Skip to content

For CPA and Tax Firms

Every client SSN, W-2, and 1099 is in your inbox. Is anyone watching?

The FTC Safeguards Rule requires tax and accounting firms to keep a Written Information Security Plan, and IRS Publication 4557 shows how to build one. The Rule calls for continuous monitoring or regular penetration testing. SentinelSMB is the monitoring piece of your WISP, live in under 10 minutes.

Ask about monitoring Run a free scan first
  • Month to month
  • No setup fees
  • Cancel anytime
$4.5B

Tax fraud identified by IRS Criminal Investigation in fiscal year 2025

Source: IRS Criminal Investigation Annual Report, FY2025

Credentialed, insured, operational

  • RegisteredND LLC
  • IRS registeredEIN on file
  • E&O insured$1M per claim, $2M total
  • EncryptedYour data, at rest and in transit
  • Sign-inAlways a second step
  • Audit trail365-day retention

Threats we catch

Three attacks aimed at accounting firms.

36 detection engines check your Microsoft 365, Google Workspace, AWS and Cloudflare accounts every five minutes. Critical threats surface instantly. Normal activity gets filed away.

Fraudulent return filings

Attackers phish a bookkeeper, harvest client SSNs and EFINs from email threads, and file fake returns in February. You find out when legitimate clients get rejected at the IRS.

Tax season inbox hijack

A forwarding rule added during busy season quietly copies every W-2, 1099, and engagement letter to an external inbox for three months. IRS Publication 4557 recommends safeguards that catch this.

Client portal credential theft

Stolen partner credentials let an attacker log into your Drake, UltraTax, or Lacerte portal and download every prior-year return. Most firms have zero monitoring on these access events.

36 detection engines Every five minutes
Fraudulent return filingsFlagged. You get a text with the steps to fix it.

Example alert for a made-up business.

Your blind spot

What a typical IT setup does not watch.

  1. During tax season you add temporary preparers and grant them access to client data — and nobody is watching what those accounts do after 8 PM.
  2. Your IT person sets up the laptops but does not monitor Microsoft 365 sign-ins, forwarding rules, or OAuth app permissions.
  3. A binder of written policies is not the same as actual monitoring, and the Safeguards Rule expects you to do one of monitoring or annual testing.
  4. A single compromised credential during peak busy season can expose every client SSN and every prior-year return in one download.

The screen is an example for a made-up business, not real customer data.

Compliance alignment

The rules and frameworks we line up to.

SentinelSMB provides the continuous-monitoring, access-control, and incident-response controls these frameworks require. Pro subscribers get the audit-ready evidence package.

  1. IRS Publication 4557

    Written Information Security Plan

    Paid tax preparers must keep a written information security plan, and Publication 4557 recommends monitoring access to systems holding taxpayer data. SentinelSMB provides the continuous-monitoring component and documents every access event.

  2. FTC Safeguards Rule

    Monitoring or testing requirement

    Effective June 9, 2023, the FTC Safeguards Rule requires tax preparers (as financial institutions) to designate a qualified individual, keep an incident response plan, and run either continuous monitoring or an annual penetration test plus vulnerability scans every six months.

  3. IRS Publication 4557 guidance

    Access control monitoring

    Publication 4557 recommends controlling access to taxpayer data and monitoring who accesses what. SentinelSMB tracks every login, every file access, and every permission change across Microsoft 365 and Google Workspace.

  4. GLBA Safeguards

    Customer information protection

    The Gramm-Leach-Bliley Act requires financial institutions to protect customer information. SentinelSMB provides the detection and response capabilities the Safeguards Rule expects.

Questions

Questions accounting firms ask.

Text Cole at (701) 391-5973
Does SentinelSMB make us IRS 4557 compliant on its own?

SentinelSMB provides the continuous-monitoring, access-logging, and incident-response components recommended by Publication 4557. You still need a written WISP document, a designated qualified individual, and employee training. Pro subscribers get six audit-ready policy templates including a WISP framework.

How does the FTC Safeguards Rule apply to my practice?

If your firm handles customer financial information — and nearly every tax and accounting firm does — you are a financial institution under GLBA and the Safeguards Rule applies. Since June 9, 2023, the Rule has required either continuous monitoring or an annual penetration test plus vulnerability scans every six months.

Can you help us pass the IRS e-Services suitability check?

SentinelSMB provides the access monitoring and audit trail the IRS expects to see from EFIN holders. We cannot complete the e-Services application for you, but we generate the documentation that demonstrates continuous monitoring.

What if we only use Drake or UltraTax, not Microsoft 365?

SentinelSMB monitors your Microsoft 365, Google Workspace, AWS, and Cloudflare environments — wherever your email, documents, and cloud infrastructure live. If your tax software is self-hosted with SSO against one of those, the account activity is covered.

How much does this add to a tax-season budget?

Starter is one flat monthly price to monitor every client SSN, W-2, and 1099 in your system around the clock. Pro is a second flat plan that includes the Cyber Insurance Evidence Report, so you are not paying a consultant to assemble that evidence by hand.

Your WISP calls for monitoring. SentinelSMB is the monitoring.

Get continuous monitoring live before next tax season. Under 10 minutes to connect. Cancel in one click.

Ask about monitoring See pricing