Keeping Clients' Tax Data Secure
Leaders from the IRS, state tax commissioners, and the tax industry met in June to recap a year of progress made by the IRS Security Summit group. While the IRS and the states are stopping more suspicious tax returns than before, criminals are redoubling their efforts to steal personal data to file fraudulent federal and state income tax returns--increasingly, from tax return preparers, said IRS Commissioner John Koskinen. CPAs have not only an ethical but also a legal responsibility to safeguard any information obtained or used to prepare a tax return. Sec. 7216 imposes criminal and monetary penalties on tax preparers who knowingly or recklessly disclose return-related information. The Gramm-Leach-Bliley Act and Federal Trade Commission (FTC) financial privacy and safeguards rules impose additional requirements. Most states have enacted security breach notification laws that impose security and privacy standards across a wide variety of industries. Data protection encompasses all aspects of tax preparation: physical security, storage and transmission of data, and staff behavior. How do CPAs begin to protect themselves and their clients from cyberattacks? [ILLUSTRATION OMITTED] PROTECT YOUR FIRM The IRS provides a comprehensive road map to reducing risk in IRS Publication 4557, Safeguarding Taxpayer Data. This 20-page brochure furnishes seven checklists that cover operations, physical environment, computer systems, and employees to help preparers create a security plan for their office and operations. According to the IRS, preparers should create an electronic security strategy that includes: * Top-notch security software that includes a firewall and anti-malware and anti-virus programs. The software should be set to automatically update against the latest threats. Preparers should consider having firewalls for both hardware and software. * A communication policy and education program to ensure all employees understand the dangers of phishing emails (one reportedly masquerades as a tax software update) and other threats to taxpayer data. The policy should cover email usage and internet browsing, phone and laptop use, and personal storage. * Strong passwords that are changed periodically. Consider having different levels of password protection, such as separate passwords to access the computer system and tax software or client files. That way, if the computer system is breached, perhaps not all of the information will be exposed. * A secure wireless connection. Make sure Wi-Fi is password protected, and use encrypted email to exchange personally identifiable information with taxpayers. * "Deep scans" to fully scour all computer drives and files for any malware or viruses. These bugs can hide in places that a "quick scan" does not search. * A portal or email system to exchange data with clients safely. Sending data safely to a client is only half of the equation. Clients need a way to deliver information safely to you as well. * A data loss prevention system. Software is available that blocks unauthorized transmission, copying, or downloading of confidential data. * Physical security to complement the electronic security system. Review where you store clients' data while the tax return is being prepared and delivered. Are the file cabinets, shelves, and server rooms secure? While targeted less often by identity thieves than taxpayers' Social Security numbers, preparer tax identification numbers (PTINs) may also be used by criminals and should be protected. …