VPN for Tax Professionals: Secure Remote Access Guide

A VPN for tax professionals encrypts remote connections to a practice's network or cloud systems, protecting Social Security numbers, bank account details, and prior-year returns while staff work outside the office. If you're researching VPN tax compliance requirements, the starting point is IRS Publication 4557, which requires every tax preparer holding a Preparer Tax Identification Number (PTIN) to implement six mandatory safeguards known as the IRS Security Six. A properly configured VPN is the control that secures remote access to nonpublic personal information (NPPI) under that framework.

The stakes are concrete. According to IBM's Cost of a Data Breach Report 2024, the average data breach now costs $4.88 million, and an IRS audit finding tied to inadequate remote access controls can lead to PTIN suspension, which stops a practice from filing returns. This guide covers what a compliant VPN requires, how to set one up, and where practices most often get the configuration wrong.

Why VPN Sits at the Center of the IRS Security Six

The IRS Security Six framework sets minimum cybersecurity standards for tax professionals through six required controls: antivirus software, firewalls, multi-factor authentication, backup software, drive encryption, and a VPN. VPN addresses the risk created when preparers connect to office systems or cloud-based tax software from home networks, client offices, or public WiFi.

According to the Verizon 2025 Data Breach Investigations Report, more than 80% of hacking-related breaches involve compromised or weak credentials, which is why MFA on every VPN connection matters as much as the encrypted tunnel itself. The CISA Telework Essentials Toolkit offers additional guidance on hardening remote access that supports these IRS requirements. Review the full IRS Security Six checklist alongside your VPN setup, since missing or undocumented controls elsewhere in the framework can still produce an audit finding.

Remote Access vs. Site-to-Site VPNs

Most tax practices use a remote access VPN, which lets individual staff connect from any location and authenticates each user separately. This fits practices with work-from-home preparers or staff who visit client offices. A site-to-site VPN instead creates a permanent encrypted link between two networks, such as a main office and a satellite location, without requiring per-session authentication. Multi-office firms often run both: remote access VPN for individual staff, plus a site-to-site connection between physical locations.

Cloud-based tax software does not automatically eliminate the need for a VPN. You may still need one to reach local servers, office shared drives, or when a software vendor requires connections from a trusted IP range. Whichever architecture you use, document it in your WISP.

MFA Is Non-Negotiable for VPN Access

The IRS requires multi-factor authentication for all remote access to systems containing NPPI. A username and password alone does not satisfy this requirement, regardless of password complexity. When a preparer connects from a coffee shop or hotel WiFi, the VPN's MFA gate is often the only barrier between an attacker on that network and client records.

Acceptable methods include authenticator apps such as Microsoft Authenticator or Google Authenticator, hardware security keys like YubiKey, and push notifications to a registered device. SMS or voice codes are the weakest acceptable option and are not recommended for practices handling high data volumes. Your WISP needs to document which method you use, how you provision new employees, and the process for a lost or compromised device. Many practices fail IRS audits not because they lack MFA, but because their WISP does not describe the policy in enough detail. See our IRS Tax Pro Account MFA setup guide for a walkthrough of enabling MFA on IRS systems directly.

Common VPN Mistakes Tax Practices Make

Using a consumer VPN service. Services like NordVPN or ExpressVPN are built for individual privacy browsing, not business access control. They cannot integrate with enterprise MFA, do not generate the connection logs an audit requires, and route traffic through shared servers.

Skipping the kill switch. Without one, a device may keep transmitting data over an unencrypted connection if the VPN drops, unnoticed, especially on shared WiFi in coffee shops, airports, or hotels.

Retaining logs for too short a period. IRS Publication 4557 expects records that demonstrate your controls work as documented. Many default VPN configurations only keep 30 to 90 days of logs; extend retention to at least 12 months and back logs up before any vendor migration.

Skipping endpoint checks. A valid VPN session from a malware-infected device still gives an attacker authenticated access to your network. Enterprise VPN platforms that support device posture checks can block non-compliant endpoints automatically before granting access.

Integrating VPN with the Rest of the Security Six

VPN works as one piece of a layered system, not a standalone fix. Configure your firewall to restrict VPN traffic to the ports it needs, commonly UDP 500/4500 for IPsec or TCP 443 for SSL/TLS, and to limit what each user can reach based on role. Pair VPN access controls with a broader cloud and network security strategy that also covers unmanaged home networks.

Train staff to recognize phishing attempts targeting VPN credentials, such as fake expiration notices or security alerts asking them to re-enter login details. Your tax season cybersecurity checklist should include VPN-specific incident response steps: who to contact, which systems to isolate, and how to preserve logs if a connection is compromised or an unusual login location appears.

Selecting a Compliant VPN Vendor

When evaluating a VPN for tax professionals, confirm the platform provides AES-256 encryption, native MFA integration (Duo, Microsoft Authenticator, or FIDO2 hardware tokens), a centralized console for provisioning and revoking access, 12-month log retention in a tamper-evident format, role-based access controls, and device posture checks. Ask about the uptime SLA and vendor support hours during filing season, when an outage has the most impact.

Enterprise VPN platforms commonly used in tax practices include Cisco AnyConnect, Palo Alto GlobalProtect, Fortinet FortiClient, SonicWall NetExtender, and cloud-managed options like Perimeter 81 or Twingate. Expect to budget roughly $10 to $25 per user per month for a platform with management, licensing, and support included, a small fraction of the cost of a breach or a PTIN suspension. Request references from other accounting or tax firms of similar size and ask how the vendor performed during peak filing season and when an IRS audit requested VPN logs.