What is CPA firm cybersecurity training? CPA firm cybersecurity training is a federal-first compliance program that teaches tax practitioners how to satisfy IRS Publication 4557 (Safeguarding Taxpayer Data), author a Written Information Security Plan from IRS Publication 5708, meet the FTC Safeguards Rule (16 CFR §314), and align with AICPA SSTS — all in one $499 lifetime course with a tax-season fraud playbook.
CPA FIRM CYBERSECURITY & COMPLIANCE TRAINING
Built for partners, EAs, tax preparers, and firm administrators at small and mid-sized accounting practices. Walk through IRS Publication 4557, author your written information security plan from the IRS Pub 5708 template, master the FTC Safeguards Rule (16 CFR Part 314) including the May 13, 2024 breach-notification amendment, and operate a tax-season fraud playbook that has been battle-tested across hundreds of engagements.
Why CPA Firms Cannot Wait Another Tax Season
The regulatory ground beneath accounting firms shifted twice in eighteen months. On June 9, 2023, the FTC Safeguards Rule transitioned from a "reasonable measures" standard to a prescriptive checklist of nine specific technical controls applicable to every tax preparer who handles consumer financial data. Then on May 13, 2024, the FTC adopted a breach-notification amendment that requires non-banking financial institutions, including tax preparation firms, to notify the Federal Trade Commission within 30 days of discovering a security event involving the unencrypted information of 500 or more consumers.
At the same time, IRS enforcement around Publication 4557 and the written information security plan obligation rooted in the Gramm-Leach-Bliley Act has intensified every year since 2022. Stakeholder Liaison field interviews now routinely ask preparers to produce their WISP on demand, and the IRS Security Summit has issued repeated reminders that operating without a WISP is no longer a defensible posture. Firms that ignore this guidance are not just exposing client data, they are creating an unfavorable record that examiners can cite during PTIN renewal, EFIN review, or any audit triggered by a complaint.
The threat landscape has not waited for the rules to settle. Refund-redirect fraud, EFIN takeover, business-email compromise targeting wire instructions, W-2 phishing campaigns, and ransomware against tax-prep workstations spike every January through April. The 2026 filing season is shaping up to look the same. This course gives your firm a structured, current, practical path to meet the law and survive the season.
What changed on May 13, 2024
The breach-notification amendment to 16 CFR Part 314 added a new Section 314.5 requiring covered financial institutions to notify the FTC as soon as possible, and no later than 30 days after discovery, of a notification event affecting 500 or more consumers' unencrypted customer information. Notification is filed through the FTC's electronic notification portal and is published on a public list within the FTC's website. For a small CPA firm, that means a single laptop loss or ransomware event with the right number of records crosses you onto a public federal breach list. The course module on breach response walks you through exactly what to do in the first 72 hours so you do not miss the clock.
What changed with IRS Publication 5708
IRS Publication 5708, the WISP template the IRS released for tax professionals, is now the practical baseline that every preparer is expected to know. The course walks through the template section by section so your firm's WISP is firm-specific, defensible, and tied directly to the controls you are actually running. A generic template downloaded and saved unsigned in a shared drive is not a WISP. We show you how to make it real.
The Four Regulators You Answer To
Most CPA firms know the IRS expects a WISP. Far fewer realize three other regulators, each with overlapping but distinct mandates, also have authority over your firm's information security program.
Internal Revenue Service
Through Publication 4557 (Safeguarding Taxpayer Data) and Publication 5708 (WISP template), the IRS sets the operational floor for every preparer with a PTIN or EFIN. Failure to maintain a WISP can trigger PTIN suspension, EFIN revocation, and referral to the IRS Office of Professional Responsibility. Stakeholder Liaison interviews routinely ask preparers to produce the WISP.
Federal Trade Commission
The FTC Safeguards Rule (16 CFR Part 314) classifies tax preparers as "financial institutions" under the Gramm-Leach-Bliley Act. The June 9, 2023 amendments require nine specific controls. The May 13, 2024 amendment adds 30-day federal breach notification for events touching 500 or more consumers. See our deeper service walkthrough at /ftc-safeguards-rule-compliance/.
State Attorneys General
All 50 states plus DC have data breach notification laws. North Carolina G.S. 75-65, California CCPA, New York SHIELD Act, Massachusetts 201 CMR 17.00, and Texas Identity Theft Enforcement and Protection Act each impose their own timelines, content requirements, and credit-monitoring obligations. The course covers the most common state laws encountered by multi-state CPA firms and how to layer state notice on top of FTC notice.
AICPA & State Boards of Accountancy
The AICPA Code of Professional Conduct Section 1.700 (Confidential Client Information), the AICPA Statements on Standards for Tax Services (SSTS), and the corresponding state board rules treat the failure to safeguard client data as a professional discipline issue independent of any IRS or FTC action. SOC 2 readiness, which the course previews, is the framework the profession increasingly looks to for documented proof of controls.
Who This Course Is Built For
Practitioner-led content for the people inside the firm who actually carry the weight of the security program, regardless of whether you have a dedicated IT person.
What Is Inside the Course
Six modules, twelve lessons, roughly 240 minutes of practitioner-led video and worked exercises, ending in a 20-question final exam scored at 80 percent to pass and a downloadable certificate of completion.
IRS Publication 4557 Walkthrough
Section-by-section walkthrough of Publication 4557 (Safeguarding Taxpayer Data: A Guide for Your Business). Covers signs you have been compromised, the six security checklist items, the WISP requirement under Gramm-Leach-Bliley, taxpayer data theft reporting, and the relationship between Publication 4557 and Publication 5708. Lesson 1 is a paragraph-by-paragraph reading. Lesson 2 is a firm self-assessment workbook.
Authoring Your WISP from Pub 5708
The hands-on module. We open IRS Publication 5708 (Creating a Written Information Security Plan for your Tax & Accounting Practice) and fill it out together. Lesson 1 covers identifying responsible individuals, scope of customer information, and access control documentation. Lesson 2 covers technical safeguards, vendor management, employee training schedule, and incident response language tailored to your firm.
FTC Safeguards Rule for Tax Pros
The nine prescriptive requirements under 16 CFR Part 314 translated into tax-firm reality. Lesson 1 covers the qualified individual designation, written risk assessment, MFA, encryption, and access controls. Lesson 2 covers vendor oversight, training, monitoring and testing, incident response, and the May 13, 2024 breach notification amendment in detail.
State Privacy & Breach Laws
The state-law layer most CPA firms miss. Lesson 1 covers the most common state breach notification statutes including North Carolina, Massachusetts, New York, California, and Texas. Lesson 2 walks the layered notice flow when a single incident triggers FTC, multiple state AGs, the IRS, and affected taxpayers all at once.
Tax-Season Fraud Playbook
The module that earns the price by itself. W-2 phishing, EFIN takeover, refund-redirect fraud, business-email compromise on wire instructions, ransomware-against-tax-prep workstations, and the dependent-claim race. Lesson 1 covers attack patterns. Lesson 2 covers the response playbook, including IRS Form 14039-B (Business Identity Theft Affidavit) and EFIN reinstatement procedure.
Breach Response & SOC 2 Readiness
The forward-looking module. Lesson 1 covers the first 72 hours of a breach: containment, evidence preservation, IRS Stakeholder Liaison contact, FTC portal filing, state AG notice, and client communication templates. Lesson 2 maps the five SOC 2 trust services criteria to the controls you have already built through this course, so you have a path to a SOC 2 attestation when a referral source or institutional client asks for one.
Tax-Season Fraud Playbook: A Preview
Attack Patterns We Cover
- EFIN takeover. Threat actors hijack a preparer's e-filing identification number to file fraudulent returns at scale. The first signal is often an IRS letter referencing returns the firm did not file. The course covers the EFIN application security checklist, IRS e-Services account hardening, and the reinstatement workflow if takeover has already occurred.
- W-2 phishing of clients. Attackers impersonate the firm to extract W-2s and 1099s directly from client HR departments, then file fraudulent returns claiming the refund. The lesson covers the warning signs, the DKIM and DMARC controls that block this on the firm's end, and the conversation script to use with clients before the season starts.
- Refund redirect. Account-number tampering on bank routing details inside the tax software, a quiet attack that leaves the firm's records looking correct while the refund lands in the attacker's account. The lesson covers the change-tracking and out-of-band verification controls that catch this.
Response Playbook We Build
- Wire-fraud BEC response. When a client receives wire instructions that appear to come from the firm but route money to an attacker, the response window is hours, not days. The lesson covers the FBI IC3 filing, Financial Fraud Kill Chain (FFKC) request, client communication, and reconciliation accounting.
- Ransomware on tax prep workstations. The first 72 hours: isolate, preserve, contact IRS Stakeholder Liaison, evaluate FTC notification trigger, document for cyber-insurance carrier. The lesson includes a printable response card you can hand to a partner who picks up the ransom note at 6 AM on April 14.
- IRS Form 14039-B and EFIN reinstatement. Step-by-step on the Business Identity Theft Affidavit and the operational steps to get back on the e-file system after a takeover, including documentation the IRS will request and typical response timelines.
Pricing & What You Get
A single flat tuition. Lifetime access to course updates as the rules change. Pricing reflects single-seat enrollment — group rates available for firms with five or more seats. Call (919) 348-4912.
- 6 modules, 12 lessons, approximately 240 minutes of video and exercises
- IRS Publication 5708 WISP template walkthrough with firm-specific customization
- Tax-season fraud playbook with printable response cards
- Final exam (20 questions, 80 percent to pass, unlimited retakes)
- Certificate of completion you can save to your CPE file
- Structured for CPE-equivalent self-study contact hours where your state board permits self-reporting
- Lifetime updates: when the FTC, IRS, or AICPA shifts the rules, your course updates with it
- Group pricing for firms with five or more seats — call (919) 348-4912
Important CPE disclosure: This course is structured for CPE-equivalent self-study contact hours and is not currently registered with NASBA. Many state boards of accountancy permit licensees to self-report self-study hours toward continuing education requirements. You are responsible for confirming acceptance with your state board before applying these hours toward your CPE record.
Includes a Downloadable Resource Pack
Every enrollment includes a Resource Pack of practitioner-built templates the PTG team uses on live tax-firm engagements. These would cost hundreds in standalone licensing fees from compliance-template vendors. Members receive them as part of the $499 tuition, in editable form, ready to brand and put to work the day a partner finishes the course.
The Resource Pack is what makes the curriculum actionable. Module 2 walks you through authoring a WISP from IRS Pub 5708; the Resource Pack ships the working template. Module 6 covers breach response; the Resource Pack ships the 30-day notification matrix. The four documents below ship with every seat:
- WISP Template (IRS Pub 5708-aligned). 8-10 pages of fill-in placeholders for firm name, qualified individual, signing partner, scope of customer information, technical safeguards, vendor list, training schedule, and incident response language. Customize once and you have a defensible WISP that maps to the controls you actually run.
- Qualified Individual Designation Memo. One-page formal memo per 16 CFR § 314.4(a) that documents the appointment of your qualified individual, scope of authority, reporting cadence, and signature line for the partner or governing body. The exact language examiners look for.
- Vendor / SOC 2 Review Tracker. Printable inventory of every vendor with access to customer information, last SOC 2 review date, contract renewal date, and a column for the qualified individual's annual sign-off. Closes the § 314.4(f) service-provider oversight requirement.
- Breach Notification 30-Day Matrix. Federal and state notification clocks on one page — FTC 30-day rule, IRS Stakeholder Liaison contact, North Carolina, California, New York, Massachusetts, Texas, and a research-framework column for any state not covered. The first document a partner reaches for at 6 AM on April 14.
Templates are delivered in editable formats. Lifetime updates: when the FTC, IRS, or AICPA shifts the rules, your Resource Pack updates with the course at no additional charge.
How This Compares to AICPA, Surgent, and Becker
The major continuing-education providers each have a place in a CPA firm's training stack. AICPA on-demand, Surgent CPE, and Becker each offer broad NASBA-registered libraries that satisfy traditional CPE-hour requirements across tax, audit, accounting, and ethics. They are designed for breadth and credit, not for hands-on cybersecurity execution at the firm level.
This course is different on three points. First, it is practitioner-led by a security firm that runs incident response on tax practices, not by a general continuing-education vendor. The Module 5 fraud playbook is built from real engagements, not from secondary research. Second, the content is current to 2026 and includes the May 13, 2024 FTC breach amendment, the most recent IRS Security Summit guidance, and the latest IRS Stakeholder Liaison expectations on WISP examination. Third, it includes an actual WISP authoring walkthrough using IRS Publication 5708 as the working template, which is something the broad CPE catalogs do not currently offer at this depth.
A practical recommendation: keep your AICPA, Surgent, or Becker subscription for traditional CPE breadth. Add this course as your firm's hands-on cybersecurity and compliance operations layer. The two stacks are complements, not substitutes.
What this course does not claim
- This course is not currently NASBA-registered. We are explicit about that throughout the curriculum.
- This course does not issue traditional CPE credit. It produces a certificate of completion structured for CPE-equivalent self-study contact hours.
- This course does not provide legal advice. It provides cybersecurity and compliance operations guidance. For legal interpretation of the FTC Safeguards Rule, IRS Pub 4557, or state breach notification statutes, engage qualified counsel.
About Petronella Technology Group
Petronella Technology Group is a Raleigh, North Carolina-based cybersecurity, compliance, and AI automation firm that has served accounting firms, financial advisors, healthcare practices, and DoD supply-chain manufacturers since 2003. The firm holds a BBB A+ rating, is a CMMC Registered Practitioner Organization, and has delivered hundreds of WISP authorings, FTC Safeguards Rule readiness projects, breach response engagements, and security awareness programs to small and mid-sized professional service firms.
The course is led by Craig Petronella, founder of PTG, who carries the CMMC Registered Practitioner (CMMC-RP) designation, the Cisco Certified Network Associate (CCNA), the Certified Wireless Network Expert (CWNE), and the Digital Forensic Examiner (DFE) credential. Craig is the author of multiple Amazon-published books on cybersecurity for small business, the host of the PTG cybersecurity podcast, and a frequent speaker at industry events on tax-season fraud, ransomware response, and the FTC Safeguards Rule.
Beyond Craig, the PTG team includes additional CMMC Registered Practitioners and brings the operational depth of an actively delivering security firm. The course content is the curriculum we use internally to train our own analysts before they are assigned to tax-firm engagements.
The firm operates a portfolio of related compliance services including cybersecurity audit and assessment, virtual CISO engagements for firms that need an outsourced qualified individual under the FTC Safeguards Rule, and HIPAA compliance services for firms that handle protected health information through their healthcare clients.
Frequently Asked Questions
What's included in the Resource Pack?
Every enrollment ships with a downloadable Resource Pack of templates worth hundreds in standalone licensing fees from compliance-template vendors:
- WISP Template — IRS Pub 5708-aligned, 8-10 pages, fill-in placeholders for firm name, qualified individual, and signing partner
- Qualified Individual Designation Memo — one-page formal memo per 16 CFR § 314.4(a)
- Vendor / SOC 2 Review Tracker — printable inventory of every vendor and last SOC 2 review date
- Breach Notification 30-Day Matrix — federal and state notification clocks on one page
All templates are delivered in editable formats. Lifetime updates ship to enrolled students at no additional charge as the rules change.
Does this course earn NASBA CPE credit?
No. This course is not currently registered with NASBA, and we do not issue traditional NASBA CPE credit. The course is structured for CPE-equivalent self-study contact hours, which many state boards of accountancy permit licensees to self-report toward their continuing education requirements. Acceptance varies by state and by license type. Confirm acceptance with your state board of accountancy before applying these hours to your CPE record. We will update this disclosure if the course later becomes NASBA-registered.
Will the WISP template walkthrough satisfy IRS Publication 5708?
Yes, when you customize the IRS Publication 5708 template to your firm during the course exercises. Publication 5708 is the IRS-issued template, and Module 2 walks through every section so the document you produce reflects your real responsible individuals, your actual technical safeguards, your real vendor list, your training schedule, and your incident response process. A signed, customized WISP that maps to the controls you are running is what the IRS expects. A generic template downloaded and saved unsigned is not a WISP. The course makes the difference clear.
Is there group or team pricing for our firm?
Yes. Tuition is $499 per seat at single-seat purchase. For firms enrolling five or more staff, we offer tiered group pricing with consolidated billing, a single point of contact for onboarding, and centralized completion reporting for the firm administrator or qualified individual. Call us at (919) 348-4912 or use the enrollment page at /training/courses/cpa-firm-cybersecurity-compliance/ to request a group quote.
What is the refund policy?
We offer a full refund within 14 days of enrollment if you have completed less than 25 percent of the course. After that point, the course is non-refundable because lifetime access has already been provisioned. Group enrollments follow the same terms on a per-seat basis. If you have a problem with the course experience, call (919) 348-4912 before requesting a refund. We would rather fix the problem than process a return.
How often is the course updated?
The course is reviewed and updated whenever a regulator publishes meaningful new guidance. Examples since launch: the May 13, 2024 FTC breach notification amendment, IRS Security Summit annual reminders, and updated AICPA professional conduct guidance on data security. Lifetime access means you receive these updates without paying again. We notify enrolled students by email when a material update ships.
Does the course cover state-specific breach laws?
The course is federal-first and covers the FTC Safeguards Rule and the IRS framework in depth. Module 4 then layers state breach notification law and walks through the most common state statutes encountered by multi-state CPA firms, including North Carolina G.S. 75-65, California CCPA notification, New York SHIELD Act, Massachusetts 201 CMR 17.00, and Texas Identity Theft Enforcement and Protection Act. If your firm operates in a state not covered in detail in Module 4, we provide a research framework for confirming local requirements with counsel.
I am a solo EA, not a CPA. Is this course relevant?
Yes. Enrolled agents, tax preparers with PTINs, and any practitioner who handles federal tax returns or W-2 / 1099 data falls within the IRS Publication 4557 and 5708 framework and the FTC Safeguards Rule. The course content was built with solo practitioners and small firms in mind. The Module 2 WISP walkthrough scales down cleanly to a one-person practice.
I do not have a dedicated IT person. Can I still implement what is in this course?
Yes. The course is written for practitioners, not for IT engineers. We use plain-English explanations of MFA, encryption, access controls, and incident response. Where a topic requires technical implementation, we point at concrete vendor options at three price points and explain what to ask a managed service provider to implement on your behalf. If you decide you would rather have outside help carrying the load, our virtual CISO service can act as your firm's qualified individual under the Safeguards Rule.
Is the certificate accepted as proof of training for cyber insurance applications?
Cyber insurance carriers vary. Most carriers asking about security awareness and compliance training accept evidence of structured curriculum, completion records, and dated certificates. Our certificate of completion includes the curriculum outline and dated completion stamp that carriers typically request. We cannot guarantee acceptance with any specific carrier. If your carrier requires a specific accreditation, share the requirement with us at (919) 348-4912 and we will tell you honestly whether the course meets it.
Does completing the course mean my firm is FTC Safeguards Rule compliant?
The course teaches the framework and walks you through authoring the documentation, but compliance is an operational state, not a course completion. To reach actual compliance you must implement the technical safeguards, designate the qualified individual, conduct the written risk assessment, train the staff, monitor the safeguards, oversee vendors, and respond to incidents on an ongoing basis. The course gives you a structured path. If your firm needs hands-on help executing on it, our cybersecurity audit and assessment service is designed for exactly that handoff.
How does this relate to SOC 2?
SOC 2 is the framework that institutional clients and referral sources increasingly look to for documented proof of controls. Module 6 maps the five SOC 2 trust services criteria (security, availability, processing integrity, confidentiality, privacy) to the controls you have already built through the course, so you have a clear path to a SOC 2 attestation when a client or referral source asks for one. The course does not itself produce a SOC 2 report. A licensed CPA firm produces that report. The course gives you the readiness foundation that makes the engagement shorter and less expensive.
Can the course satisfy our HIPAA training requirement if we serve healthcare clients?
Indirectly. CPA firms that handle protected health information for healthcare clients typically need HIPAA-specific workforce training in addition to general security awareness. This course is tax-firm focused and is not a HIPAA training substitute. For HIPAA-specific obligations, see our HIPAA compliance service. Many healthcare-serving CPA firms layer this course on top of a HIPAA workforce training to cover both regulators.
Take the Tax-Season Compliance Risk Off Your Desk
Six modules. Twelve lessons. Approximately 240 minutes that produce a working WISP, a fraud playbook, a breach response process, and a SOC 2 readiness map. $499 once. Lifetime updates. Call us if your firm wants a group rollout.
Disclaimer: This course is delivered by Petronella Technology Group, Inc. for cybersecurity and compliance education purposes only. Nothing in the course or on this page constitutes legal advice, tax advice, or an attorney-client relationship. Petronella Technology Group is not a law firm. State board acceptance of CPE-equivalent self-study contact hours varies. Confirm acceptance with your state board of accountancy before applying course hours toward CPE requirements. The course is not currently registered with NASBA. For legal interpretation of the FTC Safeguards Rule, IRS Publication 4557, IRS Publication 5708, the Gramm-Leach-Bliley Act, or state breach notification statutes, engage qualified counsel.