Tax Preparer Cybersecurity Compliance 2025: What Changed

Tax Preparer Cybersecurity Compliance in 2026: What You're Now Required to Do

Tax preparer cybersecurity compliance requirements that took shape in 2025 are now fully enforced mandates for the 2026 filing season — and the consequences for non-compliance extend directly to your ability to practice. The IRS ties your Preparer Tax Identification Number (PTIN) and Electronic Filing Identification Number (EFIN) to security compliance, meaning a failure to implement required controls isn't just a regulatory problem. It's a threat to your license to prepare returns.

The scale of the underlying risk explains the regulatory urgency. Tax-related identity theft resulted in over $2.3 billion in fraudulent refunds in 2024, with compromised tax professional credentials accounting for 34% of those incidents according to the IRS Criminal Investigation Division. Tax professionals handle more sensitive financial data per client than most financial institutions — Social Security numbers, investment records, bank account details, and personally identifiable information — making them targets for sophisticated attacks designed to file fraudulent returns before your clients even know they've been compromised.

Three federal frameworks govern what you must do: IRS Publication 4557, the FTC Safeguards Rule under 16 CFR § 314, and applicable state data breach notification laws. Together they require a Written Information Security Plan (WISP), specific technical controls including multi-factor authentication (MFA) and encryption, a designated Qualified Individual responsible for your security program, and documented employee training. This guide walks through each requirement with the specificity needed to build a defensible compliance posture before the 2026 filing season closes.

The Federal Regulatory Framework: Three Overlapping Mandates

Tax preparer cybersecurity compliance sits at the intersection of IRS credential requirements, FTC financial privacy law, and state breach notification statutes. Understanding how these frameworks overlap — and where they diverge — helps you avoid the gaps that regulators and forensic investigators look for after an incident.

IRS Publication 4557: The Security Six Foundation

IRS Publication 4557, titled "Safeguarding Taxpayer Data," establishes six baseline controls that apply to all return preparers who handle taxpayer information. These represent the minimum security posture the IRS expects before issuing or renewing PTIN and EFIN credentials:

• Anti-virus/endpoint protection on every device that accesses tax systems
• Firewalls preventing unauthorized inbound and outbound network access
• Two-factor authentication on tax software, email, and cloud storage
• Drive encryption protecting data at rest on laptops, desktops, and external drives
• Backup procedures using offline or cloud-based storage with tested restoration
• Software updates applied promptly to patch known vulnerabilities

The IRS can suspend or revoke PTIN and EFIN credentials for practitioners who fail to implement these controls. For a detailed breakdown of how credential requirements intersect with security documentation, see our guide to PTIN and WISP requirements for tax preparers.

FTC Safeguards Rule: Program-Level Security Requirements

The Gramm-Leach-Bliley Act (GLBA) Safeguards Rule under 16 CFR § 314, enforced by the Federal Trade Commission, requires financial institutions — a category that includes tax preparation firms under GLBA — to develop, implement, and maintain information security programs. The June 2023 amendments removed prior size-based exemptions entirely, meaning solo practitioners and two-person offices face the same requirements as regional accounting firms.

The rule mandates designation of a Qualified Individual responsible for overseeing, implementing, and enforcing the security program. This person must have the authority and resources to implement controls and must report program status to the board or senior management at least annually. For solo practitioners, the tax professional typically serves as their own Qualified Individual. For the full scope of FTC requirements, our FTC Safeguards Rule guide for tax preparers covers each of the 16 program elements the rule specifies.

Written Information Security Plan: Your Compliance Backbone

The WISP sits at the center of both IRS and FTC compliance. IRS Publication 5708 provides a sample WISP structure the agency officially recommends, while the FTC Safeguards Rule specifies 16 program elements a compliant plan must address. A WISP that satisfies the FTC's requirements generally meets or exceeds IRS expectations simultaneously.

A compliant WISP must document your risk assessment findings and remediation plans, describe the technical and administrative controls you have in place, name your Qualified Individual and define their responsibilities, outline your vendor oversight procedures, and specify your incident response and breach notification procedures. The plan must be reviewed at minimum annually and updated whenever you add systems, change vendors, or experience a security incident. Each revision should carry a date, and prior versions should be retained for at least three years to demonstrate compliance history.

Our IRS Written Information Security Plan guide covers specific elements you need, and our WISP template for tax preparers provides a ready-to-customize document aligned with both IRS Publication 4557 and the FTC Safeguards Rule. For a broader look at the compliance package, the all-in-one compliance package bundles templates, training resources, and review procedures into a single system.

Many practitioners download a template and file it away without customizing it to their actual environment. Regulators and forensic investigators examining a post-breach WISP will immediately identify generic language that doesn't reflect real controls. A document naming your specific tax software, your cloud storage provider, your MFA application, and your backup vendor is defensible under scrutiny. A generic one is not.

Technical Controls: Building Defense-in-Depth Protection

Endpoint Detection and Response vs. Traditional Antivirus

The IRS Security Six requires anti-virus software, but signature-based antivirus no longer provides adequate protection against the threats actively targeting tax practices. Modern ransomware uses polymorphic code and fileless attack techniques that evade signature detection entirely. Endpoint Detection and Response (EDR) solutions address this through behavioral analysis — detecting suspicious activity patterns rather than waiting for a known malware signature.

According to the IBM Cost of Data Breach Report 2025, organizations using EDR detected breaches 220 days faster than those relying on legacy antivirus, reducing average breach costs by $1.76 million. For a tax practice handling thousands of returns containing Social Security numbers and financial account data, detection speed is the difference between a contained incident and a practice-ending breach. Our guide to managed detection and response for small businesses explains how tax practices can access enterprise-grade EDR without dedicated IT staff.

Multi-Factor Authentication: Implementation Quality Matters

Microsoft's security research demonstrates that MFA blocks 99.9% of automated credential attacks. However, implementation quality determines how much of that protection you actually receive. SMS-based authentication — receiving a verification code via text message — provides weaker protection than app-based or hardware token methods because SIM-swapping attacks can redirect your text messages to an attacker's device before you ever see the code.

The NIST Special Publication 800-63B Digital Identity Guidelines rank authentication methods by assurance level. For tax professionals, authenticator app-based MFA — Google Authenticator, Microsoft Authenticator, Duo — provides the Level 2 assurance that satisfies both IRS and FTC requirements. Hardware security keys using FIDO2/WebAuthn provide Level 3 assurance and are increasingly supported by major tax software platforms.

MFA must be enabled on every system that stores or processes taxpayer data: your tax preparation software, email, cloud document storage, client portal, and any remote access tools. Enabling MFA on some systems while leaving others unprotected creates the gaps attackers look for first. For the specific threats facing client-facing portals and remote access tools, our analysis of online tax filing security risks covers the most common attack vectors.

Employee Security Training: Turning Your Biggest Risk Into a Defense Asset

The Verizon 2025 Data Breach Investigations Report attributes 82% of breaches to the human element — phishing, credential misuse, and social engineering. For tax practices, that risk concentrates during January through April when filing volume peaks and staff are processing high volumes of client communications under time pressure. Attackers time their campaigns accordingly.

The FTC Safeguards Rule mandates documented security training for all personnel with access to customer information, delivered during onboarding and periodically thereafter based on role, responsibilities, and the evolving threat environment. During filing season, the threats your team needs to recognize include:

• W-2 phishing schemes — fraudulent emails impersonating employers or clients requesting employee tax documents for supposed verification, designed to harvest credentials or deliver malware
• IRS impersonation calls — callers posing as IRS agents demanding immediate action on supposed compliance issues, used to extract login credentials or authorize fraudulent wire transfers
• Business email compromise (BEC) — spoofed executive emails requesting urgent wire transfers or changes to direct deposit information, timed to coincide with the administrative load of filing season
• Credential harvesting sites — fake tax software login pages distributed via phishing emails that capture credentials and relay them to attackers in real time

Training documentation requirements under the FTC Safeguards Rule include signed attendance rosters, completion certificates from your training platform, quiz scores demonstrating understanding (an 80% passing threshold is a reasonable benchmark), and records of annual refresher sessions. The IRS Security Summit program publishes free training materials at IRS.gov each filing season that meet FTC documentation requirements when paired with sign-in sheets and completion acknowledgments.

Incident Response Planning and Breach Notification Requirements

A documented incident response plan serves two distinct purposes: it reduces breach costs by enabling faster, more organized response, and it demonstrates regulatory good faith when you're required to notify agencies and affected individuals. The IBM Cost of Data Breach Report found that organizations with documented response plans detected breaches 54 days faster and saved an average of $1.49 million compared to firms without formal plans.

The FTC Safeguards Rule mandates written incident response procedures. The NIST Computer Security Incident Handling Guide (Special Publication 800-61) provides the standard four-phase framework that regulators recognize: Preparation, Detection and Analysis, Containment/Eradication/Recovery, and Post-Incident Activity. Your tax practice incident response plan should follow this structure and include specific contact lists, escalation procedures, pre-drafted notification templates, and a tested restoration procedure for your backup systems.

Breach Notification: Who You Must Notify and When

Notification timelines run from the date of discovery — when you have reasonable belief that unauthorized access occurred — not from the actual breach date, which may be weeks earlier. Multi-layered notification requirements mean you may simultaneously report to federal agencies, state regulators, and affected clients:

• IRS notification — report immediately through the IRS Data Theft Information Reporting System when PTIN, EFIN, or e-Services credentials are compromised; also contact your local IRS stakeholder liaison directly
• FTC notification — required under GLBA Safeguards Rule for breaches affecting consumer financial information that trigger state notification thresholds
• State notification — all 50 states have breach notification laws with varying timelines (30–90 days is typical) and scope; some require notification to the state attorney general in addition to affected individuals
• FBI IC3 reporting — submit a complaint at ic3.gov for cybercrime incidents including ransomware and business email compromise; this assists federal investigations and supports cyber liability insurance claims

Pre-drafting notification letters and maintaining a current client contact list is part of incident preparation, not something to build during an active breach. Build these materials into your WISP and test them before you need them.

Vendor Oversight, Ongoing Monitoring, and PTIN Documentation

Third-Party Risk Management

Tax practices rely on cloud-based tax software, document management portals, payroll services, and IT support providers — all of which handle or can access client data. The FTC Safeguards Rule explicitly requires tax professionals to exercise due diligence when selecting service providers and to include contractual data protection obligations in vendor agreements.

Before engaging any vendor with access to taxpayer data, verify their security posture by reviewing their SOC 2 Type II report, ISO 27001:2022 certification, or equivalent independent security attestation. Request a completed security questionnaire covering encryption standards, access controls, breach notification timelines, and their own vendor oversight practices. Your vendor contracts must include encryption requirements for data in transit and at rest, defined access controls limiting which personnel can reach your client data, a notification obligation requiring the vendor to alert you within a defined window of discovering a breach affecting your data, audit rights allowing periodic security reviews, and a data deletion procedure specifying how your information is destroyed when the contract ends.

PTIN Renewal: What the IRS Wants to See

The IRS increasingly scrutinizes security practices during PTIN renewal, with examiners requesting evidence of implemented controls and documented policies. Be prepared to produce the following on request when renewing for the 2026 filing season and beyond:

• Screenshots showing active EDR or antivirus protection on all devices used for tax work
• Firewall configuration documentation demonstrating network perimeter controls
• MFA enabled on tax software and email (settings screenshots serve as documentation)
• Drive encryption verification — BitLocker on Windows, FileVault on Mac
• Backup procedure documentation including schedules and restoration test results
• Your Written Information Security Plan with a current-year revision date
• Employee training records with signed rosters, completion certificates, and assessment scores
• Vendor contracts with data protection clauses for all service providers
• Your incident response plan with tested notification procedures and pre-drafted letters
• Annual risk assessment results documenting current threats and control effectiveness

Organize these documents in labeled electronic folders with version control and a backup copy. A well-organized compliance folder takes minutes to produce under examination pressure; a disorganized one takes days and creates a poor first impression with investigators. For full guidance on the data protection requirements applicable to tax practices, and for the latest IRS sample plan language, our IRS Publication 5708 sample WISP guide explains how to use the agency's own template as your starting point.