As tax preparers, you deal with sensitive financial information every day. The last thing you want is to become the next headline in a cybersecurity breach. With cyber threats evolving constantly, staying ahead of the danger is crucial. Let’s dive into some practical cybersecurity tips that can help protect your tax business and your clients’ sensitive data.

Learn more and download our free checklist at the end of this post. 

1. Educate Your Team

If you have a staff, regularly train them on cybersecurity. If you’re a team of one, keep yourself informed. Ensure you and everyone who works for you understands the importance of strong passwords, how to recognize phishing emails and how to handle sensitive data. Consider implementing monthly or quarterly training sessions: registration to keep everyone up-to-speed on the latest threats and prevention strategies.

2. To further secure your main network, use a strong password and consider setting up a separate guest network for clients

Encourage your team to create complex passwords that include a mix of letters, numbers, and symbols. Additionally, enable two-factor authentication wherever possible. This adds an extra layer of security, making it much harder for cybercriminals to access your systems.

3. Secure Your Wi-Fi Network

Your office’s Wi-Fi network should be secure and hidden. Change the default name of your network service set identifier (SSID) and ensure it is password protected. Use a strong password and consider setting up a guest network for clients to secure your main network.

Here are some additional tips for your Wi-Fi network: Change Default Settings: As soon as possible, change the default settings to prevent unauthorized users from accessing your network.
Regularly Update Router Firmware: Check for manufacturer updates regularly or enable automatic updates if your router supports it.
Monitor Connected Devices: Regularly check which devices are connected to your network and disconnect any connections you do not recognize.

4. Make Sure Your Software Encrypts Sensitive Data

Many software solutions offer built-in encryption features. Drake Software client files created within the software are encrypted; however, it’s also a good idea to encrypt your source files, such as PDFs of completed tax returns or any files used to prepare returns containing personally identifiable information (PII). When data is encrypted, it means that even if a cybercriminal gains access to your data, they most likely won’t be able to read it.

5. Regularly Update Software and Systems

Outdated software can be a goldmine for hackers. Regularly update your operating systems, accounting software, and antivirus programs. Many updates include patches for security vulnerabilities that cybercriminals may exploit. Consider setting your systems to update automatically to minimize risk.

6. Back Up Your Data

Regularly back up your data to an external hard drive or a secure cloud service. This practice will reduce the likelihood of losing your data if your system is compromised. It may be wise to implement a backup schedule. For example, perform daily backups for critical data like client tax returns and weekly for less essential information. Don’t forget to test your backups periodically to ensure they can be restored when needed.

Here are some more tips for backing up your sensitive information: Choose the Right Backup Solution: Evaluate your options between local backups (external hard drives) and cloud-based solutions. Combining both often provides the best protection, allowing for immediate access and off-site security.
Automate Backups: Set your backups to occur automatically to ensure consistency. Secure Your Backups: Ensure that your backup locations (both physical and cloud) are secure. For cloud storage, choose reputable providers that offer encryption and compliance with data protection regulations.

7. Limit Access to Sensitive Information

Not everyone in your office needs access to all client data. Implement a policy of least privilege—grant employees access only to the information necessary for their job. This minimizes the risk of internal data breaches and helps you keep a tighter lid on sensitive information.

8. Monitor Your Systems

Keep an eye on your network and systems for unusual activity. Invest in a good security information and event management (SIEM) system that alerts you to potential threats. Regular audits can help you identify vulnerabilities before they’re exploited.

9. Create or Update Your Written Information Security Plan (WISP)

Even with all precautions in place, breaches can still happen. Create or update your company’s WISP, outlining what to do in a cybersecurity incident. A WISP is an essential requirement for certain businesses, including tax professionals.
Need to create a WISP, but not sure where to start? You can download a sample WISP plan from the IRS website.
The WISP is a comprehensive plan that the FTC requires to have certain information. Some of this information includes the designation of a qualified individual to coordinate the security program and steps for reporting a security event affecting 500 or more people to the FTC as soon as possible.

10. Stay Informed

Cybersecurity is a constantly evolving field. Stay informed about the latest threats and best practices by following reputable cybersecurity blogs, attending webinars, or joining professional associations. Knowledge is your best defense against cyber threats.
Implementing these tips can help protect your business and your clients from cyber threats. Remember, it’s not just about securing data; it’s about building trust and maintaining your reputation in the industry.

Learn more about protecting your business and clients. Download our updated checklist: 10 Effective Cybersecurity Practices for Tax Preparers.