Cybersecurity for accountants: what to fix on workstations before tax season 2027

Why harden workstations before filing season instead of during it?

Hardening workstations before filing season is safer because, once returns start moving, every hour a machine is down is billable time lost and every change risks breaking tax software at a deadline. Good cybersecurity for accountants depends on that timing. The IRS has not yet announced the opening date for the 2027 filing season. The 2026 season opened on January 26, 2026, so firms should plan for late January and treat November and December as the window for anything that requires a reboot, a reinstall, or a new login habit.

The stakes are regulatory as well as operational. A tax preparation business is a financial institution under the FTC Safeguards Rule: 16 CFR 314.2(h)(2)(viii) names "An accountant or other tax preparation service that is in the business of completing income tax returns." The IRS repeated the point in its October 2, 2026 reminder: "Federal law requires tax and accounting professionals to create and maintain a WISP to protect client information." The workstations your staff use every day are where most of that plan either holds or fails.

Which workstations need attention first?

The workstations that need attention first are any running software that no longer gets free security updates. Three Microsoft dates matter this season, and two of them landed on October 13, 2026.

• Windows 10. Microsoft ended support on October 14, 2025. Firms that bought Extended Security Updates reached the end of ESU Year 1 on October 13, 2026. Microsoft's ESU terms set the price at $61 per device for Year One and state that "The price doubles every consecutive year," so continuing costs more each year than the last.
• Windows 11 24H2 Home and Pro. Servicing for these editions ended on October 13, 2026. Pro machines need to move to version 25H2 to keep receiving security updates.
• Office 2021. Microsoft states that "Support for Office 2021 will end October 13, 2026" and that it "will no longer provide technical support, bug fixes, or security fixes."

If your tax software still runs on an on-premises server, note one more date: Windows Server 2016 extended support ends January 12, 2027, in the first weeks of filing season. Plan that move now rather than in the middle of February.

What does the IRS expect on each workstation?

The IRS's baseline is its "Security Six," published in the Taxes-Security-Together Checklist: activate anti-virus software, use a firewall, use two-factor authentication when it is offered, use backup software or services, use drive encryption, and create and secure virtual private networks.

IRS Publication 4557, Safeguarding Taxpayer Data, adds specifics. It tells preparers to "Install anti-malware/anti-virus security software on all devices" and "Set security software to update automatically." It recommends "drive encryption to lock files and all devices" and multi-factor authentication "for anyone accessing customer information on your system." It also sets a password floor: "Use a minimum of eight characters; consider minimum of 16 characters for an administrator's password."

The sample plan in IRS Publication 5708 shows how those recommendations read inside a WISP. Its model language says "Workstations will also have a software-based firewall enabled" and "Operating System (OS) patches and security updates will be reviewed and installed continuously." If your WISP borrowed that language, your workstations have to match it.

What does the FTC Safeguards Rule add?

The FTC Safeguards Rule adds three requirements that reach every workstation: encryption, multifactor authentication and activity logging. 16 CFR 314.4 is the binding text behind the IRS guidance. For larger firms, the results also belong in the Qualified Individual's annual report to the partners, covered in our guide to the Safeguards Rule board report.

• Section 314.4(c)(3) requires you to "Protect by encryption all customer information held or transmitted by you both in transit over external networks and at rest." Client returns saved to a laptop's local drive are at rest.
• Section 314.4(c)(5) requires multi-factor authentication "for any individual accessing any information system," unless your Qualified Individual has approved an equivalent or stronger control in writing.
• Section 314.4(c)(8) requires controls "designed to monitor and log the activity of authorized users and detect unauthorized access or use of, or tampering with, customer information by such users."

Section 314.4(d)(2) also requires, absent effective continuous monitoring, vulnerability assessments "at least every six months" and annual penetration testing. A pre-season scan lines up well with that cycle. Firms that hold customer information on fewer than 5,000 consumers are exempt from the testing schedule under 16 CFR 314.6, but not from encryption, MFA, or logging.

Which hardening steps matter most for a tax practice?

The hardening steps that matter most for a tax practice are the ones that map to both the IRS guidance and CIS Controls Implementation Group 1, the baseline set of safeguards CIS defines for smaller organizations. Five carry most of the weight.

• Encrypt every laptop and desktop (CIS Safeguard 3.6). BitLocker on Windows and FileVault on Mac are built in. Confirm recovery keys are stored somewhere other than the device.
• Patch operating systems and applications automatically (Safeguards 7.3 and 7.4), on a monthly or more frequent basis. Include browsers, PDF readers, and the tax software itself.
• Run managed anti-malware with automatic signature updates (Safeguards 10.1 and 10.2), and confirm someone reviews the alerts.
• Turn on the host firewall (Safeguard 4.5) and keep a documented secure configuration (Safeguard 4.1) so a rebuilt machine comes back the same way.
• Remove local administrator rights from daily accounts. Preparers rarely need them, and malware that lands under a standard account does less damage.

How do you handle seasonal staff and remote preparers?

Give them named accounts, MFA, and managed devices before their first return, and remove access the day the season ends. The IRS Security Summit's September 4, 2026 release told preparers to "Use individual accounts and never share usernames or passwords" and to "Enable MFA in tax software, cloud storage, email, and other services containing sensitive client information."

Personal laptops are the hardest case. If a seasonal preparer works from a home machine, you cannot verify encryption, patching, or anti-malware on it, and your WISP probably assumes all three. A firm-issued laptop, or a hosted desktop that keeps client data off the personal device, closes that gap.

What cybersecurity steps should accountants finish before January?

Accountants should finish seven steps before January, in this order, so every machine is stable before the first e-file.

• Inventory every device that touches client data, including partner laptops and the front desk scanner workstation.
• Retire or upgrade anything on Windows 10 without ESU, Windows 11 24H2 Pro, or Office 2021.
• Confirm drive encryption and store recovery keys centrally.
• Verify MFA on email, tax software, the client portal, and remote access.
• Run a vulnerability scan and fix the critical findings.
• Update your WISP so it describes the controls you actually run, then have staff acknowledge it.
• Test a restore from backup of at least one client folder.

Current PTINs expire on December 31, and the IRS typically opens renewal in the fall. Last year's renewal notice set the fee at $18.75. Tie renewal to this checklist so every preparer is both credentialed and on a hardened machine when the season opens. If you are unsure how to answer the renewal's data security question, see our PTIN renewal guide.

How does s90 help CPA firms get ready?

s90 manages IT for accounting and tax firms in Los Angeles and Orange County. We handle the upgrades, encryption, patching, and MFA described here, keep the evidence your WISP points to, and schedule the work around your calendar so nothing changes during busy season. If you want a pre-season review of your workstations, we are happy to start with an inventory.