If you're trying to find tax software options that prioritize top security measures, start with one question: does the platform let you enforce two-factor authentication (2FA) for every user, or does it just offer 2FA as something staff can turn on if they remember to? Every major professional tax platform, including Drake Tax, Lacerte, ProSeries, CCH Axcess, and Thomson Reuters UltraTax CS, supports 2FA in 2026. The real difference between platforms is enforcement, method strength, and how well the platform documents authentication for compliance.
Two-factor authentication (2FA) is a security control that requires two different types of proof of identity, such as a password plus a code from a phone app, before granting access to an account. Tax preparers handle Social Security numbers, bank account details, and financial records for thousands of clients, and a single compromised login exposes all of it. Under IRS Publication 4557, multi-factor authentication is a required baseline control, not an optional upgrade. A firm that skips it does not meet that requirement, and that gap shows up during PTIN renewal reviews and IRS audits.
Quick Answer
Every major tax platform, Drake Tax, Lacerte, ProSeries, CCH Axcess, and Thomson Reuters UltraTax CS, supports two-factor authentication in 2026, so availability is not what separates a secure option from a weak one. The differentiator is enforcement: can an administrator require 2FA for every user, or does each person have to opt in on their own? CCH Axcess and Drake Tax currently support firm-wide enforcement from an admin console. Intuit's Lacerte and ProSeries require each user to enable 2FA individually unless the firm adds practice management tools on top.
2FA Security, By the Numbers
What "Top Security" Actually Means for Tax Software
The IRS Security Six framework is a set of six baseline cybersecurity controls, detailed in IRS Publication 4557, that the IRS directs every tax professional to put in place to protect taxpayer data. Multi-factor authentication is one of the six, alongside antivirus protection, a firewall, encrypted backups, drive encryption, and VPN security. According to the Verizon 2024 Data Breach Investigations Report, 68% of breaches involve a human element such as stolen credentials, which is exactly the attack path 2FA is designed to close.
So when you're comparing tax software, "prioritizes security" should mean the platform gives you control over authentication, not just the option to turn it on. That means firm-wide enforcement, support for phishing-resistant methods, and authentication logs you can hand to an auditor.
What to Ask When Evaluating Tax Software Security
- Can an administrator enforce 2FA for every user, or does each person opt in individually?
- Does the platform support TOTP authenticator apps and FIDO2 hardware keys, not just SMS codes?
- Can you export authentication logs for monthly review and WISP documentation?
- Does it integrate with an identity provider, like Microsoft Entra ID, for centralized single sign-on?
- Is there a documented recovery process for a lost or replaced device?
- Does the platform support session timeout and re-authentication after inactivity?
- Is drive encryption and role-based access control available alongside 2FA?
How the Authentication Methods Compare
Authentication factors fall into three categories: something you know, like a password, something you have, like a phone or hardware key, and something you are, like a fingerprint. True 2FA combines factors from two different categories. A password plus a security question is not 2FA, because both are things you know. A password plus a code from an authenticator app is 2FA, because it pairs something you know with something you have.
Time-based one-time password (TOTP) authentication generates a temporary code, usually 6 to 8 digits, from an app on your phone that changes every 30 seconds. FIDO2 is an authentication standard that uses a physical hardware key or device-based authenticator to verify identity through public-key cryptography, so there is no shared secret for an attacker to steal. NIST Special Publication 800-63-3 rates authentication methods on an Authenticator Assurance Level (AAL) scale. A password plus a TOTP app reaches AAL2. A FIDO2 hardware key reaches AAL3, the highest level, because it verifies the login page's domain before responding, which makes it resistant to fake login pages. SMS text codes are rated AAL1, and NIST specifically cautions against using SMS as a sole authentication method because SIM-swap attacks and telecom interception can expose the code in transit.
Authentication Method Comparison
TOTP Authenticator App
- NIST Rating
- AAL2
- Phishing Resistance
- Partial, vulnerable to real-time phishing
- Works Offline
- Yes
- Best Fit
- Most staff accounts
FIDO2 Hardware Key
- NIST Rating
- AAL3 (highest)
- Phishing Resistance
- Yes, cryptographic domain binding
- Works Offline
- Yes
- Best Fit
- Administrators and high-risk accounts
Push Notification
- NIST Rating
- AAL2
- Phishing Resistance
- No, vulnerable to MFA fatigue attacks
- Works Offline
- No, needs a data connection
- Best Fit
- Acceptable with staff training against push abuse
SMS Text Code
- NIST Rating
- AAL1
- Phishing Resistance
- No, vulnerable to SIM swap and interception
- Works Offline
- No, needs cell service
- Best Fit
- Not recommended for taxpayer data
| Feature | NIST Rating | Phishing Resistance | Works Offline | Best Fit |
|---|---|---|---|---|
| TOTP Authenticator App | AAL2 | Partial, vulnerable to real-time phishing | Yes | Most staff accounts |
| FIDO2 Hardware Key | AAL3 (highest) | Yes, cryptographic domain binding | Yes | Administrators and high-risk accounts |
| Push Notification | AAL2 | No, vulnerable to MFA fatigue attacks | No, needs a data connection | Acceptable with staff training against push abuse |
| SMS Text Code | AAL1 | No, vulnerable to SIM swap and interception | No, needs cell service | Not recommended for taxpayer data |
How the Major Tax Platforms Handle 2FA
Drake Tax: Administrators enable 2FA under Setup > Security > User Security and can require it for each user. Drake supports Microsoft Authenticator, Google Authenticator, and FIDO2 hardware keys for Drake Cloud administrator accounts.
Lacerte and ProSeries (Intuit): 2FA is managed through Intuit Account settings under Security > Two-step verification, with support for TOTP apps, the Intuit Authenticator app, and FIDO2 hardware keys. The limitation to know before you buy: each user must enable 2FA on their own account. Intuit does not offer central enforcement without adding practice management tools, so a firm-wide rollout takes direct coordination with every staff member.
CCH Axcess (Wolters Kluwer): Administrators enable and enforce 2FA for all users through the Admin Portal's Security Policies, under User Settings > Security Settings. CCH Axcess supports authenticator apps, hardware tokens, and biometric authentication on compatible devices, which makes firm-wide enrollment straightforward.
Thomson Reuters UltraTax CS and GoSystem: The Admin Console lets administrators require MFA for all users and supports TOTP apps, SMS (not recommended for taxpayer data), and hardware keys. Thomson Reuters also supports single sign-on with identity providers like Microsoft Entra ID, which centralizes 2FA management across a firm's other applications.
2026 IRS Compliance Requirement
The IRS Security Six framework requires multi-factor authentication on every system that accesses taxpayer data, and this is already checked during PTIN renewal reviews and IRS audits, not a future deadline. Your Written Information Security Plan needs to document your approved 2FA methods, enrollment procedures, and recovery process to satisfy an IRS review.
Documenting 2FA in Your WISP
A Written Information Security Plan (WISP) is the written security policy document that IRS Publication 4557 directs tax and financial services firms to maintain. Choosing tax software with strong 2FA support only satisfies part of the requirement. Your WISP also needs to name your approved authentication methods, describe your account recovery process, and assign who reviews authentication logs and how often.
Our guide to the full Security Six checklist for tax professionals covers the other five controls your WISP needs to address. If your firm also uses an IRS Tax Pro Account for e-Servicesour MFA setup guide for that account walks through a separate enrollment process. Tax software 2FA policy should tie into broader access control practices, like role-based permissions and session timeouts, that belong in the same document.
Need Your 2FA Policy Documented in a WISP?
Bellator Cyber Guard builds a custom Written Information Security Plan for tax practices, starting at $749 for up to 5 users, with a custom quote for firms above 5 users. A completed WISP typically saves a firm 20-40 billable hours compared to drafting one from scratch.
Key Takeaway
Two-factor authentication is required under the IRS Security Six framework, and by 2026 every major tax platform supports it, so availability isn't the decision. TOTP authenticator apps meet the baseline for most staff accounts, and FIDO2 hardware keys give administrators and high-risk accounts the strongest available protection. What separates a compliant firm from one exposed to penalties isn't which platform it uses, it's whether every account touching taxpayer data has 2FA enforced and documented in the WISP.
Talk with a cybersecurity expert
Get help evaluating your tax software's security controls and documenting your 2FA policy in a compliant WISP.
Frequently Asked Questions About Two-Factor Authentication for Tax Software
Two-factor authentication (2FA) requires two different types of proof of identity before granting access to an account. For tax preparers, it means that even if a password is stolen or guessed, an attacker still cannot get into tax software without the second factor, such as a code from an authenticator app or a physical hardware key. IRS Publication 4557's Security Six framework requires 2FA for every firm that handles taxpayer data.
All major professional tax platforms support 2FA as of 2026, including Drake Tax, Lacerte, ProSeries, CCH Axcess, Thomson Reuters UltraTax CS, and GoSystem. The methods and enforcement options differ by platform. Drake Tax and CCH Axcess support firm-wide enforcement plus TOTP apps and FIDO2 hardware keys. Intuit's Lacerte and ProSeries support the same methods but require each user to enable 2FA on their own account.
TOTP apps, like Google Authenticator or Microsoft Authenticator, generate a code that changes every 30 seconds and work offline. Hardware security keys are physical devices that use public-key cryptography and verify a website's domain before responding, which makes them resistant to fake login pages. NIST rates hardware keys at AAL3, the highest assurance level, compared to AAL2 for TOTP apps. Both satisfy IRS requirements, but hardware keys are the better fit for administrative accounts.
SMS is better than no 2FA, but NIST Special Publication 800-63-3 restricts SMS as a sole authentication method because SIM-swap attacks and telecom interception can expose the code in transit. IRS Publication 4557 does not name SMS as a preferred method. For accounts holding taxpayer data, a TOTP app or a FIDO2 hardware key is the safer choice.
From requirement to defensible practice
Turn the requirement into a security plan people can follow
A useful compliance path makes the obligation clear, identifies the evidence to retain, and connects written policy to the safeguards used every day.
People also look for
Keep exploring Tax security & WISP
Understand what tax professionals need to document, protect, and prepare before an IRS or FTC review.
- Common question: free WISP templateStart with a written information security planUse a practical WISP framework built around the safeguards tax practices need.
- Common question: IRS Publication 4557 requirementsRead the Publication 4557 guideSee how the IRS expects tax professionals to safeguard taxpayer data.
- Common question: IRS WISP requirementsReview the WISP requirementsWork through the required sections and the evidence your practice should retain.
- Common question: FTC Safeguards Rule checklistUse the FTC Safeguards checklistTranslate the rule into a clear list of security and documentation tasks.
- Common question: tax practice incident response planPrepare a tax-office incident planKnow who to contact, what to preserve, and how to respond to a client-data incident.
