An Evergreen Reminder of Requirements Regarding Securing Client Data
10/11/2024
William Stromsem, CPA, J.D., George Washington University School of Business
Cyberthieves are trying to get your information year-round. Now that October 15 is behind us and year-end tax planning is not here yet, this might be a good time to review requirements for securing client information. If you have a data breach, this can ruin client relationships and even end your practice.
The IRS requires a Written Information Security Plan (WISP) to protect your firm and clients from cyberattacks. Ensure that your plan is valid, up to date and in compliance with the IRS requirements. IRS Publication 5708 is a brief document that details what is required and how to customize your plan for your practice. AICPA Tax Section members can download a copy of AICPA's WISP template.
Also, the Federal Trade Commission requires practices to use multifactor authentication in accessing client information that is stored on computers or on networks (including cloud storage). This would include return preparation records when vendor software is used. Multifactor identification involves using two or more items that only the user would know, like username and password, or if available, facial recognition, fingerprints or other means of verifying that the person accessing the information is authorized to do so.
Hopefully, your firm has this fully implemented.
Publication 5708 (Rev. 8-2024) (irs.gov) Creating a WISP for your tax and accounting practice
FTC Safeguards Rule: What Your Business Needs to Know | Federal Trade Commission
Comments