If your firm is covered by the FTC Safeguards Rule, as tax, accounting and many small financial firms are, you must give your staff security awareness training. The rule doesn't set a schedule. The IRS template most tax firms use says to train at least once a year, and before any new hire touches client data.
The rule ties training to your own risk assessment, so it should spend its time on the risks your firm actually faces. In a tax office that usually means phishing emails posing as the IRS, your tax software or a new client. It also means safe ways to send client files, multi-factor authentication, and exactly who to tell when something looks wrong.
Training covers everyone with access to client data, including the front desk and seasonal staff. And it has to be provable. Signed, dated acknowledgments after each session, like Attachment D in the IRS template, are the simplest record that training happened.
What the rule requires
The requirement is one line in 16 CFR 314.4(e). You must provide "your personnel with security awareness training that is updated as necessary to reflect risks identified by the risk assessment."
Two things in that sentence matter. It covers your personnel, so not just the preparers but the front desk, the bookkeeper and the seasonal help. And it ties the content to your own risk assessment. If your biggest risk is fake client emails during filing season, that's what the training should spend time on.
The same paragraph also requires qualified people to run your security program, either on staff or through an outside provider, and requires those people to keep their own knowledge current. For most small firms, that second part is the IT company's job.
This applies at any size. The 5,000-consumer exception in 16 CFR 314.6 lets smaller firms skip some written documents, but training isn't one of them.
How often to train
The Safeguards Rule names no frequency. The IRS fills that gap for tax and accounting firms. The training policy in Publication 5708, the IRS's written security plan template, says the Data Security Coordinator "will conduct training regarding the specifics of paper record handling, electronic record handling, and Firm security procedures at least annually." It adds that "all new employees will be trained before PII access is granted."
Publication 4557 says to "provide security awareness training and schedule regular refreshers."
Here's how the three sources line up.
| Source | What it says about training | How often |
|---|---|---|
| FTC Safeguards Rule, 16 CFR 314.4(e) | Security awareness training, updated to reflect the risks in your risk assessment | No schedule set |
| IRS template, Publication 5708 | Paper and electronic record handling and firm security procedures | At least annually, and before new hires get access |
| IRS guide, Publication 4557 | Every employee educated on phishing, plus regular refreshers | No schedule set |
If your written plan says annual training, then annual training is the standard you've signed up to. Put it on the calendar. A good time is right before filing season, when new and seasonal staff start and phishing picks up. Publication 5708 suggests the start of tax season as a good moment for a security staff meeting, with topics like "how phishing emails work" and "phone call grooming by a bad actor."
Many small businesses don't do even this much. In a 2026 Nationwide survey, 72% of small business owners, meaning firms of 1 to 50 employees, said they provide formal cybersecurity training at least once a year. That compares with 95% of mid-market owners (Nationwide Cybersecurity Survey 2026).
What to cover
The IRS publications give you most of the syllabus. Here's what a tax or accounting office should cover, with where each piece comes from.
Phishing. Publication 4557 says "all employees in your office must be educated on the dangers of phishing scams." Teach staff that thieves pose as your tax software provider, your cloud storage provider, the IRS, a bank, a colleague whose email was hacked, or a new client. These emails usually have an urgent subject line and a link or attachment. Teach them never to open attachments from unknown senders, "including potential clients," without making contact some other way first. Suspicious emails that claim to be from the IRS go to phishing@irs.gov.
Checking links and callers. Publication 5708's sample rules of behavior say to hover over a link to see where it really goes, and to call the sender to confirm before opening anything unexpected. They also cover social engineering by phone. Never give out a username or password, and report any call asking for sensitive information.
Passwords and multi-factor authentication. Unique passwords, never shared between employees, and multi-factor authentication wherever it's offered. Staff should also know to report a login code they didn't request.
Sending client data. No client data in a plain email. If a file is password protected, the password goes by a different route, like a phone call. Use the firm's approved portal.
Devices. Keep personal and business devices separate. Don't plug in unknown USB drives. Lock the screen when you step away.
Paper. Lock up files containing client data when you leave your desk. Shred, don't toss.
What to do when something looks wrong. This is the part most training skips. Every employee should know the signs of a breach that Publication 4557 lists, like rejected e-files because a return was already filed, or a cursor moving on its own. And they should know exactly who to tell, right away. Speed is what lets the IRS block fraudulent returns (IRS data theft information).
Phishing training for staff
Telling people about phishing helps. Showing them works better. Some firms run simulated phishing emails, harmless fakes that show who clicks, so the follow-up training goes to the people who need it. The Safeguards Rule doesn't require simulations, and neither IRS publication sets a schedule for them.
They're less common at small firms. In the same Nationwide survey, 30% of small business owners said they run phishing tests at least every few months, against 65% of mid-market owners (Nationwide Cybersecurity Survey 2026).
If you do run them, treat a click as a training moment, not a disciplinary one. You want people reporting suspicious emails, not hiding mistakes.
Keep proof that training happened
Training you can't prove is hard to defend. That matters if a regulator or an insurer ever asks what your plan promised and what you actually did. Our guide to cyber insurance requirements covers what carriers ask for.
Publication 5708 builds the proof in. Its Attachment D is an Employee/Contractor Acknowledgement of Understanding that each person signs and dates after training. The template says these should be "updated at annual training intervals and kept on file," and calls signed training "a good documentation trail." Under the template's coordinator duties, every attendee also certifies their attendance.
Keep a simple folder for each year with these items.
- The date, who attended and who ran it
- What was covered, even a one-page outline
- Signed acknowledgments for every attendee
- Phishing test results, if you run them
- Training records for anyone hired mid-year, dated before their access start date
That last one is easy to miss. Seasonal staff often start in January, after the annual session. They still need training before they get access.
Where this fits in your plan
Training is one section of your written information security plan. If you're building the plan from the IRS template, see our WISP template guide. For the legal side, see the FTC Safeguards Rule guide and IRS Publication 4557.
Our free security check gives you a plain score on training and the other basics, and it can match you with one IT company that works with firms like yours.