VPN for Tax Professionals: Secure Remote Access Guide

A VPN for tax professionals is a Virtual Private Network solution that meets the specific encryption, authentication, and access control requirements outlined in the IRS Security Six framework—a mandatory set of cybersecurity controls for tax preparers handling nonpublic personal information (NPPI). According to IRS Publication 4557, all tax preparers with a Preparer Tax Identification Number (PTIN) must implement six critical safeguards, with VPNs serving as the primary mechanism for securing remote access to client data.

Tax professionals face disproportionate cyber risk during filing season due to the concentration of sensitive financial data they handle. The FTC Safeguards Rule requires financial institutions and tax preparers to encrypt all data in transit when accessing client information remotely. A properly configured security-compliant VPN creates an encrypted tunnel between remote devices and practice networks, ensuring Social Security numbers, bank account details, tax returns, and other sensitive financial data remain protected from interception—whether employees work from home offices, coffee shops, or client locations.

The stakes are substantial: the average data breach costs tax practices $4.88 million according to IBM's 2025 Cost of Data Breach Report, while IRS-mandated PTIN suspension can halt revenue entirely. With 83% of tax professionals now working remotely at least part-time, implementing a compliant VPN solution is no longer optional—it's a regulatory requirement and business continuity necessity for teleworking tax practices nationwide.

Understanding the IRS Security Six VPN Mandate

The IRS Security Six framework establishes minimum cybersecurity standards for tax professionals through six mandatory controls that work together to protect nonpublic personal information. Tax professionals face unique cybersecurity challenges because they aggregate massive volumes of sensitive financial data during tax season—a single compromised remote connection can expose hundreds or thousands of client records.

The VPN requirement specifically addresses the risks inherent in remote access scenarios—when tax preparers connect to office networks from external locations, access cloud-based tax software over public internet connections, or work from home offices without enterprise-grade network security. According to Verizon's 2025 Data Breach Investigations Report, over 80% of hacking-related breaches involve compromised or weak credentials, making VPN implementation with multi-factor authentication critical for protecting NPPI during telework sessions.

The CISA Telework Essentials Toolkit provides detailed guidance on VPN selection and hardening that directly supports IRS compliance efforts for tax professionals working remotely. These federal guidelines emphasize that secure remote access is not merely a technical control—it's a business-critical safeguard for practices handling sensitive taxpayer data outside traditional office environments.

The Security Six framework requires tax professionals to implement the following controls:

• Security Plan: A Written Information Security Plan (WISP) documenting VPN policies and procedures
• User Authentication: Multi-factor authentication for all VPN connections
• Access Controls: Role-based permissions limiting what users can access through VPN
• Encryption: AES-256 encryption for data in transit and at rest
• Data Disposal: Secure deletion protocols for VPN logs containing NPPI
• Monitoring: Continuous logging and review of VPN connection attempts and activity

These requirements work in concert to create defense-in-depth protection for tax practice networks, with VPN serving as the gateway control that enforces authentication, encryption, and access policies before allowing remote connectivity to sensitive systems.

VPN Types for Tax Practices: Remote Access vs. Site-to-Site

Tax practices typically implement one of two VPN architectures depending on their operational structure and telework requirements. Understanding the distinction is critical for selecting the right solution that meets both IRS requirements and your practice's workflow needs.

Remote Access VPNs allow individual users to connect from any location to your practice network or cloud resources. This is the most common implementation for tax practices with mobile employees, work-from-home staff, or preparers who visit client offices. Remote access VPNs authenticate each user individually, enforce per-user access policies, and create encrypted tunnels on-demand when users connect from home offices, coffee shops, or other remote locations.

Site-to-Site VPNs create permanent encrypted connections between entire networks—such as linking your main office to a satellite location or connecting your office network to a cloud data center. All traffic between the locations flows through the encrypted tunnel automatically without requiring individual user authentication for each session.

Most small to mid-sized tax practices need remote access VPN capabilities to support teleworking staff, though firms with multiple physical offices may benefit from hybrid deployments that include both remote access and site-to-site components. The key consideration is ensuring your VPN solution provides the granular logging, user authentication, and access control features required by the IRS Security Six framework for remote work scenarios.

Multi-Factor Authentication: Non-Negotiable VPN Requirement

The IRS explicitly requires multi-factor authentication (MFA) for all remote access to systems containing NPPI. Your VPN must enforce MFA before allowing connections—single-factor authentication (username and password only) does not meet compliance requirements regardless of password complexity. This is particularly critical for teleworking tax professionals who connect from home networks, public WiFi, or client locations where network security is outside your control.

Acceptable MFA implementations for tax practice VPNs include:

• Authenticator Apps: Time-based one-time passwords (TOTP) generated by Microsoft Authenticator, Google Authenticator, or Duo Mobile
• Hardware Tokens: YubiKey or similar FIDO2-compliant security keys that plug into USB ports
• SMS or Voice Codes: Text message or phone call verification (least secure option, use only if alternatives unavailable)
• Push Notifications: Approve/deny prompts sent to a registered mobile device

Your Written Information Security Plan must document your MFA implementation, including which method you use, how you provision MFA devices to employees, and procedures for handling lost or compromised authentication factors. Many tax practices fail IRS audits not because they lack MFA, but because they haven't documented their MFA policies properly in their security plan.

"Tax practices using VPN without MFA are operating in direct violation of IRS Publication 4557. We see PTIN suspension cases every year where the triggering event was an IRS security audit that discovered single-factor VPN authentication." — NIST Cybersecurity Framework guidance for small businesses

For teleworking environments, consider implementing two-factor authentication not just for VPN access, but also for tax software applications, email systems, and cloud storage platforms to create layered security controls throughout your remote access infrastructure.

Common VPN Implementation Mistakes Tax Practices Make

Even with the best intentions, tax practices frequently make configuration errors that create compliance gaps or security vulnerabilities when implementing VPN for telework scenarios. Here are the most critical mistakes to avoid:

Using Consumer VPN Services

Services like NordVPN, ExpressVPN, or Private Internet Access are designed for individual privacy, not business security and telework access control. They lack centralized user management, cannot integrate with your MFA systems, don't provide the detailed connection logs IRS audits require, and won't create dedicated connections to your practice network. Consumer VPNs route your traffic through shared servers worldwide—the exact opposite of what you need for accessing sensitive client data from remote locations.

Neglecting VPN Kill Switch Configuration

A kill switch automatically blocks all internet traffic if the VPN connection drops unexpectedly. Without this safeguard, your device may continue transmitting data over an unencrypted connection without your knowledge—potentially exposing client NPPI. This is particularly dangerous when working from coffee shops, airports, hotels, or other public WiFi networks during telework. Configure kill switch policies at the VPN client level to prevent any data transmission outside the encrypted tunnel.

Allowing Split Tunneling Without Policy Controls

Split tunneling lets users access some resources through the VPN while routing other traffic directly to the internet. While this improves performance, it creates risk if not properly configured for remote work scenarios. Tax practices should either disable split tunneling entirely or implement strict policies that force all traffic to practice networks and tax software through the VPN while allowing only specific trusted applications (like video conferencing) to bypass the tunnel.

Failing to Rotate VPN Credentials

Many practices set up VPN access once and never revisit authentication credentials. Implement mandatory password changes every 90 days for VPN accounts and immediately revoke access when employees separate from the practice. Better yet, integrate your VPN with Active Directory or Azure AD so user provisioning and deprovisioning happens automatically when staff employment status changes.

Insufficient Logging Retention

IRS Publication 4557 requires maintaining records that demonstrate your security controls are functioning properly. VPN logs must be retained for at least one year, but many default VPN configurations only keep 30-90 days of logs. Configure extended retention periods and ensure logs are backed up to prevent loss during system upgrades or failures. This is especially important for documenting remote access patterns during tax season.

Not Testing VPN Failover Scenarios

What happens if your primary VPN concentrator fails during peak tax season? Most practices don't know because they've never tested. Implement redundant VPN infrastructure and conduct failover drills at least annually. Your incident response plan should include procedures for VPN outages and alternative secure access methods for teleworking staff.

VPN Performance Optimization for Tax Season

VPN connections inevitably introduce some latency due to encryption overhead and network routing. However, poorly optimized VPN implementations can slow tax software to unusable levels, particularly during peak filing season when multiple teleworkers access practice systems simultaneously. Here's how to maintain acceptable performance for remote work scenarios:

Right-Size Your VPN Bandwidth

Calculate your concurrent VPN user count and multiply by the bandwidth requirements of your tax software. Most tax applications need 5-10 Mbps per user when uploading returns or accessing cloud-based platforms. A practice with 10 simultaneous remote users needs at least 100 Mbps of internet bandwidth at the office location where the VPN server terminates. Don't forget to account for peak season loads when all teleworkers connect concurrently.

Choose Geographically Appropriate VPN Servers

If using a cloud-based VPN service, select server locations closest to your users to minimize latency for telework connections. A preparer in Chicago connecting through a VPN server in California will experience significantly more delay than connecting to a Chicago-region server. Many enterprise VPN platforms offer automatic server selection based on user location to optimize performance.

Implement Modern VPN Protocols

Legacy protocols like PPTP or L2TP/IPsec are slow and insecure. Modern implementations should use IKEv2/IPsec or WireGuard protocols, which offer better performance and stronger security for remote access. OpenVPN remains acceptable if configured with AES-256-GCM encryption and UDP transport for reduced latency in telework scenarios.

Configure Appropriate Split Tunneling

If your security policy allows split tunneling, configure it to route only traffic destined for practice resources through the VPN while sending general internet traffic direct. This reduces load on your VPN infrastructure and improves performance for tasks that don't involve client data. However, ensure your split tunnel policies are well-documented in your WISP and reviewed by your security professional to prevent accidental NPPI exposure.

Monitor VPN Performance Metrics

Implement monitoring for VPN connection quality, bandwidth utilization, and user experience during tax season peaks. Track metrics like connection setup time, throughput, packet loss, and latency. Set alerts for degraded performance so you can address issues before they impact tax season productivity. Many business VPN platforms include built-in dashboards showing these metrics in real-time for telework infrastructure management.

Integrating VPN with Other Security Six Controls

Your VPN doesn't operate in isolation—it's one component of a comprehensive security framework for protecting tax practice systems and telework infrastructure. Effective tax practice cybersecurity requires integrating your VPN with the other Security Six requirements:

Firewall Coordination

Your firewall should restrict VPN access to only the ports and protocols necessary for operation (typically UDP 500/4500 for IPsec or TCP 443 for SSL VPNs). Configure firewall rules that limit what resources VPN users can reach based on their role—preparers don't need access to your accounting systems or network management interfaces from remote locations.

Endpoint Security Integration

Before allowing VPN connections from telework devices, verify that connecting devices have current antivirus software, operating system patches, and endpoint detection and response (EDR) agents installed. Many enterprise VPN platforms support posture checking that blocks non-compliant devices from connecting. This prevents compromised home computers from accessing your practice network through VPN.

Backup Coordination

Your backup systems should capture VPN logs along with other critical data. If a security incident occurs, VPN connection records may be the only evidence showing when and how attackers accessed your network. Ensure VPN logs are included in your regular backup schedules and tested during disaster recovery drills.

Security Awareness Training

Train employees to recognize phishing attacks targeting VPN credentials. Attackers frequently send fake VPN expiration notices or security alert emails designed to steal authentication credentials from teleworkers. Your users are the last line of defense against credential compromise, particularly when working from home networks outside your direct security controls.

Incident Response Planning

Your incident response procedures must include specific playbooks for VPN-related security events: compromised credentials, suspicious connection patterns from unusual geographic locations, unauthorized access attempts, and VPN infrastructure failures. Define who investigates VPN security alerts and how quickly they must respond, especially during critical tax season periods when telework activity peaks.

VPN Vendor Selection Criteria for Tax Practices

Not all business VPN solutions meet IRS requirements for tax practice telework infrastructure. When evaluating vendors, ensure your chosen platform provides:

• AES-256 Encryption: Non-negotiable minimum encryption standard per IRS Security Six—weaker algorithms don't meet compliance requirements
• MFA Integration: Native support for or integration with multi-factor authentication providers (Duo, Microsoft Authenticator, hardware tokens)
• Centralized Management: Single console for provisioning users, configuring policies, and monitoring connections across your entire practice and all telework devices
• Detailed Logging: Connection logs, authentication logs, and session logs with configurable retention periods of 12+ months for IRS audit documentation
• Role-Based Access Control: Ability to define granular access policies based on user roles, not just all-or-nothing network access for remote connections
• Compliance Reporting: Built-in reports demonstrating security control effectiveness for IRS audits and PTIN renewal documentation
• Reliability and Redundancy: Uptime SLAs of 99.9%+ and redundant infrastructure to prevent VPN outages during critical tax season periods
• Support for Diverse Devices: VPN clients for Windows, macOS, iOS, and Android to accommodate your team's device preferences for telework
• Scalability: Ability to add capacity during tax season peaks when concurrent telework connections increase dramatically
• Technical Support: 24/7 vendor support with tax season expertise and rapid response SLAs for critical issues

Popular VPN platforms meeting these criteria include Cisco AnyConnect, Palo Alto GlobalProtect, Fortinet FortiClient, SonicWall NetExtender, and cloud-managed solutions like Perimeter 81 or Twingate. Expect to invest $10-25 per user per month for enterprise VPN services that include management, licensing, and support—a modest investment compared to the cost of data breaches or PTIN suspension.

When evaluating vendors, request references from other tax practices or accounting firms with similar telework requirements. Ask about their experience during peak filing season, support responsiveness, and IRS audit experiences. Many vendors offer tax season-specific resources and compliance documentation that can accelerate your implementation.

Protect Your Tax Practice With Compliant VPN Implementation

Implementing a security-compliant VPN isn't just about checking a box on the IRS Security Six requirements—it's about protecting your clients' most sensitive financial information and safeguarding your practice from the devastating consequences of a data breach. The tax professionals who succeed in 2026 and beyond are those who view cybersecurity as a competitive advantage and client trust differentiator, not merely a compliance burden.

With the 2026 filing season rapidly approaching and IRS enforcement of PTIN security requirements intensifying following recent high-profile attacks on tax firms, now is the time to audit your VPN implementation, close any gaps, and ensure your Written Information Security Plan accurately documents your security controls. Whether you're implementing your first VPN to support teleworking staff or upgrading an existing system to meet current compliance standards, the investment in proper configuration, user training, and ongoing monitoring pays dividends in client trust, regulatory compliance, and business continuity.

The rise of remote work and telework arrangements has permanently changed how tax practices operate. Your VPN infrastructure is no longer a nice-to-have technical feature—it's the foundation of your remote access security strategy and a regulatory requirement for continued PTIN eligibility. Practices that implement robust, well-documented VPN solutions position themselves for successful IRS audits, reduced cyber risk, and the operational flexibility to support modern workforce arrangements.

Don't let VPN complexity or cost concerns prevent you from meeting your obligations. Thousands of tax practices successfully operate compliant VPN infrastructure every day, and with the right guidance and planning, yours can too. The alternative—operating without proper VPN security for remote access—isn't just risky; it's a direct violation of federal regulations that can end your ability to prepare tax returns professionally and expose your practice to substantial financial penalties.