Key takeaways
- National Tax Security Awareness Week is an annual IRS and Security Summit campaign held in early December; the 10th annual week took place in the first week of December 2025.
- Tax preparers are financial institutions under the FTC Safeguards Rule and must keep a written information security program.
- The IRS stated in September 2026 that its MFA requirement applies to tax preparation firms regardless of size.
- After a data theft, the IRS says to contact your local IRS Stakeholder Liaison right away, because speed is critical to blocking fraudulent returns.
- Anyone with an SSN or ITIN can get an Identity Protection PIN, according to the IRS.
What is National Tax Security Awareness Week?
National Tax Security Awareness Week is an annual IRS and Security Summit campaign, held in early December, that warns taxpayers, businesses and tax professionals about identity theft and scams heading into the holidays and filing season. The 10th annual week took place in the first week of December 2025 (IR-2025-118, issued December 3). As of mid-October, the IRS has not announced dates for 2026.
The 2025 campaign covered five focus areas: social media scams, phishing and smishing, protections for seniors, protections for businesses and tax professionals, and the Identity Protection PIN. For preparers the message was direct: the IRS "reminds tax professionals of their legal obligation to have a Written Information Security Plan" and urged them to use multi-factor authentication. The week lands about two months before filing season, which makes it a useful internal deadline for the five cyber security actions below.
Why does the IRS call the WISP a legal obligation?
The IRS calls the WISP a legal obligation because federal law requires one. Tax return preparers are financial institutions under the FTC Safeguards Rule, 16 CFR 314.2(h)(2)(viii), and the rule requires a written information security program. The IRS and Security Summit repeated the point in IR-2026-92 in August 2026.
The IRS supplies a template in Publication 5708, but the plan and the controls it describes belong to the firm. A missing or outdated plan is a compliance gap before any breach happens, and it is the first document anyone asks for after one.
Action 1: Does your WISP match how the office works today?
Reread the plan and compare it to the firm as it runs now. 16 CFR 314.4(g) requires the program to be evaluated and adjusted after material changes to operations or business arrangements, and Publication 5708 says to review the plan at least annually.
New staff, a new client portal, a different tax software vendor, a move to cloud storage or a remote preparer all count as changes. Update the risk assessment, the list of systems that hold client data, the service provider list and the name of the Qualified Individual. Our guide to updating your WISP before the 2027 filing season walks through the review in detail.
Action 2: Is MFA on everywhere client data can be reached?
Yes. MFA should be on for every system that holds or reaches client data, and the IRS has narrowed the room for exceptions. 16 CFR 314.4(c)(5) requires multi-factor authentication for any individual accessing any information system, unless the Qualified Individual approves a reasonably equivalent or more secure control in writing. In IR-2026-106, the IRS said the requirement applies to tax preparation firms regardless of size and advised individual logins with no shared usernames or passwords.
Check tax software, the client portal, email, remote access, cloud storage, payroll and banking portals, and IRS e-Services accounts. Shared front-desk logins are a common gap in small offices. Each person needs an individual account with its own second factor.
Action 3: Would your staff recognize the "new client" scam?
The only way to know is to test them, ideally before filing season, when the lure works best. The IRS has warned about a phishing email in which a supposed new client asks for help with their taxes and attaches or links to what they claim is their tax information. Opening it can give the scammer the preparer's email address and password or install malware that reaches client data, and the attacker may then use the compromised account to target clients.
Training is also a rule requirement: 16 CFR 314.4(e) requires security awareness training updated to reflect risks identified in the risk assessment. A short session with real examples of this lure, plus a rule that unexpected attachments from unknown senders are verified by phone before anyone opens them, covers a threat the IRS has warned preparers about directly. The IRS asks that suspicious IRS-themed emails be sent to phishing@irs.gov.
Action 4: Does your plan name who to call after a data theft?
Your plan should name every contact, with phone numbers, because the IRS says speed is critical. The IRS data theft guidance for tax professionals lists the contacts:
- Your local IRS Stakeholder Liaison, so the IRS can take steps to block fraudulent returns.
- The tax agencies in each state where you prepare returns, through the Federation of Tax Administrators.
- State attorneys general, as state breach laws require.
- The FBI, the Secret Service if directed, and local police.
If the event involves the information of 500 or more consumers, 16 CFR 314.4(j) also requires notice to the FTC no later than 30 days after discovery. 16 CFR 314.4(h) requires a written incident response plan. Put the contact list inside it, confirm who your Stakeholder Liaison is, and make sure at least two people know where the plan lives.
Action 5: Are you telling clients about the IP PIN?
If not, start now; the week gives you a natural reason to. An Identity Protection PIN is a six-digit number that prevents someone else from filing a tax return with a taxpayer's Social Security number or ITIN. According to IR-2025-118, anyone with an SSN or ITIN can get one as a proactive step, including people living abroad.
A short note in your December client letter or a portal banner explaining how to request an IP PIN takes little effort. It also gives clients a concrete action at the moment many of them are reading about scams in the news.
What cyber security steps should tax professionals take this quarter?
- Late November: review and update the WISP, and confirm the Qualified Individual named in it.
- Awareness week: run the phishing session with staff and turn on MFA for any account still without it.
- By mid-December: finish the incident contact list, confirm your Stakeholder Liaison and test a backup restore.
- December client communication: explain the IP PIN and how to request one.
- Before filing season opens: record the review date and the changes made, so the WISP shows it was updated.
How can s90 help?
s90 helps CPA firms and tax practices keep a WISP that matches how the office runs, with MFA, phishing training and incident response built in and documented. If you want the plan reviewed before filing season, we can start with a short gap review.
