In a hurry? Get your free Compliance Score, then come back to this guide.
Take the Free Quiz View Sample WISPEvery January, many tax practices add seasonal preparers who need access to client files right away — and who leave a few months later. Under the FTC Safeguards Rule and IRS Publication 5708, those hires and departures are part of your written information security plan. This guide walks through securing seasonal staff from before day one to after their last day, and ends with a one-page checklist you can print.
Why tax season is a security risk
Tax season stacks three risks on top of each other: new people who don't yet know your procedures, far more client documents moving through the office, and peak phishing season, when criminals impersonate clients, the IRS, and software vendors. A rushed onboarding — a shared password, an account without MFA, broad access "just to get started" — is exactly what an attacker looks for.
Before day one
- Individual accounts. Every person gets their own login. Never shared logins, even for a few weeks.
- MFA enrolled before access. Set up multi-factor authentication before the account can reach email, tax software, or client files.
- Least access. Give access only to what the role needs. A preparer working individual returns doesn't need payroll or partner folders.
- Security training. A short session on phishing, MFA, and where client data may go — completed and dated before they start.
- Signed acknowledgment. Have each person sign that they've read and will follow your WISP.
During the season
- Watch for phishing. Remind staff to verify unexpected requests for documents, password resets, or payment changes by calling a known number.
- No client data in personal email. Client documents stay in your approved systems and portal.
- No unapproved devices. Personal laptops, phones, and USB drives don't connect to client data unless your WISP approves and secures them.
When the season ends
- Disable accounts on the last day — email, tax software, cloud storage, and anything else they logged into.
- Recover devices — laptops, phones, security keys, and office keys.
- Revoke software licenses and portal access — including e-signature and client portal accounts.
- Check for forwarding rules that send mail to a personal address, and remove them.
One of the most common gaps I find is a former employee whose account still works months after they left. It's rarely intentional — the season ended, everyone was tired, and offboarding never got scheduled. Put it on the calendar before the season starts.
Update your WISP
Every hire and departure is a reason to review your WISP. Record who joined, what access they had, when training and acknowledgment were completed, and when access was removed. Those dated entries are the evidence that your plan matches reality — and they make your annual WISP review much faster.
One-page checklist
Seasonal Staff Security Checklist
Onboarding
- Individual account created (no shared logins)
- MFA enrolled before any access
- Access limited to what the role needs
- Security training completed and dated
- Signed acknowledgment of the WISP
- Approved devices issued and recorded
Employee: ____________ Date: ________ Completed by: ____________
Offboarding
- Accounts disabled on the last day
- Laptops, phones, and keys recovered
- Tax software licenses revoked
- Client portal and e-signature access removed
- Email forwarding rules checked and removed
- WISP updated and change dated
Employee: ____________ Date: ________ Completed by: ____________
Frequently asked questions
Do seasonal employees need security training?
Yes. The FTC Safeguards Rule's training requirement covers everyone who handles customer information, including temporary and seasonal staff. Keep it short and practical — phishing, MFA, where client data may and may not go — complete it before the person gets access, and record the date.
How fast should I disable a seasonal employee's account?
On their last day. Plan it before the season starts so disabling accounts, recovering devices, and removing portal and software access happen as a routine step, not weeks later when someone remembers.
Can seasonal staff share a login?
No. Every person needs their own account. Shared logins make it impossible to enforce MFA per person, to see who accessed which client file, or to remove one person's access without affecting everyone else.
Sources & References
Primary regulatory and standards sources used throughout WISPWolf's compliance guidance.
Get the free WISPWolf Compliance Starter Kit
Download the starter kit and identify your compliance gaps. Includes an IRS WISP starter template (not a completed customized WISP), FTC Safeguards Rule checklist, GLBA checklist, risk assessment worksheet, cyber insurance guide, and tax preparer compliance checklist.
Get Your Free WISP Compliance Score
See how your firm's security practices compare to FTC Safeguards Rule and IRS WISP expectations. Answer 15 questions and get a personalized scorecard in minutes.
IRS Pub 5708 Compliant · FTC Safeguards Rule · AES-256 Encrypted · No Credit Card Required