NetworkDefender
NetworkDefender
Most CPAs know they have to protect client data. Fewer know exactly how many separate laws require it, what each one demands, or what happens when a breach hits a firm that never put those requirements in place. This covers all of it: federal law, IRS mandates, AICPA standards, and Wisconsin-specific rules. If you run an accounting firm in Wisconsin, every one of these applies to you.
The Gramm-Leach-Bliley Act is a federal law most people associate with banks. You are covered too. The FTC's definition of "financial institution" under GLBA explicitly includes tax preparers and CPA firms. If your firm prepares returns, provides financial planning, or handles client financial data in any capacity, you are a financial institution under federal law.
GLBA requires you to protect client financial data and maintain a written security program. That is not optional guidance. The tool for implementing GLBA is the FTC Safeguards Rule, codified at 16 CFR Part 314.
The Safeguards Rule specifies exactly how to comply with GLBA. Every accounting firm, regardless of size, must meet these requirements:
If your firm maintains customer information concerning 5,000 or more consumers, additional requirements include a written risk assessment, penetration testing and vulnerability assessments on a defined schedule, a written incident response plan, and an annual written report to firm leadership on your security program. Separately, FTC notification under 16 CFR § 314.4(j) applies to a qualifying notification event involving the information of at least 500 consumers, regardless of the firm's size.
Under 16 CFR § 314.6, firms below the 5,000-consumer threshold are exempt from § 314.4(b)(1), (d)(2), (h), and (i), but not from the FTC notification rule in § 314.4(j). The other Safeguards Rule requirements still apply.
The full rule text is at ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314.
Every tax preparer in the country must have a Written Information Security Plan. Every single one. The IRS has no small-firm exemption here. A solo practitioner and a 50-person regional firm are held to the same standard.
Your WISP is not a document you create once and file away. It has to be reviewed and updated as your technology, staffing, and risk environment change. When you renew your PTIN, you attest to security compliance. That attestation means something.
The WISP is also how you demonstrate GLBA compliance. It is the implementation document. If you are audited or named in litigation after a breach, the WISP is Exhibit A.
No WISP means you are out of compliance. Here is what that actually looks like: a breach occurs, a client's data is compromised, and your firm has nothing documented. You are now retroactively scrambling to meet compliance obligations you should have addressed years ago, facing audit costs, civil litigation from affected clients, complications with your cyber liability insurance claim, and reputational damage that can take years to recover from, if it is recoverable at all.
The IRS references are Publication 5708 (updated August 2024, "Creating a Written Information Security Plan for Your Tax and Accounting Practice") and Publication 4557 (Safeguarding Taxpayer Data). Read both.
GLBA and the IRS address data security broadly. The AICPA's professional standards add requirements specific to how you practice.
SSTS 1.3 requires a data protection policy and a documented process for vetting and contracting with vendors. SSTS 1.4 requires documented evaluation of software and tools your firm uses. ET Section 1.700 requires a confidential client information policy. These are professional standards tied to your license, not optional guidance from a trade association.
For audit and assurance firms, SQMS No. 1 took effect December 15, 2025. It requires that your quality management system include an IT risk assessment. If you provide audit or assurance services and have not yet addressed this, you are already out of compliance.
For firms that qualify for Wisconsin's GLBA exemption under Wis. Stat. § 134.98(3m)(a) by being subject to and compliant with the cited GLBA privacy and security requirements and having a breach policy in effect, § 134.98 does not impose its state breach-notification requirements. Separately, the FTC Safeguards Rule requires notice to the Federal Trade Commission when a qualifying notification event involves the information of at least 500 consumers, as soon as possible and no later than 30 days after discovery. See 16 CFR § 314.4(j). FTC notice is not a substitute for any other applicable notification obligations.
If your firm does not qualify for the exemption and an incident meets Wisconsin's notice requirements, § 134.98 generally requires notice within a reasonable time, not to exceed 45 days after learning of the unauthorized acquisition. Notice goes by mail or through a channel previously used to communicate with affected individuals. If a single incident requires notice to 1,000 or more individuals, you must also notify the nationwide consumer reporting agencies.
Law enforcement can request a delay in notification during an active investigation. That delay is permitted, but it requires an explicit law enforcement request, you cannot decide on your own to hold off.
One more detail worth knowing: failure to provide required notification is not automatically negligence per se under Wisconsin law. It is, however, admissible as evidence of negligence. That distinction matters when your firm ends up in civil litigation.
Wisconsin Admin. Code Accy 2.602 sets the CPE framework: 80 hours per two-year cycle, minimum 20 hours per year. Three of those hours must be formal ethics CPE. At least 40 of the 80 total hours must come from formal learning activities. CPE records must be retained for five years. Your license renews December 14 of odd years.
There is no mandatory IT or cybersecurity subject matter requirement under Wisconsin's rules. You are not required to take security courses. But cybersecurity qualifies as a CPE subject area under the code, and given what GLBA, the IRS, and the AICPA now require from your firm, putting some of your CPE hours toward security compliance is a reasonable use of them.
Your firm needs these in place:
Start with the WISP. If your firm does not have one, that is your immediate gap. Every other element connects to it, and it is the document that demonstrates compliance under both the IRS mandate and GLBA.
If you have a WISP but have not reviewed it in the past 12 months, review it now. Update it to reflect current staffing, current technology, and any vendor changes.
If you provide audit or assurance services, SQMS No. 1 took effect December 15, 2025. If you have not yet built the IT risk assessment into your QMS, address it now.
If a breach has previously occurred at your firm without a documented response process, talk to your attorney about your current exposure before that situation comes up again.
GLBA, the IRS WISP requirement, AICPA professional standards, and Wisconsin Statute 134.98 where applicable each carry compliance obligations and consequences. A firm that has not addressed its applicable requirements is exposed to regulatory action and faces the full stack when something goes wrong: audit costs, civil litigation, insurance complications, and reputational damage that does not go away when the breach is contained.
The firms that handle this well are not the ones with the largest IT budgets. They are the ones that document their compliance the same way they document their client work.
NetworkDefender Security helps Wisconsin accounting firms meet GLBA, IRS, and AICPA compliance requirements. We build WISPs, conduct risk assessments, and implement the technical controls the law requires. Contact us to schedule a security review.
Want to see where you stand first? Run through our free Cyber Insurance & Compliance Readiness Checklist. It takes about five minutes and covers the same controls a WISP review and your cyber underwriters ask about.