Microsoft 365 Security for Accounting and Tax Firms

Accounting and tax firms are covered by the FTC Safeguards Rule, which requires a written information security program with specific safeguards, including multi-factor authentication and encryption of customer information. The IRS reinforces this and publishes a sample written plan. For most firms, Microsoft 365 is where client data lives, so it is also where many of these safeguards are put in place. This guide explains the requirements in plain English and maps them to practical Microsoft 365 controls.

This is general information, not legal advice. Confirm how the rules apply to your firm with your attorney or a qualified compliance advisor.

Why the Safeguards Rule applies to tax preparers

The Safeguards Rule (16 CFR Part 314) implements the Gramm-Leach-Bliley Act for non-bank financial institutions. Its definition of financial institution expressly includes an accountant or other tax preparation service in the business of completing income tax returns. The IRS says the same in Publication 4557, Safeguarding Taxpayer Data, and notes that failing to create and carry out a written plan can lead to an FTC investigation.

What the rule requires, in plain English

Smaller firms get some relief. Under section 314.6, a firm that maintains customer information on fewer than 5,000 consumers is exempt from the written risk assessment requirement, the continuous monitoring or testing requirement, the written incident response plan and the annual written report. The other safeguards, including MFA and encryption, still apply, and having an incident plan is still sensible.

The FTC notification requirement

Since May 13, 2024, a covered firm must notify the FTC of a notification event involving at least 500 consumers as soon as possible and no later than 30 days after discovery, using the FTC's online form. A notification event is the unauthorized acquisition of unencrypted customer information. Data counts as unencrypted if the encryption key was also compromised, which is one practical reason encryption matters. State breach laws, such as Texas Business and Commerce Code Chapter 521, can impose separate notice duties.

Mapping the requirements to Microsoft 365

Features vary by plan, and Microsoft changes them over time, so check Microsoft's current documentation. As of this writing:

Tax-season considerations

A scenario

Take a hypothetical eight-person tax practice serving about 2,000 individual clients. Because it holds information on fewer than 5,000 consumers, some written-document requirements are exempt, but it still needs a written program, a Qualified Individual, MFA, encryption, training and vendor oversight. A practical plan: name the managing partner as Qualified Individual, adapt the IRS Publication 5708 template, enforce MFA on every account, replace email attachments with expiring SharePoint links or the tax software's portal, encrypt every laptop, add a separate Microsoft 365 backup, and sign agreements with IT and software vendors that address security.

Common mistakes

How NexJen can help

NexJen Essentials includes multi-factor sign-in on every account, endpoint protection with managed detection and response (MDR), Microsoft 365 backup by a separate service, 24/7 automated monitoring and patching, and staff onboarding and offboarding. Our fixed-fee Security Posture and Compliance Assessment benchmarks your Microsoft 365 tenant against the CIS Benchmark and Microsoft Secure Score and gives you risk-rated written findings you can use in your written plan. It is not a certification and not a Safeguards Rule audit; your firm and its advisors remain responsible for compliance.

Common questions