Remote work security for tax preparers: a home office guide

Remote work security for tax preparers comes down to five areas: a home router with a changed password and current firmware, a firm-controlled laptop, no public Wi-Fi without the firm's VPN, client paper locked up and shredded at home, and a plan for a lost device. Each remote worker signs a checklist covering all five.

Home network setup for remote tax preparers

Home network setup for remote tax preparers starts at the router: change its default administrator password, keep its firmware updated, use WPA3 or the strongest encryption it offers, and keep work devices apart from the household's phones, games and smart speakers where the router allows it. A compromised family device on the same network can reach the work laptop.

IRS Publication 4557 (Rev. 6-2024) lists basic router steps for anyone who uses wireless for client work. Among them: "Change default administrative password of your wireless router; use a strong, unique password," "Use Wi-Fi Protected Access 3 (WPA-3)," and do not use WEP, which "is not considered secure." It also asks preparers to rename the network to something "not personally identifying." It opens the list with a stronger preference: "If you can, do not use wireless networks for computers or devices that process, display, or print client information."

NIST Special Publication 800-114 Rev. 1 (July 2016), a federal guide to telework security, adds firmware. It suggests "Checking for updates and applying them periodically," either automatically or "manually (to be performed by the teleworker at least monthly)." It also suggests configuring the router "so that it cannot be administered from outside the home network."

The household is the part office security plans forget. NIST explains why: if other devices on the home network "become infected with malware or are otherwise compromised, they could be used to attack the telework device or eavesdrop on its communications." It notes that a router can sometimes protect devices "from each other" when they are "logically separated." IRS Publication 5708 (Rev. 8-2024) applies the same idea in an office: guest Wi-Fi "will be on a different network and Wi-Fi node from the Firm's Private work-related Wi-Fi." At home, if the router offers a guest network, it can play that role for the family's devices, with the work laptop on the main network, or the other way round.

How the six basic IRS protections apply to home offices and phones is covered in do Security Six protections cover phones and home offices? This section stays with the network.

Firm-owned or personal laptops for remote tax work?

Firm-owned laptops are the safer choice for remote tax work, because the firm sets them up, keeps them updated and can lock or wipe them. Personal laptops are shared with family and sit outside the firm's control. If a firm allows them, it needs a written minimum: separate account, encryption, current updates, security software and no client files saved locally.

Publication 4557 notes that "Some firms issue laptops to teleworking employees in order to control the IT environment." Publication 5708 goes further and recommends keeping client data off personal devices altogether; the IRS wording on personal computers is quoted in do Security Six protections cover phones and home offices?

The risk with a personal laptop is everyone else who uses it. Publication 5708 says separating personal and business computers "is especially important if other people, such as children, use personal devices." A child installing a game mod and a preparer opening a client's K-1 should not happen on the same machine.

Minimum controls if the firm allows personal laptops

Publication 4557's checklist asks for antivirus and anti-spyware protection on any personal computer used for client data. NIST SP 800-114 lists actions for securing a personal telework computer, including:

• "having a separate standard user account for each person" and "using the standard user accounts for daily use";
• "Ensuring that updates are regularly applied to the operating system and primary applications";
• "Installing and using only known and trusted software."

Add drive encryption, so a lost or stolen laptop does not expose what is on it. And add a rule that client files stay in the firm's systems, opened remotely, not downloaded to the personal machine.

Remote staff should also get only the client access their work needs, a separate control explained in least privilege for seasonal and remote accounting staff.

Public Wi-Fi and hotel networks for tax preparers on the road

Public Wi-Fi and hotel networks should be treated as offering no protection at all. A tax preparer on the road should avoid them for client work, use the firm's VPN immediately if there is no other choice, and prefer a network the preparer controls, such as a password-protected phone hotspot, over a network shared with strangers.

Publication 4557 is direct: "Do not use a public wi-fi (for example, at a coffee café or airport) to access business email or sensitive documents." Its baseline of a VPN and multi-factor login for remote access is covered in the Security Six post.

NIST SP 800-114 explains the reasoning. Networks other than the teleworker's home network "are unlikely to provide much protection," and "external networks may not encrypt network communications, making them susceptible to eavesdropping." Because there is no easy way to check, NIST says "teleworkers should assume that third-party networks are not providing any protection." When a preparer must use one, NIST advises using the organization's VPN and activating it "immediately after connecting to the third-party network." It also suggests updating devices before the trip, over a trusted network.

A phone hotspot is not a third-party network in NIST's sense. The preparer sets its password and knows who is on it. That does not make it a substitute for the VPN, but it removes the stranger at the next table from the network.

What about hotel business center computers?

Do not use them. NIST warns that teleworkers "typically do not know if such devices have been secured properly or if they have been compromised," and gives "checking email from a kiosk computer at a hotel" as its example. A shared computer can record every password typed on it.

Printed client paper in a remote tax preparer's home

Printed client paper in a remote tax preparer's home needs office rules: print only what is needed, keep it in a locked drawer or cabinet when not in use, keep it away from family members and visitors, and cross-cut shred it at home or bring it back to the office. Never leave it in a car.

Publication 5708's sample plan sets the standard for paper leaving the office: "only the minimum information necessary will be checked out," records "will be returned to the secure storage location as soon as possible," and "Under no circumstances will documents, electronic devices, or digital media containing PII be left unattended in an employee's car, home, or in any other potentially insecure location." A home office with a locked cabinet is the practical reading of that last line.

Home printers are a quiet risk. Publication 4557 includes printers among devices to avoid connecting over wireless where possible, and Publication 5708's sample policy says wireless-capable printers "will have default factory passwords changed." A printer can also hold data of its own, so it should be wiped before it leaves the house for repair or recycling; the steps are in wiping laptops, drives and copiers before secure disposal.

For paper, Publication 5708's template specifies "cross-cut shredding or incineration," so a strip-cut shredder in a home office does not meet its wording. How to judge a shredder is covered in shredding standards for client paper documents.

Printing less is the simplest control. A page with a full Social Security number is a bigger problem on a kitchen table than one with the last four digits; how to mask numbers before printing or sharing is the subject of how to redact an SSN from client documents.

How should a remote preparer handle a lost or stolen laptop?

A remote preparer who loses a laptop should report it to the firm at once, lock or erase it remotely, change every password that was saved or used on it, and file a police report if it was stolen. The firm then decides whether client data was exposed and must be reported.

The remote tools depend on the device, and they work only if they were turned on beforehand:

• Windows. Microsoft's support page Find and lock a lost Windows device says Find My Device "needs to be turned on before you can use it." From account.microsoft.com/devices, the owner can select "Lock," and "Once your device is locked, you can reset your password for added security." The page also recommends reporting a stolen device "to your local law enforcement as well as your insurance company." Firm-managed laptops may have other remote tools set up by the firm's IT provider.
• Mac, iPhone and iPad. Apple's guide Erase a device in Find Devices on iCloud.com says that if a device "is lost or stolen, you can erase it." If the device is offline, "the remote erase begins the next time it's online."

Passwords come next. Change the passwords for email, tax software, the firm's remote access and anything saved in the laptop's browser, and confirm multi-factor login is on for each.

Whether the loss is a reportable data theft depends on the facts, such as whether the drive was encrypted and whether client files were stored on it. That question has its own section in what counts as data theft a tax preparer must report. Clients whose data may have been on the laptop are good candidates for an Identity Protection PIN; the post on IP PIN for tax clients covers who should get one.

Remote work mistake: client files in personal email and cloud accounts

Forwarding client files to a personal email or personal cloud account to work from home moves them outside everything the firm protects: its multi-factor login, its access rules, its backups and its offboarding. The copy then stays in that account indefinitely, often on a phone the whole family uses.

Publication 5708 says plainly: "Do not send sensitive business information to personal email addresses." Publication 4557 asks preparers to "Use separate personal and business email accounts." The reasons are practical. The firm cannot see who else can open a personal account. It cannot require multi-factor login on it. When the employee leaves, the firm can close the work account but not the copy in their personal inbox.

The habit usually starts innocently. A preparer cannot reach the office system from home, so they email a client's W-2s and a brokerage statement to themselves "just for tonight." The attachment then syncs to a personal phone and a personal cloud backup, and nobody remembers to delete it.

The fix is to make the firm's route easier than the workaround. Give remote staff working remote access before busy season, test it from home, and make the rule part of the checklist below. Fewer copies also start at intake: Schema CPA gives each client one upload link, and email attachments, phone photos and portal downloads all land in that client's file, so a remote preparer opens the client's file rather than asking for documents to be forwarded; the workflow section of the homepage walks through the steps.

Remote preparer security checklist (example)

The checklist below is an example for a fictional firm. Each remote worker completes it, signs and dates it, and redoes it every year or after a move.

Signed: ______________ (example: Dana Reyes, remote preparer) Date: __________ Reviewed by: ______________