Tax and accounting firms must keep multifactor authentication on to protect client data

Tax and accounting firms are required by the FTC Safeguards Rule and the IRS to use multifactor authentication (MFA) on every system that holds client data, according to cpapracticeadvisor.com.

Despite the common temptation to disable MFA temporarily during busy tax seasons, doing so puts client data, firm reputation, and regulatory compliance at risk, the article explains.

The FTC treats tax and accounting firms as financial institutions and mandates MFA for any individual accessing information systems, unless a Qualified Individual approves an equivalent control in writing.

The IRS and its Security Summit partners emphasize that MFA is a federal requirement for tax professionals, applying to both remote and in-office staff.

The Cybersecurity and Infrastructure Security Agency (CISA) recommends using phishing-resistant MFA methods like passkeys and FIDO2 security keys as the gold standard, with number matching for push notifications as an interim measure.