Now more than ever it is of the utmost importance for CPAs to handle client data as carefully as possible; more than 127 million personal information records were exposed in 2011, causing a swell of fraudulent tax filings and delays in refund claims, according to the Internal Revenue Service.
To avoid expensive data breaches, firms can follow basic loss prevention tips:
- Ensure that laptops, desktops, USB drives, servers, smart phones and other devices do not contain any confidential data that is unencrypted.
- Consider remote laptop security measures to prevent access to protected files in the event of theft or loss.
- Ensure that email messages and attachments containing confidential data are encrypted with file encryption and digital certificates.
- Use strong passwords, and do not write them down or share them. Passwords should be “salted” with random bits and symbols such as #, $ and &. Change passwords at least every 90 days.
- Physical security should be provided for computers and endpoints as with any other valuable assets, including building security and access codes and locking up all servers, laptops, desktops and mobile devices.
- Do not download personal software onto business computers because of the risk of downloading viruses or worms along with the software.
Firms should also engage in a continuous data security process that operates in three areas:
- Risk Assessment – Utilize software tools for assessing and analyzing the security of most computer systems. Many software companies also provide security updates to protect from threats that have been identified, and most updates can be applied automatically. Have a computer specialist conduct a more thorough assessment and analysis to highlight vulnerabilities and provide risk reduction tips.
- Comprehensive Written Plan – A written information security plan outlines the specific ways the firm will protect data; sets forth policies, procedures and staff responsibilities, including what staff members are not allowed to do, and what they are required to do (such as immediately reporting any actual or potential security problems); covers areas such as the Internet, social media, email usage, and record retention and destruction; and details the reporting and other requirements of the states in question and the state agencies to which breaches are to be reported. Some states require firms to be compliant with the state’s privacy laws if the firm has the privacy data of a resident in that state. Some states require a written security plan by law.
- Regular Staff Training – Teach the written plan to staff and ensure that each employee knows what the firm is doing and what he or she is required to do, including best practices for addressing new and continuing risks, such as social engineering, phishing and web application attacks. New laws or regulations should be reflected in changes to the plan. Training sessions to update staff on such changes will make the plan a dynamic, living document that staff uses and relies upon.
