Security Awareness
Training for Accounting
Firms, Built for Small Practices.
The FTC considers your firm a financial institution. The IRS requires a written security plan. Your professional liability carrier asks about annual training at renewal. This program supports all three sets of expectations, designed for firms where the managing partner is also the IT department.
Our FTC Safeguards Rule course is coming soon. Until then, teams can start with Cybersecurity Awareness and Phishing & Social Engineering.
Your regulatory requirements
Your firm handles data that regulators and insurers care about, deeply.
Tax returns. W-2s. Social Security numbers. Bank account details. Investment portfolios. If your firm handles any of this, and every accounting firm does, multiple frameworks require your team to complete annual security awareness training.
| Framework | Citation | What it requires |
|---|---|---|
| FTC Safeguards Rule | §314.4(c) | Requires financial institutions, including CPA firms, tax preparers, and bookkeeping services, to provide security awareness training to all personnel. Training must be updated to reflect risks identified in the risk assessment. |
| IRS Publication 4557 | Safeguarding Taxpayer Data | IRS requirement that tax professionals create and enact a written information security plan, including employee training on data security practices appropriate to the size and complexity of the firm. |
| SOC 2 | CC2.2 | For firms undergoing SOC 2 examinations, the Common Criteria require that management communicates information, including employee security awareness training, to support the functioning of internal control. |
| Gramm-Leach-Bliley Act | 15 U.S.C. §6801 | Requires financial institutions to explain their information-sharing practices and protect sensitive data. The FTC Safeguards Rule implements the data security provisions of GLBA for non-bank financial institutions. |
This table summarizes key training-adjacent provisions. Consult qualified counsel for a complete compliance assessment specific to your firm.
Why this matters for small firms
Attackers target accounting firms specifically, and small firms are softer targets.
Your firm holds concentrated financial data on dozens or hundreds of clients. One successful phishing email can expose SSNs, bank accounts, and tax returns for your entire client base. Training your staff is the front line of defense.
Accountants ranked among top phishing targets
Verizon 2024 Data Breach Investigations Report, professional services sector analysis
Firms with fewer than 10 employees breached
FBI IC3 2023 Internet Crime Report, small business victim demographics
Average cost of a data breach for professional services
IBM Cost of a Data Breach Report, 2024, professional services industry benchmark
What the training covers
Written for people who handle client financial data, not for IT security analysts.
Your staff are accountants, not cybersecurity professionals. This training speaks their language, tax season scenarios, client portal safety, wire fraud prevention, in plain English that makes the risks real without the technical jargon.
Client Financial Data Identification
What counts as nonpublic personal information (NPI) under GLBA and the FTC Safeguards Rule, bank account numbers, SSNs, tax returns, W-2s, and the data points staff handle every day.
Phishing and Business Email Compromise for Tax Season
How attackers impersonate clients, the IRS, and software vendors during tax season. Real examples of W-2 phishing scams that targeted small preparers, and how to spot them before replying.
Client Portal and Cloud Security
Secure use of client portals, tax software, and cloud file storage. Practical steps for small firms, what to do and what to avoid when sharing documents with clients and third parties.
Wire Transfer and Payment Verification
The FBI reports billions in wire fraud losses targeting real estate, legal, and accounting transactions. How to implement a simple verification step, a phone call to a known number, that stops most wire fraud.
Data Retention and Secure Disposal
FTC Safeguards Rule requires proper disposal of customer information. When to shred, when to securely delete, and how to handle physical files in a small firm without a records management department.
Incident Reporting in a Small Firm
If client data is exposed, a lost laptop, a misdirected email, a phishing click, who needs to know and how quickly. The notification obligations that apply to accounting firms under state law and professional standards.
Recommended for your industry
Recommended training for accounting teams
Not every employee needs every course. Start with the training that addresses your firm's regulatory obligations and biggest risks, then add specialized courses where your client base demands it.
FTC Safeguards Rule
Recommended for: CPA firms, tax preparers, bookkeeping services, enrolled agents, and any staff who handle client financial data.
Helps employees understand their obligations under the FTC Safeguards Rule and how to protect client financial data, tax returns, and nonpublic personal information.
This course is not open for enrollment yet.
View course detailsCybersecurity Awareness
Recommended for: Partners, staff accountants, bookkeepers, and administrative support in every role.
Builds the everyday security habits staff need to recognize phishing, tax-season scams, unsafe passwords, and the business email compromise attacks that target accounting firms.
Phishing & Social Engineering
Recommended for: Firms that handle high volumes of client financial data and vendor communications.
Provides deeper training for firms handling sensitive client data, where impersonation of clients, the IRS, and software vendors presents elevated risk.
SOC 2
Recommended for: Firms pursuing or maintaining SOC 2 attestation.
Useful for firms undergoing a SOC 2 examination that want employees to understand the trust services criteria and their role in supporting internal controls.
Not sure where to start? For most accounting firms, begin with the FTC Safeguards Rule and Cybersecurity Awareness. Add specialized courses based on your clients, SOC 2 commitments, and insurance requirements.
About your recommended courses
Frequently asked questions about your course recommendations
Our recommendations are built by mapping your industry's regulatory obligations and most common risks to specific courses. We organize them into tiers (Start Here, Highly Recommended, Recommended, When Applicable, and Based on Your Needs) so you can quickly see what's essential, what's broadly useful, and what's conditional on your specific situation.
Certificates and training records
When a peer reviewer, insurer, or client asks, you have documented records.
Every learner receives a dated certificate mapped to FTC Safeguards Rule §314.4(c), IRS Pub 4557, and SOC 2 CC2.2. Each certificate includes a public URL where anyone, a peer reviewer, a cyber insurance underwriter, a client audit team, can verify it is genuine. No login, no account, no phone call.
Manager dashboard shows who completed, who has not, and when each certificate expires. Export a PDF report. Attach it to your peer review documentation or cyber insurance renewal application.
Also applies to your profession
See how this training applies to other regulated small businesses.
Healthcare Practices
HIPAA Security Rule training for dental, medical, and chiropractic practices, no small-practice exemption.
View healthcare guideMortgage & Real Estate
GLBA training expectations and wire fraud prevention for independent originators and small brokerages.
View mortgage guideLegal Practices
ABA Model Rules 1.1 and 1.6, technology competence and confidentiality for small and solo firms.
View legal guideManaged Service Providers
CMMC, NIST CSF, ISO 27001, supply chain security training for small MSP teams.
View MSP guideInsurance Agencies
State regulation and NAIC model law training for independent agents and small brokerages.
View insurance guideFinancial Advisors
SEC and FINRA-aligned training for RIAs and independent advisors handling sensitive client financial data.
View financial advisor guideNonprofits
Donor data protection and grant compliance training for small charities and foundations without IT staff.
View nonprofit guide
Enroll your entire firm in four minutes. No IT staff, no sales call, no contract.
Partners, staff accountants, bookkeepers, administrative support, everyone who handles client data completes the same program. Certificates issued instantly. Publicly verifiable. Completion records you can download as soon as people finish.
Fixed annual pricing per person. Cancel any time. Certificates remain valid and verifiable for 12 months. Training and documentation support compliance, consult qualified counsel for framework-specific legal interpretation.