Tax Season 2027 IT Readiness: A Checklist for DFW CPA Firms
Quick answer: Before tax season, a CPA firm should confirm four things: its written information security plan (WISP) is current, MFA is on for every tax and email account, backups have been test-restored, and seasonal staff have secure, limited access. Fix those in November and you go into January with fewer surprises.
What should a tax season IT checklist cover?
A tax season IT checklist for a CPA firm covers the safeguards the IRS and FTC expect, plus the systems you can’t afford to lose between January and April. In practice that means eight items: a current WISP, MFA on every account, tested backups, secure access for seasonal staff, phishing training, tax software readiness, an outage plan and a cleanup of last season’s accounts. The sections below walk through each one.
Why November is the right month
Once January hits, nobody at a CPA firm has time to change systems. Every hour goes to returns. That makes November and early December the last calm window to fix the IT gaps that cause tax-season outages, lockouts and breaches.
It is also when criminals start their own season. Fake IRS notices, spoofed client emails and “updated W-2” phishing peak from January through April. Getting your defenses in place now matters more than any single tool you buy.
1. Is your WISP current?
Paid tax preparers are covered by the FTC Safeguards Rule, and the IRS expects every preparer to have a written information security plan. You confirm that each year when you renew your PTIN. A WISP that was written once and never updated will not hold up after an incident.
Check that your plan:
- Names the person responsible for security at your firm
- Lists where client data lives — tax software, portal, file server, email, paper
- Describes your safeguards: MFA, encryption, backups, access rules
- Includes an incident response plan with phone numbers
- Was reviewed and dated within the last 12 months
Our glossary covers the written information security program (WISP) and the FTC Safeguards Rule in more detail.
What does the IRS require? WISP and Publication 4557
IRS Publication 4557, Safeguarding Taxpayer Data, is the IRS guide to the security practices it expects from tax professionals, and the WISP is where you write those practices down. The IRS also publishes a short list it calls the “Security Six”:
- Antivirus software on every device
- A firewall
- Multi-factor authentication
- Backups
- Drive encryption
- A VPN for remote connections
If your WISP describes all six and your firm can show they’re in place, you’re covering the baseline the IRS checks for. For how these rules apply to AI tools, see Can DFW accounting firms use AI? IRS 4557 and the FTC Safeguards Rule.
To write or update the plan itself, IRS Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice, includes a sample WISP template you can adapt to your firm.
2. MFA on every tax app, portal and mailbox
Stolen passwords are still the most common way into a firm. Turn on multi-factor authentication for:
- Your tax software and e-file accounts
- Your client portal
- Microsoft 365 or Google Workspace email
- Remote access tools and VPN
No exceptions for partners. The accounts with the most access are the ones attackers want most.
3. Test-restore your backups
A backup you have never restored is a guess. Pick one client folder and one tax software database, restore them to a test location, and time how long it takes. If the answer is “we are not sure” or “more than a day,” fix it now. During tax season, a day of downtime means missed deadlines.
4. Secure access for seasonal and remote staff
Most CPA firms add seasonal preparers or let staff work from home through April. Before they start:
- Give each person their own login, with no shared accounts
- Grant access only to the clients and folders they need
- Require MFA and a firm-managed or secured device
- Set an end date to remove access on April 16
5. Get ready for phishing season
Run a short refresher before January: how to spot a fake IRS notice, why you never change bank details from an email, and who to call when something looks wrong. Add a rule that any request to change a client’s refund or payment information gets a phone call to a number you already have.
6. Is your tax software ready for 2027?
Install and test this season’s version of your tax software before the first return comes in, not on the day you need it. Check that every workstation meets the vendor’s requirements, that hosted or cloud tax software requires MFA, and that e-file access works for everyone who needs it. Find out now if any machine still runs Windows 10: tax software vendors drop support for old systems, usually with little warning.
7. Have a plan for an outage during filing week
Decide in advance what happens if the internet, a server or a laptop fails in March:
- A backup internet connection, or at least a hotspot that is tested and charged
- A spare laptop that is already set up and ready to hand out
- A written list of who to call, kept somewhere other than the system that’s down
- A known restore time for your tax software and client files
8. Clean up last season’s accounts
Before adding this year’s seasonal staff, remove anyone left over from last year. Check tax software users, Microsoft 365 accounts, portal logins and remote access. Accounts nobody uses are a common way in for attackers, and they’re easy to miss during the rush.
Your tax season IT timeline
| When | What to do |
|---|---|
| Early November | Review and date your WISP; list where client data lives |
| Mid November | Turn on MFA everywhere; test-restore a client folder and the tax database |
| Early December | Remove last season’s accounts; install and test this year’s tax software |
| Mid December | Set up seasonal staff accounts and devices; run the phishing refresher |
| January | Confirm monitoring and backups daily; freeze non-urgent changes |
| April 16 | Remove seasonal access and review what to fix before next year |
Want a second set of eyes? We review your WISP, MFA and backups and give you a short list of fixes before January. Book a pre-season IT review.
IT support for CPA firms in Frisco, Plano and Irving
We support accounting and tax firms across Collin and Dallas counties from our Frisco headquarters, with offices in Plano and Irving’s Las Colinas. One North Texas CPA firm we support has three offices and 52 staff. When we started, MFA wasn’t enforced and backup jobs had been failing for years. We moved backups to Azure Backup with daily restore points, enforced MFA firm-wide and added 24/7 threat monitoring. In five years we haven’t disrupted a single tax season. Read the CPA firm case study.
Learn more about our managed IT for accounting firms and cybersecurity services in Plano.
Frequently asked questions
Do small tax practices need a WISP?
Yes. The requirement applies to paid tax preparers of every size, including solo practitioners.
What should a WISP include?
Who is responsible for security, where client data is stored, the safeguards you use, how you train staff, and how you respond to an incident.
How often should a CPA firm test backups?
At least quarterly, and always before tax season. A backup that has never been restored is a guess, not a safeguard.
Can our IT provider write our WISP?
Your IT provider can document the technical safeguards, but the firm owns the plan and must review it.
When should a CPA firm do its tax-season IT work?
November and early December. Once January arrives every hour goes to returns, and there is no calm window left to change systems.
Who provides IT support for CPA firms in Plano?
DKBinnovative supports accounting and tax firms across Frisco, Plano and Irving from its Frisco headquarters at 1701 Legacy Drive, including WISP documentation, MFA enforcement, tested backups and seasonal access control. The firm has served compliance-intensive clients since 2004.
Is a WISP required by law for tax preparers?
Yes. The FTC Safeguards Rule requires tax and accounting firms to keep a written information security program, and the IRS asks preparers to confirm they have one when they renew their PTIN.
What is the IRS Security Six?
Six safeguards the IRS recommends for every tax professional: antivirus software, a firewall, multi-factor authentication, backups, drive encryption and a VPN for remote connections.
Book a pre-season IT review: Contact the DKB crew.
Serving the DFW Metroplex
