Antivirus for Tax Preparers
Security Six requirement #1: Every device that accesses client tax data must have active antivirus protection. Here’s what the IRS expects and how to choose the right solution.
Why antivirus matters for tax preparers
Tax preparers store some of the most valuable data criminals can steal: Social Security numbers, bank account details, employer identification numbers, and complete financial histories. A single infected device can compromise hundreds of client records.
IRS Publication 4557 requires antivirus software on all devices used to process, store, or transmit taxpayer data. This includes desktops, laptops, and any mobile devices used for work. The software must be kept current with automatic updates enabled.
Antivirus vs. EDR: what’s the difference?
Traditional antivirus detects known malware signatures. Endpoint Detection and Response (EDR) goes further — it monitors behavior, detects zero-day threats, and can automatically isolate infected devices. For tax practices, EDR is the recommended standard because tax-targeted attacks often use custom malware that traditional antivirus misses.
What to look for in antivirus for your tax practice
Real-time scanning
Continuously monitors files, downloads, and email attachments. Blocks threats before they execute.
Automatic updates
Virus definitions must update automatically. Manual updates leave gaps that attackers exploit.
Centralized management
For multi-user offices, you need a dashboard to verify all devices are protected and up to date.
Ransomware protection
Specific ransomware detection and rollback capabilities. Tax season ransomware attacks are increasingly common.
Antivirus for tax preparers — FAQ
Windows Defender provides basic protection and technically meets the IRS minimum requirement. However, for tax practices handling sensitive financial data, a dedicated business-grade antivirus or EDR solution offers significantly better protection, centralized management, and the detailed logging the FTC Safeguards Rule requires.
If you use your phone to access client data — email, tax software, cloud storage — then yes. The IRS requirement covers all devices that process, store, or transmit taxpayer data. Mobile device management (MDM) solutions can provide antivirus, encryption, and remote wipe capabilities.
Real-time protection should run continuously. Full system scans should run at least weekly, preferably daily during tax season when attack volume increases. Schedule scans during off-hours to avoid impacting performance during client work.
From requirement to defensible practice
Turn IRS and FTC expectations into a WISP your office can follow
A useful compliance path makes the obligation clear, identifies the evidence to retain, and connects written policy to the safeguards used every day.
- Know what applies
- Document the evidence
- Make the safeguard operational
A defensible path
- 01
Confirm the requirement
Separate what is required from recommendations and vendor language.
- 02
Map it to your environment
Connect the rule to people, devices, data, vendors, and current procedures.
- 03
Close and document the gaps
Prioritize changes and keep evidence that the process is being followed.
People also look for
Keep exploring Tax security & WISP
Understand what tax professionals need to document, protect, and prepare before an IRS or FTC review.
- Common question: free WISP templateStart with a written information security planUse a practical WISP framework built around the safeguards tax practices need.
- Common question: IRS Publication 4557 requirementsRead the Publication 4557 guideSee how the IRS expects tax professionals to safeguard taxpayer data.
- Common question: IRS WISP requirementsReview the WISP requirementsWork through the required sections and the evidence your practice should retain.
- Common question: FTC Safeguards Rule checklistUse the FTC Safeguards checklistTranslate the rule into a clear list of security and documentation tasks.
- Common question: tax practice incident response planPrepare a tax-office incident planKnow who to contact, what to preserve, and how to respond to a client-data incident.