The IRS requires practitioners to report a breach to their IRS Stakeholder Liaison, a regional IRS contact for tax professional issues, within 24 hours of discovery. Delays can trigger added regulatory scrutiny and leave clients exposed while fraudulent returns are still being filed.
Incident Response Sequence
Contain immediately
Disconnect affected systems from the internet and your network. Do not clean the system before preserving evidence; premature remediation can destroy proof of what was accessed.
Assess scope
Determine which client records were accessed, the likely timeframe, and the attack vector, such as a phishing link, stolen credentials, or an unpatched vulnerability.
Report to the IRS within 24 hours
Contact your local IRS Stakeholder Liaison with your name, Electronic Filing Identification Number (EFIN), contact information, the number of potentially affected clients, and a brief description of what happened.
Notify affected clients
State breach notification laws set client notification timelines; most require notice within 30 to 90 days. Confirm requirements with legal counsel.
File a police report
A police report documents the incident for cyber insurance claims and regulatory purposes.
Remediate and update the WISP
Close the vulnerability, update the WISP with lessons learned, and log every step with timestamps.
Enrolled agents who discover unauthorized use of their EFIN should also file IRS Form 14157, Complaint: Tax Return Preparer. For a closer look at the reporting process, see our page on tax professional data breach response.
Book a Free Tax Cybersecurity Assessment
Bellator Cyber Guard's tax security specialists will review your WISP, MFA setup, and controls against IRS Publication 4557 and FTC Safeguards requirements, then hand you a prioritized action plan.
Frequently Asked Questions
Yes. Enrolled agents who prepare returns for compensation are classified as financial institutions under the Gramm-Leach-Bliley Act, which means the FTC Safeguards Rule's written information security program requirement applies to their practices. IRS Publication 4557 also directs tax professionals to create and maintain a WISP.
IRS Publication 4557, "Safeguarding Taxpayer Data," lists eight requirements: a WISP, strong authentication including MFA, encryption of data in transit and at rest, employee security training, need-to-know access restrictions, security software, secure data backups, and a tested incident response plan. The full publication is available from the IRS.
The IRS requires MFA on tax software, IRS e-services accounts, and email. NIST SP 800-63B names phishing-resistant MFA, hardware security keys using FIDO2/WebAuthn or certificate-based authentication, as the preferred method for 2026. Authenticator app codes are an acceptable alternative for most small practices; the IRS and NIST both recommend moving away from SMS codes because of documented SIM-swapping attacks.
Disconnect affected systems from the network without attempting cleanup first, assess which client records were potentially accessed, and report the incident to your IRS Stakeholder Liaison within 24 hours with your EFIN and the estimated number of affected clients. File a police report, notify affected clients under your state's breach notification law (most require notice within 30 to 90 days), and update your WISP once remediation is complete.
Review and sign off on the WISP at least once a year; the FTC Safeguards Rule requires evidence that the program is actively managed, and an undated or unreviewed WISP does not satisfy that requirement. Update it outside the annual cycle whenever you change software, add a vendor, change staff with system access, or experience an incident.
The IRS can suspend or revoke an EA's EFIN, which ends the ability to e-file client returns. The FTC can pursue civil enforcement for Safeguards Rule violations, with penalties that can reach tens of thousands of dollars per violation, and enrolled agents are also subject to Circular 230 discipline, which can include censure, suspension, or disbarment from practice before the IRS. A breach that exposes client data can also create civil liability under state breach notification laws; practitioners should consult legal counsel on specific exposure.
From requirement to defensible practice
Turn IRS and FTC expectations into a WISP your office can follow
A useful compliance path makes the obligation clear, identifies the evidence to retain, and connects written policy to the safeguards used every day.
People also look for
Keep exploring Tax security & WISP
Understand what tax professionals need to document, protect, and prepare before an IRS or FTC review.
- Common question: free WISP templateStart with a written information security planUse a practical WISP framework built around the safeguards tax practices need.
- Common question: IRS Publication 4557 requirementsRead the Publication 4557 guideSee how the IRS expects tax professionals to safeguard taxpayer data.
- Common question: IRS WISP requirementsReview the WISP requirementsWork through the required sections and the evidence your practice should retain.
- Common question: FTC Safeguards Rule checklistUse the FTC Safeguards checklistTranslate the rule into a clear list of security and documentation tasks.
- Common question: tax practice incident response planPrepare a tax-office incident planKnow who to contact, what to preserve, and how to respond to a client-data incident.
