Accounting If you prepare taxes, the IRS requires a written information security plan (WISP), and any vendor that handles client data on your behalf becomes part of that plan. Work through this before you buy, and confirm specifics against current IRS (Pub 4557) and AICPA guidance.
Client Data Security & Vendor Evaluation Checklist
- Does the vendor encrypt client data in transit and at rest?
- Will it sign a confidentiality / data-processing agreement covering client financial data and PII?
- Does it limit access to the minimum necessary, with audit logs of who accessed what?
- Can it provide a recent independent security report (e.g. SOC 2 Type II)?
- Where is data hosted, and are subcontractors bound by the same obligations?
- Does it support multi-factor authentication and role-based permissions for your staff?
- How are breaches detected, and what is the notification process and timeline?
- How is your data returned or destroyed when you end the relationship?
- Does it integrate securely with your GL / practice-management system (e.g. QuickBooks, Xero)?
- Have you documented this vendor in your firm's WISP and confirmed requirements against current IRS Pub 4557 guidance?
From Accounting Ops Guide · accountingopsguide.com