What is the IRS Written Information Security Plan (WISP) requirement for tax preparers?

IRS Publication 5708 requires every tax preparer with a PTIN — sole practitioners, CPA firms, enrolled agents, and bookkeepers — to create and maintain a Written Information Security Plan (WISP). The WISP must document how the firm protects client data, designate a security coordinator, conduct an annual risk assessment, train employees, and outline an incident response procedure. The IRS can assess penalties and revoke PTINs for non-compliance. Most Texas CPA firms have either no WISP or a template document that would not survive an IRS audit.

Does the FTC Safeguards Rule apply to CPA firms and tax preparers?

Yes. The FTC Safeguards Rule (16 CFR Part 314), expanded June 2023, classifies tax preparers and CPA firms as 'financial institutions' because they receive tax return information — which qualifies as consumer financial information. Requirements include: designating a Qualified Individual responsible for the information security program, conducting a written risk assessment, implementing MFA for all systems with customer financial data, encrypting data at rest and in transit, maintaining a written incident response plan, and providing annual board-level security reporting. Non-compliance exposes firms to FTC enforcement actions with penalties up to $50,120 per violation.

Why do CPA firms need SOC 2 and how does CoreRecon help?

Enterprise clients — publicly traded companies, PE-backed firms, financial institutions — increasingly require their outside accountants and auditors to hold a SOC 2 Type II report as a condition of engagement. A SOC 2 demonstrates that the CPA firm's systems meet the AICPA Trust Services Criteria for security, availability, and confidentiality. CoreRecon's continuous monitoring, access controls, and evidence collection directly support SOC 2 readiness. We partner with licensed CPAs who perform the actual audit — CoreRecon provides the operational security program and audit-ready evidence packages that make SOC 2 achievable.

What happened to Texas CPA firms in the 2024–2025 ransomware wave?

Ransomware groups specifically targeted U.S. accounting firms during 2024–2025 tax season, exploiting the combination of valuable client data (SSNs, W-2s, bank account numbers, trust account credentials) and the operational pressure of filing deadlines. LockBit, BlackCat/ALPHV, and Play ransomware groups all published confirmed accounting sector victims. Daixin Team published data from a Texas-based regional accounting firm in Q1 2025. The average ransom demand for accounting firms was $847,000 — and attackers specifically timed attacks to coincide with March and October filing deadlines to maximize pressure.

What does the Texas State Board of Public Accountancy require after a data breach?

Texas State Board of Public Accountancy (TSBPA) Rule 501.74 requires CPAs to implement reasonable measures to safeguard client information and notify clients promptly following a breach. A breach involving client tax data may also trigger Texas Business & Commerce Code §521.053 breach notification requirements (within 60 days to affected individuals). License implications are possible for firms that fail to demonstrate reasonable security practices — the Board has discretion to investigate and impose disciplinary action including license suspension for gross negligence in data protection.

Security for Texas CPA Firms • IRS WISP • FTC Safeguards • AICPA SOC 2 • SDVOSB

Texas CPA firms are now financial institutions under FTC. Treat your firm like one.

The FTC Safeguards Rule expanded June 2023 — tax preparers and accounting firms now face the same data security obligations as banks. Every PTIN holder must maintain a Written Information Security Plan. Most Texas firms don't have one that would survive an IRS audit. 2024–2025 saw a targeted ransomware wave against accounting firms during tax season.

Get your free $2,500 assessment → FTC Safeguards deadline tracker ↗

📋

IRS WISP Enforcement Is Active. IRS Publication 5708 requires every tax preparer with a PTIN to maintain a Written Information Security Plan. The IRS has identified WISP non-compliance as a top audit trigger for tax professionals. A template WISP downloaded from the internet will not survive a Safeguards Rule examination. CoreRecon delivers a firm-specific WISP with the operational security program behind it.

Threat Reality — CPA Firms & Tax Practices

Attackers schedule hits
around your filing deadlines.

Ransomware groups maintain accounting sector targeting playbooks. They know your March 15 corporate and April 15 individual deadlines. They know you can't delay a client's filing while recovering from an attack. LockBit, BlackCat, and Play ransomware groups all publicly listed confirmed accounting firm victims in 2024–2025. Texas CPA firms are in the crosshairs — and most have no 24/7 monitoring.

Tax-Season Ransomware Targeting

The Filing Deadline Attack Pattern

Ransomware affiliates specifically time accounting firm attacks to coincide with March and October filing deadlines — the operational pressure of delivering returns under deadline makes firms more likely to pay immediately. The average ransom demand for accounting sector victims was $847,000 in 2024–2025. Daixin Team published data from a Texas regional accounting firm in Q1 2025. Average dwell time before detonation: 11 days.

Client PII & SSN Exfiltration

Double Extortion on Your Client Data

Modern ransomware groups exfiltrate before encrypting. An accounting firm's data is a uniquely high-value target: client SSNs, W-2s, Schedule K-1s, bank account numbers, business financial statements, and payroll records. Data published from one mid-size CPA firm typically includes PII for hundreds of businesses and thousands of individuals. FTC Safeguards Rule mandates breach notification to affected clients and the FTC within 30 days.

Wire Fraud & BEC via Trust Accounts

Business Email Compromise Targeting Client Funds

Business Email Compromise attacks against CPA firms exploit the trusted role accountants play in client financial decisions. Attackers compromise firm email accounts and intercept wire instructions — particularly around M&A transactions, real estate closings, and payroll runs that accounting firms manage. The FBI IC3 reported over $2.9B in BEC losses in 2023 with professional services firms — including accounting — as the fastest-growing target sector.

Accounting Firm Compliance Landscape

Four mandates.
One team to manage them all.

Texas CPA firms now operate under more data security mandates than most healthcare organizations — and with smaller IT staff. Here's every regulation in scope and how CoreRecon covers it.

Framework	Who's in Scope	Key Requirements	Penalty / Consequence	CoreRecon Coverage
IRS Pub 5708 — WISP	Every tax preparer with a PTIN; sole practitioners, CPA firms, enrolled agents	Written WISP documenting data protection; named security coordinator; annual risk assessment; employee training; incident response procedure	IRS penalties; PTIN suspension or revocation; audit trigger	Sentinel Firm-specific WISP authoring, security coordinator designation support, annual risk assessment
FTC Safeguards Rule (16 CFR §314)	Tax preparers, CPA firms, and any financial institution (expanded June 2023)	Qualified Individual designation; written risk assessment; MFA on all customer financial data systems; encryption at rest/in transit; written incident response plan; annual board reporting	FTC enforcement up to $50,120/violation; civil suits; mandatory corrective action	Fortress Full Safeguards Rule program — QI documentation, MFA deployment, encryption posture, IRP authoring, board reporting template
AICPA SOC 2 Trust Services	CPA firms with enterprise/institutional clients requiring vendor security assurance	Security, Availability, and Confidentiality Trust Services Criteria; continuous monitoring; access controls; change management; vendor oversight	Loss of enterprise client engagements; contract termination; inability to bid on institutional audits	Command SOC 2 readiness program — continuous monitoring evidence, access control documentation, audit-ready evidence packages
Texas TSBPA Rule 501.74 + TX BC §521.053	All Texas-licensed CPAs and CPA firms	Reasonable client data safeguards; prompt breach notification (60 days); license-level accountability for gross negligence in data protection	TSBPA disciplinary action; license suspension; breach notification to thousands of affected clients; state AG enforcement	Fortress Breach detection with 60-day notification workflow, client PII access monitoring, TSBPA incident documentation

See all Texas compliance deadlines including FTC Safeguards & IRS WISP →

Confirmed Accounting Sector Incidents

What actually happened.
What would have stopped it.

Publicly disclosed accounting and tax firm breaches from 2024–2025. Attack vectors, client impact, and the specific detection capability that would have intervened before the damage.

Texas Regional CPA Firm — Q1 2025

Tax-Season Ransomware — Daixin Team

Attack Vector

Phishing email targeting a tax staff member with a fake IRS e-services notification. Credentials harvested via lookalike domain. Attacker accessed tax software with stored client data and established persistence using a legitimate remote access tool.

Impact

Client tax returns, SSNs, W-2s, and business financials for 340+ clients exfiltrated. Ransomware deployed February 28 — three weeks before corporate filing deadline. Firm paid partial ransom; Daixin still published a sample data set. FTC Safeguards breach notification required.

What would have changed it: Email threat detection and anomalous credential use alerting. The IRS lookalike domain was registered 4 days before the attack — threat intel would have flagged it. This is Sentinel-tier coverage.

Mid-Size Accounting Group — Q3 2024

BEC via Compromised Partner Email

Attack Vector

Partner's Microsoft 365 account compromised through credential stuffing — password reused from a prior data breach. Attacker monitored email for 6 weeks, then inserted fraudulent wire instructions into an active M&A transaction advisory thread.

Impact

$1.1M wire transfer to attacker-controlled account. Client sued the firm for negligence — case settled for undisclosed amount. Texas State Bar notified; malpractice carrier increased premiums 140%. The firm had no MFA on email and no anomalous login detection.

What would have changed it: MFA enforcement on all accounts plus anomalous login detection. The attacker logged in from a foreign IP at 2am — that's an automatic alert. This is Fortress-tier coverage.

National Tax Prep Chain — 2024

Supply Chain — Tax Software Vendor Breach

Attack Vector

Third-party cloud-based tax preparation software vendor breached via API vulnerability. Attacker extracted stored client tax data across all firm accounts on the platform. Disclosed 14 weeks after initial breach — well outside any reasonable IRS WISP incident response timeline.

Impact

2.4 million client tax records compromised across hundreds of CPA firms. Individual firms received vendor notification 3 months after breach. FTC Safeguards Rule required firms to notify their clients regardless of where the breach occurred — firms with no IR plan scrambled.

What would have changed it: Vendor risk monitoring and a pre-written FTC Safeguards incident response plan. Firms with documented IR plans activated in under 24 hours. Unprepared firms took 3–6 weeks. This is Fortress-tier readiness.

Pricing for Texas CPA Firms & Accounting Practices

WISP-compliant SOC.
Month-to-month. No enterprise contract.

CoreRecon's pricing for accounting firms covers the people and infrastructure that touch client financial data — partner workstations, staff endpoints, servers, and file storage systems. Month-to-month. No minimums. WISP documentation and FTC Safeguards compliance package included.

Tier	Price / Endpoint / Month	What's Included	Best For
Sentinel	$89	24/7 SOC monitoring, endpoint detection & response, IRS WISP authoring & maintenance, annual risk assessment, employee phishing simulation, email threat detection, attack surface management, monthly executive reports, IR Letter for cyber insurance	Solo practitioners and small CPA firms (<10 staff); IRS WISP compliance; cyber insurance requirements; basic FTC Safeguards baseline
Fortress	$109	All Sentinel + full FTC Safeguards Rule program (QI documentation, written risk assessment, MFA enforcement, encryption posture, incident response plan, board reporting template), anomalous login detection, SIEM, vendor risk monitoring, TSBPA breach notification workflow	Mid-size CPA firms (10–50 staff); full FTC Safeguards Rule compliance; enterprise client requirements; firms handling M&A or trust account transactions
Command	$129	All Fortress + AICPA SOC 2 readiness program (Trust Services Criteria mapping, continuous monitoring evidence collection, access control documentation, audit-ready evidence packages, SOC 2 auditor liaison support), annual tabletop exercises, pen testing	Regional and national firms needing SOC 2 for institutional clients; audit & advisory practices with Fortune 500 clients; firms handling PE/M&A transactions requiring vendor security certification

* Accounting firm pricing covers partner and staff endpoints, servers, and file storage systems with client financial data. The free assessment maps your exact endpoint footprint and identifies which tier addresses your specific WISP and Safeguards obligations.

Frequently Asked Questions

What CPA firm partners
and managing principals ask us.

IRS Publication 5708 requires every tax preparer with a PTIN — including sole practitioners, CPA firms, enrolled agents, and bookkeepers — to create and maintain a Written Information Security Plan. The WISP must document how your firm protects client data, designate a security coordinator, require an annual risk assessment, mandate employee training, and outline an incident response procedure. The IRS can assess penalties and revoke PTINs for non-compliance. Most Texas CPA firms either have no WISP or have a generic template that was never tailored to the firm — that won't survive an IRS examination or an FTC Safeguards audit.
The FTC Safeguards Rule (16 CFR Part 314), expanded June 2023, classifies tax preparers as "financial institutions" because they receive consumer financial information. Requirements include: (1) designating a Qualified Individual (QI) responsible for the information security program, (2) conducting and documenting a written risk assessment, (3) implementing MFA for all systems with customer financial data, (4) encrypting client data at rest and in transit, (5) maintaining a written incident response plan, and (6) providing annual board-level or principal-level security reporting. Non-compliance exposes your firm to FTC enforcement actions with civil penalties up to $50,120 per violation. The Compliance Deadline Tracker has the full FTC Safeguards card.
Not every CPA firm needs SOC 2, but enterprise and institutional clients are increasingly requiring it. If your firm serves publicly traded companies, PE-backed businesses, financial institutions, or healthcare organizations, expect to see SOC 2 Type II in vendor qualification questionnaires. SOC 2 readiness typically takes 12–18 months — the operational security program has to be in place and demonstrably running before the audit period begins. CoreRecon's Command tier builds the operational infrastructure (monitoring, access controls, change management, vendor oversight) that a SOC 2 auditor will examine, and provides audit-ready evidence packages. We work with licensed CPAs who conduct the actual audit.
Accounting firms combine four attacker incentives: (1) extremely high-value data — SSNs, W-2s, bank account numbers, business financial statements for hundreds of clients, (2) deadline pressure that makes firms more likely to pay quickly, (3) limited IT and security staff, and (4) minimal 24/7 monitoring. Ransomware groups including LockBit, BlackCat/ALPHV, Play, and Daixin Team all publicly listed confirmed accounting sector victims in 2024–2025. They actively time attacks to coincide with March 15 corporate filing and April 15 individual filing deadlines. The average dwell time before ransomware detonation in accounting firms was 11 days in 2024 — enough time for full data exfiltration before encryption.
Texas State Board of Public Accountancy Rule 501.74 requires CPAs to implement reasonable measures to safeguard client information and notify clients promptly following a breach. A breach involving client tax data also triggers Texas Business & Commerce Code §521.053 breach notification requirements — affected individuals must be notified within 60 days of discovery. License implications are possible for firms that demonstrate gross negligence in data protection; the TSBPA has discretion to investigate and impose disciplinary action including suspension. CoreRecon provides a pre-written breach notification workflow and TSBPA-ready incident documentation as part of the Fortress tier.

Texas CPA firms are now financial institutions under FTC. Treat your firm like one.

Attackers schedule hits
around your filing deadlines.

Four mandates.
One team to manage them all.

What actually happened.
What would have stopped it.

Does Your Firm Have a WISP That Would Survive an IRS Audit?

WISP-compliant SOC.
Month-to-month. No enterprise contract.

What CPA firm partners
and managing principals ask us.

Find out whether your firm's WISP would survive an IRS examination — before the IRS does.

Texas CPA firms are now financial institutions under FTC. Treat your firm like one.

Attackers schedule hitsaround your filing deadlines.

Four mandates.One team to manage them all.

What actually happened.What would have stopped it.

Does Your Firm Have a WISP That Would Survive an IRS Audit?

WISP-compliant SOC.Month-to-month. No enterprise contract.

Texas clients. Real outcomes.Sectors that handle sensitive data.

What CPA firm partnersand managing principals ask us.

Find out whether your firm's WISP would survive an IRS examination — before the IRS does.

Attackers schedule hits
around your filing deadlines.

Four mandates.
One team to manage them all.

What actually happened.
What would have stopped it.

WISP-compliant SOC.
Month-to-month. No enterprise contract.

Texas clients. Real outcomes.
Sectors that handle sensitive data.

What CPA firm partners
and managing principals ask us.