IT for Accounting and Tax Firms in Virginia

Updated October 22, 2026

Accounting and tax practices hold Social Security numbers, bank account details, and income records for every client, which makes them a top target for identity thieves filing fraudulent returns. They’re also among the most clearly regulated small businesses when it comes to data security.

This page is general information, not legal or compliance advice. Check the primary sources linked below and consult your compliance advisor.

The rules that apply

The FTC Safeguards Rule

Under the Gramm-Leach-Bliley Act, the FTC treats tax preparers and many accounting firms as “financial institutions.” The FTC Safeguards Rule (16 CFR Part 314) requires an information security program, including:

• A designated qualified individual responsible for the program (an employee or an outside provider)
• A written risk assessment
• Access controls, limiting who can see customer information
• Encryption of customer information in transit and at rest
• Multi-factor authentication for anyone accessing customer information systems
• Secure disposal of customer information
• Monitoring and testing, such as vulnerability scans and penetration testing on a schedule the rule specifies
• Staff training
• Vendor oversight
• A written incident response plan
• A periodic written report from the qualified individual to leadership

Firms that maintain customer information on fewer than 5,000 consumers are exempt from some of the documentation requirements, but not from the core safeguards. Since May 2024, covered businesses must also notify the FTC of certain security events involving the information of 500 or more consumers.

The IRS written information security plan (WISP)

Professional tax preparers are expected to have a WISP, and the IRS ties this to your Preparer Tax Identification Number (PTIN) obligations. The IRS publishes Publication 5708, a WISP template for tax and accounting practices, and Publication 4557, Safeguarding Taxpayer Data.

The WISP and the Safeguards Rule program overlap heavily. One well-maintained document can usually serve both.

Professional standards and Virginia law

CPAs also have confidentiality obligations under professional standards, and Virginia’s breach notification law applies if Social Security or financial account numbers are exposed. See Virginia data privacy and breach laws.

Tax season changes the risk

• Phishing spikes. Fake IRS notices, fake client document uploads, and “new client” emails with malicious attachments arrive in January through April. See how to spot phishing.
• Seasonal staff. Temporary preparers need accounts set up properly at the start and removed completely at the end. See our offboarding checklist.
• Downtime is expensive. A day without your tax software in March costs far more than a day in August. Do upgrades and hardware replacements in the off-season.

A practical baseline for a small firm

1. MFA on email, tax software, client portals, and remote access. See how to set up MFA.
2. A secure client portal for exchanging documents, not email attachments.
3. Encrypted laptops and managed phones.
4. EDR on every computer.
5. Tested backups of tax software data, document storage, and email, with an offsite copy. See backup and disaster recovery.
6. A WISP that names your qualified individual and actually matches how you work.
7. Annual security training with records.
8. A list of every vendor that touches client data, with their security commitments.

Questions to ask an IT provider

• Can you serve as (or support) our qualified individual under the Safeguards Rule?
• Can you help us write and maintain our WISP?
• How will you handle seasonal staff accounts?
• What’s your plan for keeping us running during tax season?
• How do you perform the vulnerability scanning the Safeguards Rule calls for?