Tax season puts enough pressure on accounting firms. Unresolved cybersecurity risks shouldn't add to it.

As CPA firms begin preparing for the 2027 filing season, much of the focus naturally falls on staffing, client communication, workflow efficiency, and tax preparation software.

But there's another area that deserves attention before workloads increase: the cybersecurity practices protecting client information and supporting daily operations.

Accounting firms routinely handle sensitive financial records, tax documents, Social Security numbers, payroll information, and other confidential client data. Protecting that information requires more than installing security software or maintaining a written policy.

It requires understanding whether existing safeguards are appropriate, properly implemented, and keeping pace with changes in the firm's technology environment.

The IRS is reinforcing that message ahead of the upcoming filing season.

In October 2026, the agency announced Tax Professional Awareness Week, offering resources to help tax professionals prepare for filing season and protect taxpayer information.

The IRS and its Security Summit partners have also continued emphasizing the importance of maintaining a Written Information Security Plan (WISP).

For CPA firms, this creates a practical opportunity to evaluate cybersecurity risks before the busiest months of the year.

Here are seven areas worth reviewing now.

1. Your Written Information Security Plan: Does It Reflect How Your Firm Operates Today?

A Written Information Security Plan is not simply a document to create and file away.

It should reflect the firm's current systems, processes, information-security risks, and safeguards.

In an August 2026 reminder, the IRS and Security Summit partners reinforced that federal law requires tax and accounting professionals to create and maintain a WISP to protect client information.

The IRS explains that a security plan should be tailored to the size, complexity, and nature of the practice.

It should also be reviewed and updated as business operations and associated risks change.

Consider how much your firm may have changed since its last review.

Have you introduced new cloud applications? Added employees? Changed document-sharing processes? Expanded remote work? Adopted AI tools to assist with administrative or client-related tasks?

Any of these changes could affect how your organization handles sensitive information.

What to review before tax season:

  • When was your WISP last reviewed or updated?
  • Does it accurately describe the technology your firm uses?
  • Are information-security responsibilities clearly assigned?
  • Have new risks or changes in operations been evaluated?
  • Are the safeguards described in the plan actually implemented?

A current WISP provides an important foundation for a firm's information-security program.

But the real objective is ensuring the firm's practices reflect what the plan says.

For additional guidance, the IRS provides resources for creating and maintaining a Written Information Security Plan.

2. Employee Access and Multifactor Authentication: Who Can Access Client Information?

During tax season, accounting firms may add temporary employees, increase workloads, or adjust responsibilities to handle client demand.

Those changes make employee access management especially important.

A staff member may need access to certain tax documents, client folders, or financial applications to perform assigned duties.

That doesn't necessarily mean they should have access to every client record or administrative function.

Access should be appropriate to the employee's responsibilities and reviewed when those responsibilities change.

Multifactor authentication (MFA) adds another important layer of protection by requiring additional verification beyond a password.

The IRS includes two-factor authentication among the recommended protections in its Taxes-Security-Together Checklist.

What to review before tax season:

  • Is MFA enabled for systems that support it, particularly email, cloud services, and tax applications?
  • Do employees have access only to the information and systems necessary for their roles?
  • Are shared accounts or unnecessary administrative permissions creating additional exposure?
  • Is access removed promptly when employees leave or change roles?
  • Are temporary and seasonal employee accounts managed appropriately?

Reviewing access before the filing season can help firms address unnecessary permissions before more users and client records enter daily workflows.

3. Client Data Storage and Sharing: Do You Know Where Sensitive Information Lives?

CPA firms handle information across numerous systems.

Client documents may be stored in tax preparation software, cloud platforms, email systems, document-management applications, and backup environments.

When employees use multiple tools to exchange or process information, it can become difficult to maintain a clear picture of where sensitive data resides.

Understanding that environment is an important part of managing data-security risk.

For example, a firm might use an approved client portal for document exchange but still have employees sharing sensitive attachments through less controlled methods.

The availability of a secure system does not automatically mean everyone is using it consistently.

What to review before tax season:

  • Which systems contain sensitive client information?
  • Are employees using approved methods to exchange confidential documents?
  • Who has permission to access shared folders and document repositories?
  • Are unnecessary copies of client information being retained?
  • Are data-handling expectations communicated to employees?

These questions also apply when employees begin experimenting with AI-assisted workflows.

The October 2026 Journal of Accountancy article, New Checklist Helps CPAs Manage AI Cyber Risks, discusses the importance of authorized AI tools, data classification, and appropriate safeguards for sensitive information.

For firms using AI, data-handling reviews should consider whether employees understand what client information may or may not be entered into those applications.

The objective is to make sure confidential information remains appropriately protected as employees work across different technologies.

4. Third-Party Vendors: Are Your Technology Providers Introducing Risks You Haven't Reviewed?

Accounting firms depend on outside providers for many important services.

Tax preparation platforms, payroll applications, document-management systems, cloud providers, and outsourced IT partners may all play a role in handling or protecting sensitive client data.

Each relationship introduces different responsibilities and potential risks.

For example, a provider that stores confidential tax records may warrant different security considerations from a vendor supporting a less sensitive administrative function.

Similarly, an outsourced technology partner with administrative access to firm systems introduces a different type of exposure from a provider with limited access.

The IRS includes service-provider safeguards among the considerations involved in maintaining an information-security program.

What to review before tax season:

  • Which technology vendors have access to sensitive client information?
  • Do vendors maintain appropriate safeguards for the services they provide?
  • Have important vendor relationships changed since their last review?
  • Are access permissions and responsibilities clearly defined?
  • Does the firm understand how critical vendor outages could affect operations?

Vendor reviews should be proportionate to the risks associated with each relationship.

The goal is not to create unnecessary administrative work.

It's to understand where the firm depends on outside organizations to protect information or maintain essential services.

5. Backup and Recovery: Could Your Firm Restore Important Systems During Tax Season?

Having backups is important.

Knowing whether your firm can restore the information and systems it needs is equally important.

During filing season, access to tax software, client records, working documents, and communication systems becomes especially important to maintaining operations.

An extended technology disruption could interfere with deadlines, client service, and employee productivity.

That makes backup and disaster recovery planning an operational concern, not simply an IT task.

The IRS's Taxes-Security-Together Checklist includes backup protections among its recommended safeguards.

What to review before tax season:

  • Are important systems and files included in the firm's backup arrangements?
  • Have backup restoration procedures been tested?
  • Does the firm know which systems need to be recovered first?
  • Are responsibilities defined if a major application or server becomes unavailable?
  • Have changes to cloud services or document storage affected backup coverage?

Backup testing can identify problems that might otherwise remain unnoticed until recovery is necessary.

For firms preparing for their busiest months, now is a practical time to confirm that recovery expectations align with actual capabilities.

6. Security Monitoring and System Maintenance: Are Known Issues Being Addressed?

Cybersecurity risk can develop when software becomes outdated, security settings change, or vulnerabilities remain unresolved.

CPA firms may use a combination of workstations, servers, network devices, cloud applications, and specialized tax software.

Keeping track of these systems requires consistent attention.

Not every issue creates the same level of risk.

A vulnerability affecting a critical, internet-facing system may deserve more immediate attention than a lower-impact issue affecting a less important application.

That is why security maintenance should involve both identifying weaknesses and prioritizing remediation.

What to review before tax season:

  • Are operating systems and applications receiving appropriate security updates?
  • Are unsupported or end-of-life systems still in use?
  • Have important security configurations been reviewed?
  • Are significant vulnerabilities being identified and prioritized?
  • Who is responsible for investigating and addressing security alerts?

The purpose is not to eliminate every possible technical issue before January.

It's to identify the weaknesses most likely to affect sensitive information or important operations and establish a plan for addressing them.

7. Incident Response: Does Your Team Know What to Do if Something Goes Wrong?

Even firms with established safeguards need to prepare for the possibility of a security incident.

An employee might receive a convincing phishing email.

An account might show signs of unauthorized access.

A laptop containing sensitive information could be lost or stolen.

An application provider might report a security incident affecting its customers.

In each situation, a timely and coordinated response matters.

The IRS encourages tax professionals to establish procedures for responding to data theft and understanding applicable reporting responsibilities.

Its Identity Theft Information for Tax Professionals resource explains steps tax professionals should consider when taxpayer information may have been compromised.

What to review before tax season:

  • Do employees know how to report suspicious activity?
  • Is someone responsible for coordinating incident response?
  • Are important internal and external contacts documented?
  • Does the firm understand applicable reporting obligations?
  • Has the incident response plan been reviewed or exercised?
  • Can the team access response instructions if its normal systems are unavailable?

An incident response plan should do more than describe what the firm intends to do.

It should provide clear responsibilities and practical procedures that can be followed under pressure.

Testing those procedures before a disruption can reveal gaps in communication, decision-making, and recovery planning.

Why October Is a Good Time to Review Cybersecurity

Cybersecurity planning becomes more difficult when employees are managing filing deadlines and high volumes of client work.

Reviewing current practices in the fall gives CPA firms an opportunity to identify important gaps, evaluate priorities, and plan improvements before workloads increase.

It also creates a natural time to connect cybersecurity planning with other operational preparations for the coming year.

For example, if a firm is planning to add staff, adopt new software, expand cloud storage, or adjust workflows, those decisions may affect existing security controls.

Reviewing cybersecurity alongside those changes can help leadership make more informed technology decisions.

The process does not have to begin with an expensive overhaul.

It can start with understanding the firm's current risks, evaluating existing safeguards, and identifying where improvements would provide the most value.

How Does a Cybersecurity Risk Assessment Fit Into Filing-Season Preparation?

A cybersecurity risk assessment helps an organization evaluate its existing security practices and identify areas where additional safeguards or improvements may be needed.

For CPA firms, that evaluation can connect technical findings with broader business and information-security responsibilities.

For example, a review might identify outdated permissions, gaps in backup coverage, unresolved vulnerabilities, or documentation that no longer reflects current operations.

Leadership can then evaluate which findings matter most and develop a practical remediation plan.

This risk-based approach is particularly useful for firms balancing cybersecurity needs with budgets, staffing, and filing-season demands.

An assessment does not replace a WISP or automatically establish compliance with all applicable requirements.

Instead, it can provide information to support the firm's broader cybersecurity program and help determine where attention is needed.

Preparing Your CPA Firm for a More Secure 2027 Filing Season

The IRS's renewed focus on taxpayer-data protection is an important reminder that cybersecurity requires ongoing attention.

A Written Information Security Plan provides a foundation, but firms also need to consider how its safeguards are implemented across employees, applications, vendors, and daily operations.

Reviewing access controls, data handling, backup procedures, system maintenance, and incident response before tax season can help identify weaknesses that might otherwise disrupt important work.

The goal isn't to create more complexity for an already busy accounting firm.

It's to understand where the greatest cybersecurity risks exist and address them before they become operational problems.

Is Your Firm's Cybersecurity Program Ready for the 2027 Filing Season?

AvTek Solutions helps CPA and professional services firms evaluate cybersecurity risk, develop practical security strategies, and strengthen the systems and processes supporting their operations.

Through our vCISO Services, cybersecurity risk management, and Managed IT Services, we help organizations identify security gaps, prioritize improvements, strengthen policies and documentation, and support backup, recovery, and incident response planning.

Whether your firm needs help evaluating its existing safeguards or developing a clearer cybersecurity risk-management plan, the first step is understanding where things stand today.

Talk with AvTek about reviewing your firm's cybersecurity risks before the 2027 tax season.