6 free security fixes for accounting firms before tax season

Tax season is the worst time to discover a security gap and the best time for an attacker to exploit one. These six fixes cost nothing but an afternoon, and several of them are things the FTC Safeguards Rule already expects of tax and accounting firms.

1. Turn on multi-factor sign-in everywhere

A stolen password alone shouldn't get anyone into client data. Turn on multi-factor authentication (MFA) for:

• Microsoft 365 or Google Workspace
• Your tax and accounting software and client portal
• Online banking and payroll
• Remote access and VPN

MFA is free on most of these platforms, and it's one of the specific safeguards the Safeguards Rule requires.

2. Shut off last season's accounts

Seasonal preparers, interns and contractors often keep working logins long after they leave. For each account, ask: does this person still work with us, and does this account still need the access it has? If not, remove it.

3. Take away admin rights that aren't needed

An administrator account can install software, change settings and turn off security tools, which is why attackers want one. Most staff don't need admin rights to do their jobs. Remove them, and give the few who do need them a separate admin account they use only for that.

4. Turn on automatic updates

Attackers go after software with known holes. Make sure automatic updates are on for Windows and macOS, phones, browsers, Microsoft Office, your PDF software and security tools. Schedule the big updates before January, not during the busiest week of March.

5. Stop sharing passwords on sticky notes

A password manager lets each person keep a strong, unique password for every system and share access safely when needed. It also ends the practice of everyone using the same login for the same software, which makes it impossible to tell who did what.

6. Prove your backups restore

Ask three questions now, while there's time to fix the answers:

• When did the last successful backup run?
• When did someone last restore a client file from it?
• How long would it take to get the whole firm working again?

A backup that has never been tested is a hope, not a plan.

Then write it down

Each of these belongs in your written information security plan (WISP). If you don't have a real one yet, our guide to the FTC Safeguards Rule and WISPs for tax firms walks through what it needs to include.