Client portals and data security
This category covers keeping client documents safe in transit and at rest. Posts explain what a client portal is and why clients resist logging in, how secure upload links and file sharing compare, why emailing tax documents is risky, and what IRS Publication 4557, the Security Six, a written information security plan and the FTC Safeguards Rule require. It also covers phishing, data theft reporting, staff access and document destruction. Day-to-day intake belongs to Collecting client documents. Start with "WISP for tax preparers: the written plan the IRS expects".
IRS Security Six: the six protections, explained
The IRS Security Six in plain terms: antivirus, firewalls, multi-factor login, backups, drive encryption and VPNs, with a quick check for each one.
October 16, 2026irsdata securityworkstations
WISP template for tax professionals, section by section
Fill in a WISP template for tax professionals one section at a time: the asset inventory, risk list, safeguards, response plan and the sign-off page.
October 14, 2026wisptemplatedata security
Email encryption for accountants: when and how to use it
Email encryption for accountants explained: TLS versus message encryption, how to send an encrypted message, and when a client should get a link instead.
October 14, 2026emailencryptionclient communication
Ransomware protection for accounting firms, layer by layer
Ransomware protection for accounting firms: how attacks get in, backups that survive them, settings that block them, and the first hour after one hits.
October 13, 2026ransomwarebackupsincident response
WISP for tax preparers: the written plan the IRS expects
What a WISP for tax preparers is, who must keep one, the elements the FTC Safeguards Rule requires, and how to size the plan to a solo or small practice.
October 12, 2026wispdata securitysafeguards ruleirs
FTC Safeguards Rule for tax preparers: what it requires
Why the FTC Safeguards Rule covers tax preparers, what it requires under the Gramm-Leach-Bliley Act, the small-firm exemptions and the FTC breach notice.
October 10, 2026safeguards ruleftcglbadata security
How to stop emailing tax documents without losing clients
How to stop emailing tax documents: why email and texts expose client data, the policy wording to send clients, and what to do when an attachment still arrives.
October 9, 2026emailclient policydata security
Security awareness training for accounting staff: a plan
Plan security awareness training for accounting staff: what the rules require, a 12-month calendar, seasonal onboarding and the records to keep.
October 9, 2026trainingstaffwisp
Access controls for accounting firm staff, step by step
Set access controls for accounting firm staff: map roles to client folders, give least privilege, review access each quarter and offboard on the last day.
October 9, 2026access controlstaffoffboarding
Secure upload link vs client portal: which fits your firm
A secure upload link vs a client portal, compared on client effort, what each protects, two-way exchange and staff upkeep, with a rule for picking per client.
October 8, 2026upload linksclient portalssecurity
Secure client portal for CPA firms: controls to check
The controls that make a secure client portal for CPA firms: encryption, login rules, access logs, link expiry and vendor reports, and how to verify each one.
October 8, 2026client portalssecurityvendor review
Secure file sharing for accountants: a setup guide
Set up secure file sharing for accountants: choose a sharing method, lock down link settings, name an owner for each share and close shares after the season.
October 4, 2026file sharingsecuritytax season
Encryption at rest vs in transit, for accounting firms
Encryption at rest vs in transit in plain terms: what each one protects in a firm, where client files sit unprotected, and the questions to ask a vendor.
October 3, 2026encryptiondata securityvendors
IRS Publication 4557: a safeguarding checklist for firms
IRS Publication 4557 turned into a working checklist: what each part asks a tax firm to do about safeguarding taxpayer data, and how to record that it is done.
October 1, 2026irsdata securitychecklist
Secure document destruction for accountants: a how-to
Secure document destruction for accountants: shredding paper, wiping drives and cloud copies, keeping a destruction log, and what the Disposal Rule expects.
October 1, 2026destructiondisposalrecords
IP PIN for tax clients: who needs one and how to get it
What an IP PIN does for tax clients, which clients should get one, how they request it, and how to collect the new PIN each season without delays.
September 27, 2026ip pinidentity thefttax season
Remote work security for tax preparers: a home office guide
Remote work security for tax preparers at home and on the road: home networks, personal laptops, public Wi-Fi, paper at home and lost devices.
September 3, 2026remote workhome officedevices
Phishing scams targeting tax preparers and how to spot them
The phishing scams targeting tax preparers each season, from fake new clients to IRS impersonation, the signs that give each away and a staff drill to run.
August 20, 2026securityphishingstaff training
How to redact SSN from client documents before sharing
How to redact SSN digits from client documents so they stay gone: when to redact, why black boxes fail in PDFs, and how to check a redacted file.
August 20, 2026redactionssnpdfdata security
Why clients avoid client portals, and what to change
Why clients avoid client portals: forgotten passwords, one visit a year, phone-unfriendly screens and unclear requests, and the change that fixes each cause.
August 16, 2026client portalsclient communicationadoption
How to roll out a tax client portal to individual clients
Roll out a tax client portal to 1040 clients in stages: pick pilot clients, write the invite, handle first sign-in and keep a fallback for clients who stall.
July 21, 2026client portalstax seasonrollout
Client portal for accountants: what it actually does
What a client portal for accountants does: logins, document exchange, requests and signatures, how it differs from email and shared drives, and who needs one.
July 8, 2026client portaldocument collectionsecurity
How to report data theft to the IRS as a tax preparer
How to report data theft to the IRS as a tax preparer: who to call first, what the Stakeholder Liaison needs, and which state, FTC and client notices follow.
June 26, 2026securitydata breachirs
SOC 2 report for accounting software: how to read one
How to read a SOC 2 report for accounting software: Type 1 vs Type 2, the auditor's opinion, exceptions, your firm's own controls and out-of-date reports.
June 5, 2026soc 2vendor reviewwisp
What to look for in a client portal: a buyer's checklist
What to look for in a client portal before you buy: client sign-in effort, request tracking, staff seats, exports and cost, scored on one buyer's checklist.
May 16, 2026client portalbuying guidesoftware
Multi-factor authentication for tax professionals
Set up multi-factor authentication for tax professionals across email, tax software and cloud storage, pick the right factor type and plan for lost phones.
February 14, 2026securitymfatax season