A stolen client file is a fraudulent refund. The IRS asks what you're doing about it.
Tax practices are attacked for exactly what they hold: names, Social Security numbers, bank details and prior-year returns. You confirmed a written security plan on your PTIN renewal; Alden writes it to match your firm, runs the controls behind it on your Microsoft 365 tenant and devices, and keeps the records that prove both — through filing season and after it.
Two regulators, one client file, and a very attractive target.
A tax practice holds exactly what a criminal needs to file a fraudulent refund: names, Social Security numbers, bank details and prior-year returns. The IRS and the FTC each set rules for protecting it. Alden builds one program that satisfies both, and keeps it running.
The written plan your PTIN renewal asks about
Every paid preparer confirms on renewal that they understand their data-security obligations, and IRS Publication 4557 spells out what the plan must cover. We write it to match your firm, not a template, and we keep the “Security Six” behind it running.
- ✓WISP written to Publication 4557, reviewed annually
- ✓Anti-malware, firewall, MFA, backup, drive encryption, secure remote access
- ✓Data-theft reporting procedure for the IRS and the state
FTC Safeguards Rule
Tax preparers and accountants are financial institutions under Gramm-Leach-Bliley, so the amended Safeguards Rule (16 CFR Part 314) applies in full — named controls, a qualified individual, and FTC notice within 30 days when a breach affects 500 or more people.
- ✓Qualified individual, written risk assessment, annual report to ownership
- ✓Encryption, access controls, logging, monitoring and disposal
- ✓Incident response plan, staff training, service-provider oversight
The questions that arrive every year
The cyber renewal application, a client's vendor questionnaire, and Florida's breach-notice law all ask versions of the same question: are the controls on, and can you prove it? Our answers come from live configuration, so they are true on renewal day and on the day of a claim.
- ✓Insurance application answered from the tenant, variances fixed before you sign
- ✓Client questionnaires turned around from the binder in days
- ✓Florida Information Protection Act notice timeline built into the plan
We schedule the hardening, enrollment and training for the quiet months. Book the fit call now and the plan is in place before the next season starts.
Nothing changes between February and April unless you ask.
We schedule hardening, device enrollment and training for the off-season, freeze non-urgent changes during peak, and keep 24/7 detection on every mailbox and laptop when the phishing volume is highest. Seasonal staff get managed accounts on day one and lose them on their last day — with the record to show it.
- ✓Change freeze during peak season; emergency-only exceptions, documented
- ✓Seasonal-staff onboarding and offboarding checklists with access records
- ✓Tax software, portals and e-file stay where they are; we secure the tenant and devices around them
- ✓Phishing tests paused during peak, resumed after the deadline
One program. Three readers.
Everything below is in the monthly agreement. Each item names who tends to ask for it.
- Written information security plan, reviewed annuallyAsked for by: IRS (PTIN), FTC, carrier
- Designated responsible individual and annual report to ownershipAsked for by: FTC, carrier
- Multi-factor sign-in on every account; legacy sign-in blockedAsked for by: IRS, FTC, carrier
- Every laptop enrolled, encrypted, patched and remotely wipeableAsked for by: IRS, FTC, carrier
- 24/7 detection and response on every identity and deviceAsked for by: carrier, clients
- Backups of mail, files and Teams, with a quarterly restore test on recordAsked for by: IRS, carrier
- Client data labeled; outside sharing and email of returns controlledAsked for by: FTC, clients
- Staff training and phishing tests, with completion recordsAsked for by: IRS, FTC, carrier
- Incident response plan with IRS, FTC and Florida notice timelines; annual tabletopAsked for by: IRS, FTC, carrier
- Vendor oversight file: tax software, portal, e-sign, cloudAsked for by: FTC, clients
Start with a conversation, not a contract.
Twenty minutes to confirm fit. If it fits, you start with a $995 assessment that counts toward onboarding: three weeks, a ranked findings report, yours to keep either way. Book it for the off-season and the plan is in place before the next renewal.
How we describe our work
Alden's assessments are point-in-time observations against named standards: IRS Publication 4557, the FTC Safeguards Rule and your insurer's application as written. We build and operate controls and produce the evidence behind them. We do not audit or certify your firm, and we do not provide legal advice. Your firm reviews and signs its own attestations. Regulators and insurance carriers make their own determinations; our work supports insurability and exam readiness, it does not guarantee either. Our controls reduce the likelihood and impact of the attacks described; no control prevents all of them.