Your firm holds Social Security numbers, bank details and full financial pictures for every client. We protect that data on every laptop and account your team uses, and help you build the controls the FTC Safeguards Rule expects, controls that actually work, not just a policy in a drawer.
Fake client documents, bogus IRS notices and e-signature lures flood inboxes right when your team is busiest and least careful.
Phishing tests timed for tax season and short training built around the lures your staff really receive.
Learn more about Security awareness training →You have a written information security plan, but the controls it describes were never fully set up, or nobody has checked in years.
We help put the controls in your plan in place and document them in line with the FTC Safeguards Rule.
Learn more about Compliance readiness →Temporary preparers share logins to tax software and portals, and their access often lingers long after the season ends.
A business password manager gives every preparer their own credentials, and access is removed the day the season ends.
Learn more about Password and identity management →Returns and financial statements get emailed to personal accounts, copied to USB drives or shared through unapproved apps.
Data loss prevention watches for sensitive client data leaving through email, USB and file sharing, and blocks it.
Learn more about Data loss prevention (DLP) →An attack in March can lock every client file just as filing deadlines approach.
Isolated, tested backups let you restore client files from a clean copy and get back to work.
Learn more about Backup and ransomware recovery →Staff paste returns and financials into free AI tools to summarize or draft letters, without knowing where that data goes.
Shadow AI discovery shows which AI tools your team uses, so you can approve safe ones and add AI rules to your WISP.
Learn more about Shadow AI discovery →Preparers and seasonal staff open client returns from home networks and personal devices nobody at the firm manages.
Zero trust access lets them reach tax software and client files only from verified, healthy devices, and access ends the moment the season does.
Learn more about Zero trust access →Tax software, portals and cloud storage providers hold your clients' data, and business clients increasingly send you security questionnaires before engaging the firm.
We assess the vendors that hold client data, and prepare your firm to answer client security reviews accurately.
Learn more about Third-party risk assessment →Preparers work from home and seasonal staff come and go. Zero trust lets them reach tax software and client files only from verified, healthy devices, and makes removing access at the end of the season immediate.
An accounting firm’s files are a complete toolkit for identity theft: names, Social Security numbers, bank accounts, income and dependents. That’s why criminals target firms of every size, and why regulators expect more than antivirus and good intentions.
The pressure peaks during tax season. Inboxes fill with client attachments, new e-signature requests and urgent notices, and attackers hide inside that volume. At the same time, seasonal staff come on board, people work late from home, and corners get cut to hit deadlines.
Protect every login. Multi-factor authentication on email, tax software, portals and remote access, plus a business password manager so credentials aren’t shared in spreadsheets or browsers.
Watch every device, 24/7. Managed detection and response on every laptop and workstation, with analysts ready to isolate a device the moment something looks wrong.
Keep client data where it belongs. Data loss prevention and encryption stop returns and financials from leaking through personal email, USB drives or the wrong file share.
Recover without paying. Isolated, tested backups mean ransomware becomes a recovery exercise instead of a crisis in the middle of the season.
Govern AI use. We find the AI tools your team is already using, approve safe ones and add clear AI rules to your written plan.
Make the WISP real. Through compliance readiness support we help document your safeguards the way the FTC Safeguards Rule describes, so your written plan matches what’s actually configured.
The best time to fix security is before January. Get your free security score to see where your firm stands today, or book a free cyber risk analysis and we’ll build a plan that’s ready before the rush.
Last reviewed October 11, 2026. General information, not legal advice. Upfortify provides security services and readiness support. We are not an auditor, assessor, certification body or law firm.
24/7 detection and response on every preparer's laptop, so a compromised account is contained before client data walks out.
Phishing tests timed for tax season, built around the fake client and fake IRS emails your team really receives.
Preparers reach tax software and client files only from verified devices, and seasonal access ends on time.
Stops returns and client financials from leaving through personal email, USB drives or unapproved file sharing.
Isolated, tested backups so a ransomware attack in March is a recovery job, not a lost season.
Turn your WISP into real, documented controls aligned with the FTC Safeguards Rule.
The FTC treats tax preparers and many accounting firms as financial institutions under the Gramm-Leach-Bliley Act, so the Safeguards Rule generally applies. It requires a written information security program with a Qualified Individual in charge, a risk assessment, access controls, encryption, multi-factor authentication, staff training and more. Firms that maintain information on fewer than 5,000 consumers are exempt from a few of the requirements, such as a written risk assessment, a written incident response plan and annual reporting to the board. A provider can fill the Qualified Individual role, but your firm stays responsible.
A written information security plan describes how your firm protects client data. The IRS expects paid tax preparers to have one, and the Safeguards Rule requires a written program. IRS Publication 4557 explains the basics, and Publication 5708 provides a WISP template. The plan only helps if the controls it describes are actually in place, which is the part we take care of.
Under the Safeguards Rule, financial institutions must notify the FTC within 30 days of discovering a notification event involving unencrypted information of at least 500 consumers. State breach laws and IRS reporting can apply too. Having monitoring, logging and an incident response plan in place makes those deadlines manageable.
Only approved tools with the right data settings, under a written policy. Consumer AI accounts may keep or use what's entered. We show you which AI tools your team already uses, help you approve safe ones, and add AI use to your WISP.
Small firms are targeted precisely because they're assumed to be easier. Most of the rule's requirements apply regardless of size, and the essentials, like MFA, managed devices, backups and training, are affordable when delivered remotely at a per-user price.
See where cyber risk is hiding before it becomes a business problem.
