Key takeaways
- 16 CFR 314.4(c)(5) requires MFA for any individual accessing any information system at a tax preparation firm.
- The only exception is reasonably equivalent or more secure controls approved in writing by the Qualified Individual.
- The IRS says the MFA requirement applies to tax preparation firms regardless of size and advises against shared logins.
- NIST SP 800-63B-4 does not treat one-time passcodes or out-of-band methods as phishing-resistant.
- Seasonal staff accounts should have MFA registered on day one and an end date set when created.
Most CPA firms turned on multifactor authentication for email years ago. The gaps that remain sit in tax software, client portals, remote access and the seasonal accounts created in a hurry each January. Closing them is the core of MFA for tax preparers under the FTC Safeguards Rule, and the fall is the time to do it.
Is MFA required for tax preparers?
Yes. The FTC Safeguards Rule treats tax preparation firms as financial institutions, and 16 CFR 314.4(c)(5) requires multifactor authentication for any individual accessing any information system, unless the firm's Qualified Individual approves reasonably equivalent or more secure access controls in writing. Busy season brings new accounts, rushed approvals and a wave of phishing aimed at tax professionals, so any gap left open in the fall gets tested in the spring. MFA is one item on the broader FTC Safeguards Rule checklist for tax preparers.
The IRS has been direct about scope. In IR-2026-106, it told tax professionals to use MFA across all services and data access points, stated that the requirement applies to tax preparation firms regardless of size, and advised individual logins with no shared usernames or passwords. The IRS sample plan in Publication 5708 and the safeguards guide in Publication 4557 both include MFA among the controls a written information security plan should describe, and PTIN applicants confirm on Form W-12 that they know a written plan is required.
Where do MFA gaps usually hide in a CPA firm?
In the systems nobody thinks of as a login. Microsoft 365 or Google Workspace usually has MFA turned on for most users. The gaps tend to sit around it.
- Tax software and its cloud portals, especially where a shared office login is still in use.
- Client portals and file-sharing tools, for both staff and administrator accounts.
- Remote access: VPN, remote desktop and remote support tools.
- Older email sign-in methods, such as IMAP, POP and basic SMTP authentication, that skip the MFA prompt.
- Administrator and service accounts excluded from policies "for now."
- Payroll, banking and practice management systems with their own separate passwords.
- Seasonal staff and contractors added in a hurry.
How do you find the gaps?
Start from an inventory of systems that store or reach client data, then check each one for three things: whether MFA is required, whether it applies to every account, and which method it uses. CIS Safeguard 5.1 calls for an account inventory validated at least quarterly, and Safeguards 6.3 and 6.4 call for MFA on externally exposed applications and on remote network access.
In Microsoft 365, the identity secure score flags missing MFA on administrative roles and legacy authentication that has not been blocked. Sign-in logs show which accounts are still signing in with a password alone. For each third-party system, open the admin settings and check directly, because many tax and portal vendors leave MFA optional for each user.
Which MFA method should the firm require?
The strongest method each system supports, with phishing-resistant methods for administrators. NIST SP 800-63B-4 does not treat passwords, one-time passcodes or out-of-band methods as phishing-resistant. FIDO2 security keys, passkeys and Windows Hello for Business hold up against fake login pages because they are bound to the real site.
A practical split for most firms: phishing-resistant methods for administrators and partners, an authenticator app for everyone else, and text messages only where a system offers nothing better. Write the split into the WISP so the policy on paper matches the settings in the tools.
What about systems that cannot do MFA?
Document the exception and put a compensating control around the system. The Safeguards Rule lets the Qualified Individual approve, in writing, reasonably equivalent or more secure access controls. Common options are placing the system behind a remote access gateway that does require MFA, restricting it to firm devices on the office network, or replacing it. Record the decision, the control and a date to revisit it, and keep the approval with the WISP. The same approach works for documenting compensating controls for encryption exceptions.
How should seasonal staff get MFA?
Set it up during onboarding, before the person touches client data. Give each person an individual account, register their MFA method on day one, and set an end date on the account when it is created. Conditional Access in Microsoft Entra can require MFA and a compliant device at sign-in. Microsoft recommends running new policies in report-only mode for at least a week before enforcing them, so start that test now rather than in January.
Remove access the day the engagement ends. A dormant account with a registered MFA method is still a way into client data.
What happens if an account without MFA is compromised?
The firm may face notice duties on a short clock. Under 16 CFR 314.4(j), a notification event involving the unencrypted information of at least 500 consumers must be reported to the FTC within 30 days of discovery, and state breach laws can apply on top of that. A gap closed in November is far easier to handle than one found in the middle of filing season.
What should the firm do this quarter?
Work through this list before the filing season opens.
- Build or update the inventory of systems that hold client data, with an owner for each.
- Turn on MFA for every account in each system, and retire shared logins.
- Block legacy email authentication in Microsoft 365 or Google Workspace.
- Move administrators and partners to phishing-resistant methods.
- Write up any exceptions with the Qualified Individual's approval and the compensating control.
- Pre-build seasonal staff accounts with MFA registration steps and end dates.
- Update the WISP so it describes the MFA policy as it actually runs.
How does s90 help CPA firms close MFA gaps?
s90's Identity Posture service inventories accounts across Microsoft 365 and connected systems, flags users and administrators without MFA, and tracks approved exceptions so the Qualified Individual has a current record. We help firms roll out phishing-resistant methods and seasonal staff accounts before busy season starts. If you would like a quick review of where your MFA gaps are, we are happy to walk through it with you.
