The number of cyber incidents affecting accounting firms has increased almost 10x over the past decade.
Data breaches can happen to anyone at any time in numerous ways: a lost or stolen device, hacking, fraud, improper disposal of data, or errant email messages.
Small firms make up 57% of cyberattack cases, while large firms make up 21% of cases*.
The median loss in these attacks is approximately $800K*.
*Independently conducted by Ponemon Institute LLC Publication, October 2015.
Should you experience a data compromise—whether by cybercriminals, theft, or accident—there are certain basic steps you should take. For a comprehensive list of security actions, consult security experts at Cybersafe Solutions to determine the cause and scope of the breach, to stop the breach, and to prevent further breaches from occurring.
Government Regulations
Filings, client portals, and cloud-computing systems are the standard for the accounting industry. These records maintained by firms, filled with clients' private information, must be secured out of moral obligation and legal responsibility. Federal, state, and local governments place regulations to protect taxpayer data. They also require financial institutions—including CPAs, professional tax preparers, data processors, affiliates, and service providers—to ensure the security and confidentiality of customer records.
In addition, regulations also protect against unauthorized access and use of such records or information that could result in substantial harm to any customer. Financial institutions are also required to develop, implement, and maintain an information security program. The plan should be written in one or more accessible parts and contain administrative, technical, and physical safeguards that are appropriate to the business’ size and complexity, nature and scope of activities, and sensitivity of customer information handled.
The IRS recommends tax professionals use Publication 4557, Safeguarding Taxpayer Data, as a guide to create or update your cybersecurity plan.
It's critical to assess your current cybersecurity information protection plan in order to address any weaknesses.
A firm may be subject to penalties for violations of federal statutes and regulations for unauthorized disclosures or uses of taxpayer information by any person engaged in the business of preparing or providing services in connection with the preparation of tax returns.
A client or third party can also bring both direct claims and cross-claims for indemnification against the firm for damages incurred as a result of a breach.
