Accounting and tax practices hold some of the most sensitive data a small business can keep — Social Security numbers, bank account details, income records, and years of prior returns. Federal rules treat tax preparers as financial institutions, which makes protecting that data a legal obligation, not just good practice. West Computers builds and runs the security program your firm needs and keeps your systems up when filing deadlines hit.
The Gramm-Leach-Bliley Act gives the Federal Trade Commission authority to set data-protection rules for financial institutions under its jurisdiction. The IRS states plainly that this definition includes professional tax preparers, and its Security Summit guidance says tax and accounting professionals are covered regardless of size. The rule that applies is the FTC Safeguards Rule (16 CFR Part 314).
The rule requires a written information security program — what the IRS calls a WISP — appropriate to your firm’s size, complexity, and the sensitivity of the client data you hold. The amended rule’s specific technical requirements, including MFA and encryption, took effect in June 2023, and since May 2024 covered firms must notify the FTC within 30 days of discovering a security event that involves the unencrypted information of 500 or more consumers.
The IRS reinforces this every year: when paid preparers apply for or renew a PTIN, Form W-12 asks them to acknowledge that they are required by law to create and maintain a written information security plan.
Each of these maps to a requirement in the Safeguards Rule or to the practices the IRS recommends in Publication 4557. We implement them, document them, and keep them running.
We build your WISP using the structure in IRS Publication 5708 and the elements in the Safeguards Rule: a Qualified Individual, a written risk assessment, the safeguards you use, how they’re monitored and tested, vendor oversight, and how the program is updated as your firm changes.
The Safeguards Rule requires MFA for anyone accessing customer information on your systems. We enforce it across Microsoft 365, remote access, tax software portals, and client file-sharing — with phishing-resistant options where they fit.
Client information must be encrypted in transit and at rest. We encrypt laptops and workstations, servers, and backups, and set up secure ways to exchange returns and documents with clients instead of plain email attachments.
Your busiest weeks are the worst time for an outage. We schedule patching and hardware refreshes before the season, monitor around the clock, test backups and restores in advance, and keep a recovery plan ready so a failed machine doesn’t stop your filing work.
The rule requires continuous monitoring or periodic penetration testing and vulnerability assessments. Our 24/7 SOC and MXDR service watches endpoints, email, and cloud accounts and responds to threats as they happen.
The IRS warns that criminals target tax professionals to steal client data and file fraudulent returns. Email security, user coaching, and Zero Trust application control help stop the phishing and malware that lead to account takeover.
Least-privilege access to client files and tax software, periodic access reviews, and fast offboarding when seasonal staff leave — so former employees don’t keep access to client data.
A written plan for detecting, containing, and recovering from a security event — including who to call, how to document it, and how to meet notification obligations to the FTC and your IRS stakeholder liaison.
Help reviewing the security of your tax software, cloud storage, and other providers, plus ongoing security awareness training for partners, staff, and seasonal hires.
We review your current environment against the Safeguards Rule and IRS Publication 4557 — MFA coverage, encryption, backups, access, email security, and documentation — and tell you plainly where the gaps are.
We document your WISP and risk assessment so they reflect how your firm actually works, not a generic template that sits in a drawer.
MFA, encryption, monitoring, backups, email security, and access controls are deployed and configured, with evidence kept for each one.
Ongoing monitoring, patching, access reviews, and an annual program review — with a pre-season readiness check before every filing season.
This page is a general overview, not legal advice. These are the primary sources we work from.