Update your firm’s cybersecurity practices in 2026

Cybersecurity has become one of the most significant risks facing tax professionals. As firms continue to adopt cloud-based applications and remote work arrangements, cybercriminals are finding new ways to target sensitive taxpayer information. 

Tax professionals remain attractive targets because they maintain large volumes of confidential financial information, including Social Security numbers, tax returns, bank account details and other personally identifiable information (PII). 

Understanding cybersecurity threats

Common threats include phishing attacks, ransomware incidents and unauthorized access to systems and accounts. Phishing remains one of the most effective tactics used by cybercriminals. These attacks often involve fraudulent emails, text messages or websites designed to trick users into revealing passwords or other sensitive information. 

Ransomware presents another growing concern. In these attacks, criminals encrypt a firm's data and demand payment to restore access. Even firms with limited staff and resources can become targets.

Federal requirements shape security expectations

Cybersecurity is not solely an operational issue. It is also a compliance responsibility. Federal data security requirements, including those established under the Gramm-Leach-Bliley Act (GLBA), require tax professionals to safeguard customer information. Since the 2023 filing season, when renewing your PTIN, tax professionals must attest to having a data security plan in place.  

Understanding these requirements is critical because firms are expected to implement reasonable safeguards that protect sensitive information from unauthorized access and disclosure. For many practitioners, compliance begins with evaluating existing security measures and identifying potential gaps before they become vulnerabilities.

Evaluating technology risks

Modern tax practices rely on a wide range of technology tools. Tax preparation software, document storage systems, client portals and cloud platforms play a role in daily operations. Each tool introduces potential security risks if not properly evaluated and managed.

An effective cybersecurity strategy should include secure processes for handling sensitive data, managing user access and maintaining technology systems. Regular reviews of security controls can help firms identify weaknesses before they are exploited.

Where’s your written information security plan?

Federal law requires tax professionals to create and maintain a written data security plan, commonly referred to as a WISP.

A WISP serves as a roadmap for how a firm protects sensitive information and responds to security risks. It documents policies, procedures and safeguards designed to protect client data. An effective WISP helps ensure that cybersecurity efforts remain organized, consistent and aligned with current requirements.

Preparing for the next filing season

Cybersecurity threats are expected to remain a significant challenge in 2026 and beyond. By understanding emerging threats, firms can strengthen their cybersecurity posture and reduce potential exposure. Gain practical guidance tailored specifically for tax professionals; join NATP's Cybersecurity Best Practices for Tax Professionals webinar presented by Jatin Narang on July 23, 2026. 

The course explores today's most pressing cybersecurity risks, federal data security requirements, secure technology practices and the key components of an effective WISP. Professional and premium members can attend this webinar as part of their NATP membership benefits at no additional cost, making it an excellent opportunity to strengthen your firm's security posture while earning valuable professional education.