Tax software stores Social Security numbers, income records, bank information, and other sensitive client data. Federal rules require tax preparers to protect that information. Your professional tax software can help with some of those requirements. Knowing what the software takes care of helps you see what you need to handle in your own office.
Features such as multi-factor authentication (MFA) can help keep someone else out of your account, and user permissions give you more control over staff access. You still have to secure the computers you use and decide how client files are stored.
What Security Rules Apply to Tax Preparers
Federal law requires tax preparers to have a written information security plan, or WISP, for protecting client data. The plan should fit the size of your practice and the information you handle. And it isn’t limited to what happens inside your tax software. You also need to account for client information stored elsewhere or accessed by other people in your office.
The FTC Safeguards Rule sets requirements for controlling access to customer information, including MFA and encryption. It also covers how customer information is kept and disposed of when it’s no longer needed. IRS Publication 4557 gives tax professionals guidance on protecting taxpayer data in their practices.
The IRS also recommends its Security Six. It covers antivirus software, firewalls, MFA, backups, drive encryption, and VPNs for remote connections. Your tax software may address some of these protections. Others depend on the computers, network, and security practices you use in your office.
How Tax Software Supports These Requirements
Your tax software should cover some of the security controls you would otherwise have to set up and manage independently. Most professional tax platforms support multi-factor authentication at login, whether through an authenticator app or a verification code sent to a registered device. Either method adds a layer of protection beyond a password alone.
Permissions are another built-in control worth setting up. Software that lets administrators assign different access levels to different users means a preparer working on returns doesn’t need the same account privileges as someone managing the office. Restricting access to what each person actually needs is a straightforward way to reduce exposure.
Session timeouts are a smaller but useful feature. Software that closes an inactive session after a set period helps when someone leaves a return open on their screen and steps away.
The bigger difference between platforms shows up in data storage. Cloud-based software stores your tax files on the provider’s servers, with backups managed on their end. Desktop software stores files locally, which gives you direct control over your data. However, it puts the responsibility for backing it up and keeping those copies secure entirely on your office. Both approaches can work, but they require different practices to be maintained properly.
Security That Extends Beyond Your Software
The protections built into tax software stop at the software itself. The computers you use to access it need attention, too. Keep operating systems and security software current, use a firewall, and lock a computer when you step away from it. These are especially important on machines where client documents or tax files are stored locally.
Working away from the office brings the network into the picture. The IRS recommends using a VPN when connecting remotely and avoiding unsecured public Wi-Fi when accessing taxpayer information. If employees work from home, the same precautions should apply to the computers they use there.
Then there is email. Tax preparers are regularly targeted with phishing messages that impersonate the IRS, tax software companies, and even prospective clients. An unexpected attachment that appears to contain a new client’s tax documents can be the attack itself. Anyone who handles client email should know to verify an unfamiliar sender before opening files or entering login information.
What to Do When You Suspect a Data Breach
Security problems don’t always start with an obvious warning. You may notice returns being filed that nobody in your office prepared, changes to client accounts, or login activity you don’t recognize. A lost computer containing taxpayer information can also put client data at risk.
First, limit access to the affected system or account if something looks wrong. Change compromised passwords and document what happened. If taxpayer data may have been stolen, contact your local IRS Stakeholder Liaison immediately. Depending on what happened, state tax agencies, clients, law enforcement, or other parties may also need to be notified.
Your WISP should already spell out who handles these steps. Don’t wait until a breach happens to decide who makes the calls or where incident records are kept. Having that process written down gives your office something concrete to follow.
Building and Maintaining Your Written Information Security Plan
A WISP should describe how your office actually stores and protects client information. The IRS provides a sample plan in Publication 5708. You must adapt it to your own practice rather than simply keeping a copy of the template on file.
Start with where taxpayer information is stored and who can access it. Your plan should identify the person responsible for data security and document the safeguards you use to protect client information. It should also address employee access, service providers, and your office’s response if client data is compromised.
The plan needs to keep up with your practice. Hiring employees can change who has access to client files. Moving from desktop tax software to an online system changes where those files are stored and how they’re backed up. Those are the kinds of changes that should send you back to the WISP to make sure it still describes what you’re actually doing.
What Is the Best Tax Preparation Software for Security?
If you want to know what the best tax preparation software is for security, start by checking what the software actually protects for you. Does it cover MFA, user permissions, online storage, and backups? Then look at what’s left up to you, such as the computers your staff use and the client files you keep outside the software.
Built-in controls for account access and user permissions are useful. Still, they work best when the rest of your office follows the same security rules. Keep your WISP current, remove access when someone leaves the firm, and review your setup whenever you change software or bring on new staff.
