Professional services
Security records and data protection for accounting and tax firms.
Security built for accounting and tax firms
Clients expect confidential work to remain under clear control. Connected file and sign-in records help a firm investigate concerns and explain its handling of client information.
Examiners
| Who asks | What they ask for | Supporting record |
|---|---|---|
| FTC | A log of authorized user activity under 314.4(c)(8). | Sign-in and file server logs, plus user risk scores. → |
| IRS | Audit trails, reviewed at least every 90 days. | Scheduled reports that date each review. → |
| Regulated clients | Notice under the applicable client terms. | A case timeline and a signed export. → |
| PCAOB, from Dec 15, 2026 | Evidence on technological resources. | Signed logs of system activity. → |
| Clients | Which of their documents left. | File share and DLP file records. → |
Client notice
File access and transfer records help establish which information may be involved in an incident. Keep the evidence and remaining gaps visible so client communications reflect what the investigation supports.
FTC Safeguards Rule
Under 16 CFR 314.4(c)(8), user-activity monitoring helps a tax firm examine access to customer information. Identity and file-server records provide a history for review and support the wider safeguards program.
IRS Publication 5708
A written security plan needs a review process people can maintain. Scheduled SIEM reports can organize relevant activity, while recorded findings and follow-up show that the review actually happened.
26 USC 7216
Tax-return information needs handling rules across email, uploads and approved AI tools. Content inspection by a DLP can apply those rules on covered paths, with legitimate exceptions reviewed before disclosure.
By rule
FTC
A log of authorized user activity under 314.4(c)(8). Identity and activity records in a SIEM give reviewers the history needed to investigate account use.
IRS
Audit trails, reviewed at least every 90 days. Scheduled SIEM reports organize the relevant records; review findings and follow-up show how the information was used.
PCAOB, from Dec 15, 2026
Evidence on technological resources. Signed records from a SIEM and verification material support an independent check of the evidence’s integrity.
Clients
Which of their documents left. File access and transfer events help investigators identify the information involved and the activity around it.
Questions
Would we spot a fake client email?
Email controls and threat intelligence can identify suspicious indicators; account and host activity can add context after a message is opened. Review the evidence across those tools rather than relying on one signal.
Who approves an action?
The organization defines who may approve each response. A SOAR workflow presents the decision to that person and retains the approval, action and outcome.
What stays with the firm?
The firm owns its written security plan, client decisions and tax-software relationships. Define which vendor records and managed systems are included in the monitoring scope.
Guide
Does the FTC Safeguards Rule apply to accountants?
The rule applies to financial institutions within its scope, including tax-preparation firms. Applicability depends on the services the firm provides.
What is IRS Publication 4557?
IRS guidance for tax professionals on safeguarding taxpayer data, including audit trails and a written security plan.
What is 26 USC 7216?
A federal law that makes knowing or reckless disclosure of tax return information a crime.
How ARRTECH takes care of professional services security
Connects security activity into a signed record, giving incident decisions and board reporting evidence that can be independently verified.
Protects intellectual property and customer trust, with content-aware controls that let organizations adopt AI on their own terms.
Expands response capacity through automation, with defined human authority and a record of who approved what.
Finds changes in behavior that predefined rules miss, connecting the signs of an attack so teams can understand what warrants action.
Investigates alerts, tests explanations and prepares the evidence, giving analysts more capacity while people retain authority over the response.
