What a small CPA or tax firm should require in a client portal before you switch

Publication 4557 tells tax professionals to encrypt sensitive files and email that carry personally identifiable information, to use strong password protections, and to send password protected and encrypted documents if they must share files by email, or to use a secure file transfer method instead. It also says to implement multi factor authentication for anyone accessing customer information, to limit access to people who need to know, and to implement audit trails that record who did what, when, and what changed. A return sitting in a personal Gmail thread matches none of that. (Publication 4557)

The Taxes Security Together checklist from the IRS, state tax agencies, and the Security Summit puts two factor authentication, drive encryption, backups, and a data security plan on the basic list for every size of firm. Publication 5293 repeats the same core: encrypt sensitive files and email, unique passwords, limit access, and report thefts to the IRS Stakeholder Liaison. This page does not claim a named product is "IRS compliant." It is the bar your portal has to clear if you are going to stop attaching 1040 PDFs to ordinary email. (Taxes Security Together checklist, Publication 5293)

The IRS newsroom reminder on multifactor authentication says tax pros should implement it across services and data access points, and should always enable it in tax software and cloud storage that contain sensitive client data. Treat the client portal as one of those access points. If the vendor lets you turn MFA off for "easier client login," leave the demo. (Tax pros: multifactor authentication is key to protecting client data)

Score the product you already use and two replacements on this table before you sit through another demo. Must have means you do not switch until it is true. Nice to have can wait until the cutover is done.

Publication 4557 also warns against public wifi for business email or sensitive documents, and treats MFA plus a VPN as a minimum for remote access to the firm network. A portal that only works if staff download zip files onto a cafe laptop is not a portal. It is email with extra steps.

Least privilege is a named list, not a feeling. Write it once per client. Review it when someone is hired, leaves, or the engagement changes.

• Firm users: owner, named preparers, named admin. No shared "office" login.
• Client users: taxpayer, spouse if they both need the file, bookkeeper if the letter says so. Each person gets their own login with MFA.
• Outside bookkeeper or prior CPA: a time boxed folder or a single download, then revoke.
• Seasonal staff: access to assigned clients only. Revoke in April when the season ends.
• Vendors (IT, a processor, a storage host): named people, under the same MFA and log rules you use internally.

Publication 4557 says to limit access to taxpayer data to individuals who need to know, and to withdraw outstanding authorizations for taxpayers who are no longer clients. The portal list should move with the engagement. When you send a disengagement letter, closing the portal is part of the same week, not a later chore.

A portal that nobody logs into will push you back to attachments. Send one short explainer with the first document request. Do not bury it in a 12 page welcome PDF.

• This is the only place we send returns, organizers, and source PDFs.
• Turn MFA on the first time you log in. We will not disable it because a password manager felt slower.
• Email from us will say a file is waiting. The file is not in the email.
• If a spouse or bookkeeper needs the file, reply with their email. Do not forward your password.
• If you cannot log in, call the office. Do not reply to a surprise "reset your portal" email that we did not tell you to expect. Publication 4557 flags phishing that pretends to be a software or storage vendor.

Getting documents in at all is still how to get clients to send tax documents on time. The portal is the place. The missing list is still the work.

Do not flip the whole book on a Friday in March. Move a slice, prove MFA and the log, then move the rest. Keep email attachments closed for anyone you have already trained.

If week 2 fails because clients cannot get past MFA, do not turn MFA off. Sit with the first ten on the phone and finish the login. The IRS and Security Summit material above treats that second factor as a protection you turn on, not a feature you bargain away.

The Taxes Security Together checklist and Publication 4557 both tell professional tax preparers to create and keep a data security plan. Name the portal on that plan: what data it holds, who can get in, MFA, encryption, logs, and how you revoke access. The steps to write the plan are in the WISP guide. Do not wait for a vendor to hand you a "compliance packet" and call the job done.

Download the portal scorecard and 4 week cutover. Score three products on must have versus nice to have, then date the cutover weeks.

The tax season operator can draft the login chase for clients who were invited and have not opened the portal. Your staff approve what goes out. Your CPA reviews and signs every return.