Cybersecurity for Accounting Firms: A Safeguards Rule Guide for Oklahoma CPAs
Cybersecurity for accounting firms is not optional, because federal law treats tax and accounting practices as financial institutions. Under the Gramm-Leach-Bliley Act and the FTC Safeguards Rule, tax and accounting professionals are considered financial institutions, regardless of size, according to IRS Publication 5708. That means a written security plan, a named person in charge and real technical controls. This guide explains what the rules require, the threats aimed at CPA firms, and a six-step plan for Oklahoma practices of any size.
Get Protected
Endpoint Detectives runs 24/7 managed detection and response (MDR) on CrowdStrike for $150 per workstation per year, billed annually up front. No hidden fees.
Why Is Cybersecurity for Accounting Firms So Important?
Accounting firms hold exactly what criminals want: Social Security numbers, bank details, payroll files and prior tax returns. One stolen login can expose every client in the practice management system.
Attackers also know tax season is the worst time for a firm to be offline. The Verizon 2026 DBIR found ransomware was present in 48% of breaches. A locked file server in March is not just an IT problem; it is missed deadlines and calls from every client at once.
Most intrusions no longer look like a virus. The CrowdStrike 2026 Global Threat Report found 82% of detections were malware-free, which means attackers sign in with stolen credentials and use normal tools. Antivirus alone will not notice.
Does the FTC Safeguards Rule Apply to CPAs?
Yes. The FTC Safeguards Rule applies to tax and accounting professionals, including sole practitioners, because the Gramm-Leach-Bliley Act (GLBA) treats them as financial institutions.
The FTC Safeguards Rule requires a written information security plan (WISP), a designated qualified individual, a written risk assessment, regular monitoring and testing, oversight of service providers, and multi-factor authentication for anyone accessing an information system, according to IRS Publication 5708.
| Requirement | What it means in practice |
|---|---|
| Written information security plan | A document describing how you protect client data |
| Qualified individual | One named person who owns the program |
| Risk assessment | A written review of where client data lives and what could go wrong |
| Monitoring and testing | Ongoing checks that your safeguards actually work |
| Service provider oversight | Contracts that require vendors to protect your data |
| Multi-factor authentication | A second login step for every user on every system |
The FTC Safeguards Rule, 16 CFR 314.4(d)(2), requires covered financial institutions without continuous monitoring to run annual penetration testing and vulnerability assessments at least every six months. Continuous monitoring is one way to meet that testing requirement.
Step 1: Name Your Qualified Individual
Pick one person to own your security program, and write their name in the plan. In a small firm this is often a partner or office manager, supported by an outside provider.
The qualified individual does not have to do every task. Their job is to make sure the tasks get done, keep records, and report to the partners at least once a year.
Step 2: Write or Update Your WISP
Start your WISP from IRS Publication 5708, which is a template built for tax and accounting practices. IRS Publication 4557, Safeguarding Taxpayer Data, is a useful companion that explains the controls in more detail.
A good WISP covers three areas:
- Administrative safeguards. Policies, staff training and who has access to what.
- Physical safeguards. Locked offices, secure storage and how you dispose of old drives.
- Technical safeguards. Multi-factor authentication, encryption, backups and monitoring.
Keep it short enough that staff will read it. A plan nobody opens does not protect anyone. Have every employee sign an acknowledgment after training, and store a copy of the plan somewhere you can reach if the office network is down.
Step 3: Complete a Written Risk Assessment
List every place client data lives, then rate what could go wrong at each one. Include tax software, cloud storage, email, scanners, laptops and any personal phones that check work email.
For each location, note who can reach it and how it is protected. Our cybersecurity risk assessment template gives you a ready-made worksheet for this step.
Step 4: Turn On Multi-Factor Authentication Everywhere
Require multi-factor authentication for every user on every system that touches client data. That includes email, tax software, remote access and your document portal.
This single control closes the door attackers use most. Stolen passwords stop working when a second factor is required, and the rule makes it mandatory unless your qualified individual approves an equivalent control in writing.
Get Protected
Need monitoring and testing that fits the Safeguards Rule? Endpoint Detectives includes 24/7 monitoring, vulnerability scanning and remote incident response in one plan.
Step 5: Add Monitoring and Testing
Put someone on watch around the clock, and scan for weaknesses on a schedule. Attackers move quickly once inside. The CrowdStrike 2026 Global Threat Report found average eCrime breakout time fell to 29 minutes, and the fastest observed breakout was 27 seconds.
Endpoint detection and response (EDR) software records activity on every computer so an analyst can spot and stop an intruder. A security operations center (SOC) is the team that reads those alerts day and night. Every Endpoint Detectives subscription includes the CrowdStrike EDR license, endpoint monitoring, network monitoring, cloud monitoring, vulnerability scanning, SIEM log aggregation, a 24/7 SOC and remote incident response. A security information and event management (SIEM) system pulls your logs into one place for investigation.
Endpoint Detectives analysts can respond to a confirmed threat in as little as 15 minutes. Endpoint Detectives customers deploy the CrowdStrike agent themselves with an easy-to-follow guide, so there is no on-site visit to schedule around tax season. Learn more on our managed detection and response page.
Annual testing still has its place. Our guide to vulnerability scans vs penetration tests explains when an outside test makes sense.
Step 6: Plan Your Breach Response Before You Need It
Write down who you will call and in what order if client data is exposed. The IRS recommends tax professionals develop a data theft response plan that includes contacting their IRS Stakeholder Liaison to report a security incident.
Two reporting duties matter most for Oklahoma firms:
- The FTC. Under the FTC Safeguards Rule, a security event affecting 500 or more people must be reported to the FTC as soon as possible and no later than 30 days after discovery, through an online form on ftc.gov.
- The Oklahoma Attorney General. Under Oklahoma SB 626, effective January 1, 2026, an entity must notify the Oklahoma Attorney General no later than 60 days after notifying affected residents when a breach affects 500 or more Oklahoma residents.
Keep your incident response services contact in the plan so you are not searching for help during the worst week of the year.
How Does Oklahoma Law Affect Accounting Firms?
Oklahoma law rewards firms that can prove they took reasonable care. Under Oklahoma SB 626, an entity that used reasonable safeguards and gave the required notice faces no civil penalty and has an affirmative defense in a civil action.
SB 626 defines reasonable safeguards as policies and practices that protect personal information appropriate to the size of the entity, including risk assessments, technical and physical layered defenses, employee training and an incident response plan. A current WISP, a dated risk assessment and monitoring records are the evidence that shows you met that standard.
Endpoint Detectives is a CrowdStrike partner headquartered at 720 NE 63rd St in Oklahoma City and serves businesses nationwide. See our Oklahoma City cybersecurity and Tulsa cybersecurity pages for local coverage.
How Much Does Cybersecurity Cost for a CPA Firm?
Budget by workstation, then add any one-time projects such as a penetration test. Endpoint Detectives MDR is $150 per workstation per year, billed annually up front. No hidden fees. The closest comparable MDR provider costs about twice as much.
For a small practice, the biggest costs are usually time rather than software: writing the plan, training staff and reviewing vendor contracts. A managed plan removes the hardest ongoing piece, which is watching alerts every night and weekend. Our MDR pricing page has a calculator so you can run the numbers for your own office before the next filing season starts.
What Mistakes Do CPA Firms Make Most Often?
- Treating the WISP as a one-time form. Review it at least once a year and after any big change.
- Skipping multi-factor on the tax software. Attackers go straight to the system with the returns.
- Trusting vendors without checking. The Verizon 2026 DBIR found third-party involvement appeared in 48% of breaches, up from 30%.
- Leaving seasonal staff off the training. Temporary hires get phishing emails too, often in their very first week.
- No one watching after hours. Attackers prefer nights, weekends and the week before a deadline.
FAQ
Do accounting firms need a WISP?
Yes. Tax and accounting professionals are legally required to have a written, accessible information security plan under the FTC Safeguards Rule. IRS Publication 5708 provides a free template.
Does the FTC Safeguards Rule apply to small CPA firms?
Yes. The rule applies to tax and accounting professionals regardless of size, so a sole practitioner needs a plan too, even if it is shorter.
How do accounting firms protect client data?
Start with multi-factor authentication, a written risk assessment, encrypted backups and staff training. Then add 24/7 monitoring so someone can act when an attacker gets in.
What should a CPA firm do after a data breach?
Contain the incident, preserve evidence, contact your IRS Stakeholder Liaison and follow your notice duties to clients, the FTC and the Oklahoma Attorney General. Consult your attorney about your specific obligations.
Conclusion
Cybersecurity for accounting firms comes down to six steps: name an owner, write the WISP, assess risk, require multi-factor authentication, monitor and test, and plan your response. Each step also builds the record that shows regulators and clients you took reasonable care.
This article is general information, not legal or tax advice. Consult your attorney or professional association about your firm's specific obligations.
Get Protected
Endpoint Detectives delivers 24/7 MDR on CrowdStrike for $150 per workstation per year, billed annually up front. No hidden fees. You deploy the agent yourself with our easy-to-follow guide. Talk to us before your next tax season.
Born in Oklahoma. Hunting threats everywhere. Real humans. Real response. No corporate runaround. No hidden fees. No mercy for threats.
Last updated: October 28, 2026