Tax preparer security plan checklist

What every firm's plan should cover

• One named person is responsible for the security program. (314.4(a))
• You have identified the risks to client information in your office, devices, and software. (314.4(b))
• Each person can reach only the client data their job needs. (314.4(c)(1))
• You keep a list of where client data lives: computers, phones, cloud software, backups, and paper. (314.4(c)(2))
• Client data is encrypted on devices and when it is sent. (314.4(c)(3))
• Multi-factor sign-in is on for every system that holds client information. (314.4(c)(5))
• You have a schedule for securely disposing of client information you no longer need. (314.4(c)(6))
• You log who accesses client data and can spot unusual activity. (314.4(c)(8))
• You test or monitor your safeguards on a regular schedule. (314.4(d)(1))
• Everyone who handles client data gets security training, and you keep a record of it. (314.4(e))
• You choose vendors with care, your contracts require them to protect data, and you review them. (314.4(f))
• You review and update the plan when your software, staff, or office changes. (314.4(g))
• The plan is written down and staff can find it. (IRS Publication 5708)

Required at 5,000 clients or more

• The risk assessment is in writing. (314.4(b)(1))
• You run continuous monitoring, or a yearly penetration test with vulnerability scans every six months. (314.4(d)(2))
• You have a written incident response plan. (314.4(h))
• The responsible person reports in writing to the owners at least once a year. (314.4(i))

Breach duties to write into the plan

• The plan says to notify the FTC within 30 days if unencrypted information on 500 or more clients is taken. (314.4(j))
• The plan says to report client data theft to your IRS Stakeholder Liaison. (IRS guidance)

Your gaps

• One named person is responsible for the security program. (314.4(a))
• You have identified the risks to client information in your office, devices, and software. (314.4(b))
• Each person can reach only the client data their job needs. (314.4(c)(1))
• You keep a list of where client data lives: computers, phones, cloud software, backups, and paper. (314.4(c)(2))
• Client data is encrypted on devices and when it is sent. (314.4(c)(3))
• Multi-factor sign-in is on for every system that holds client information. (314.4(c)(5))
• You have a schedule for securely disposing of client information you no longer need. (314.4(c)(6))
• You log who accesses client data and can spot unusual activity. (314.4(c)(8))
• You test or monitor your safeguards on a regular schedule. (314.4(d)(1))
• Everyone who handles client data gets security training, and you keep a record of it. (314.4(e))
• You choose vendors with care, your contracts require them to protect data, and you review them. (314.4(f))
• You review and update the plan when your software, staff, or office changes. (314.4(g))
• The plan is written down and staff can find it. (IRS Publication 5708)
• The risk assessment is in writing. (314.4(b)(1))
• You run continuous monitoring, or a yearly penetration test with vulnerability scans every six months. (314.4(d)(2))
• You have a written incident response plan. (314.4(h))
• The responsible person reports in writing to the owners at least once a year. (314.4(i))
• The plan says to notify the FTC within 30 days if unencrypted information on 500 or more clients is taken. (314.4(j))
• The plan says to report client data theft to your IRS Stakeholder Liaison. (IRS guidance)

Want me to check your website too? Get a free website security report

Ready to write it down? Get the free template