Cybersecurity for Accountants, Tax Preparers and Law Offices

What a small professional office actually holds

The Census Bureau's County Business Patterns for 2023 counted about 214 accounting, tax and payroll firms, 255 legal services firms and 150 insurance agencies in Santa Barbara County, and about 149 accounting firms and 150 legal firms in San Luis Obispo County. Most are small: a few partners, some staff, a shared drive, a client portal and a busy inbox.

That inbox and drive hold Social Security numbers, bank account details, tax transcripts, medical records in injury files and settlement amounts. A breach is a business problem, a client-trust problem and, in many cases, a regulatory one.

Jacob Keith holds the CISSP, CompTIA CySA+ and CompTIA SecurityX, and brings about six years of security compliance work on government systems,

The FTC Safeguards Rule: WISP and Qualified Individual

The FTC Safeguards Rule (16 CFR Part 314) covers many financial-type businesses, including tax preparers and many accounting firms. It expects a written information security program (WISP) built on a risk assessment, with a named Qualified Individual responsible for it, plus:

• Multi-factor authentication for anyone accessing customer information
• Encryption of customer information in transit and at rest
• Security awareness training for staff
• Oversight of service providers that handle customer data
• A written incident response plan
• A periodic report to the owner or partners

If a security event involves unencrypted information of 500 or more consumers, the rule requires notice to the FTC no later than 30 days after discovery. The rule text and FTC business guidance are at ftc.gov.

Keith Systems helps you prepare: a risk assessment of how your office really works, a WISP written for your size rather than a generic template, and the evidence to show controls are in place. Whether the rule applies to your firm is a question for your own counsel. The FTC Safeguards WISP guide for tax preparers covers the basics.

Law firms and insurance agencies often answer to different rules: professional confidentiality duties for attorneys and state insurance regulation for agencies. The practical controls overlap heavily, but Keith Systems does not tell you which laws apply.

MFA, encryption and the vendors who touch client files

Most small-office incidents start with one stolen password. Keith Systems reviews your email, document storage, tax or practice software and remote access, and checks that multi-factor authentication is on for every account, including the partner who "never logs in from outside."

Encryption review covers laptops, file shares, backups and email containing sensitive attachments. Vendor oversight means a simple list: who holds client data (payroll service, e-signature, portal, cloud storage, IT support), what you have in writing from each, and how access is removed when a relationship ends. For Microsoft 365 offices, the Microsoft 365 security checklist is a good starting point.

Client portals deserve their own look: who can create accounts, whether clients must use MFA, how long files stay posted, and what happens when staff leave.

Business email compromise and wire fraud

Escrow and settlement payments, client refunds and payroll make professional offices a favorite target. The common pattern: an attacker gets into a mailbox (yours, a client's or a title company's), watches quietly, then sends perfectly timed wire-transfer instructions.

Defenses that work in a small office:

1. Never change payment details based on email alone. Call a number you already had on file.
2. Require two-person approval for new payees and changed bank details.
3. Tell clients in writing, early, that you will never change wire-transfer instructions by email.
4. Turn on mailbox alerts for new forwarding rules, a common sign of a takeover.
5. Review sign-ins for logins from unexpected locations.

More detail is in the business email compromise guide.

If something goes wrong: the 30-day California clock

California Civil Code 1798.82, as amended by SB 446 effective January 1, 2026, requires notice to affected California residents within 30 calendar days. If more than 500 residents are affected, a sample copy of the notice goes to the Attorney General within 15 days after notifying consumers. Firms covered by the Safeguards Rule may also owe the FTC notice.

Thirty days goes fast when you are still working out what happened. An incident response plan written in advance, with your counsel, insurer and key contacts listed, makes the difference. See the California breach notification guide and incident response readiness.

Tax-season readiness and free local help

The best time to tighten security is before January, not during it. A pre-season checklist: remove departed staff accounts, confirm MFA everywhere, test a backup restore, review the vendor list, refresh staff training on phishing and fake client requests, and walk your team through who calls whom if a mailbox is compromised.

Free help is worth using. The EDC SBDC, which offers free counseling to small businesses in Santa Barbara and Ventura counties, is running a free small-business cybersecurity webinar series from October 1, 2026 to April 7, 2027, including a session for accountants on the FTC Safeguards and GLBA written information security program. Keith Systems is not affiliated with it; it is simply good, free material. See free cybersecurity help on the Central Coast.

When you want hands-on help with your own office, book a free security consult or call (805) 800-8163.