What Are the Security Requirements for an Accounting Firm CRM?

Your accounting firm's CRM needs multi-factor authentication for everyone who accesses client information, access limited by role, and backups kept on a secure external source. IRS Publication 4557 instructs tax professionals to implement MFA for anyone accessing customer information on their systems. It also recommends backing up sensitive data to a secure external source that is not continuously connected to a network.

This guide turns those rules into a setup checklist you can hand to your IT admin. Menu names differ in every CRM, so the steps below describe the settings to find rather than exact clicks in one product.

What do IRS Publication 4557 and the FTC Safeguards Rule expect from your CRM?

The IRS provides Publication 4557 as an overview of tax professionals' legal obligations to protect taxpayer information and as a checklist for creating and maintaining a security plan, according to the IRS identity theft page for tax professionals. The IRS also identifies Publication 4557 as a resource for understanding and complying with the FTC Safeguards Rule, as stated in IRS Issue Number 2026-22.

Your CRM holds names, contact details, engagement notes, and often documents. That makes it an information system under your written information security plan (WISP). Three settings carry most of the weight:

1. MFA on every login.
2. Role-based access, so each person sees only what the job requires.
3. Backups stored on a secure external source.

If you are still choosing software, see our page on CRM for accountants and the side-by-side comparison of all 18 CRMs.

How do you enforce MFA in your CRM?

The IRS describes MFA as a username and password plus one or more additional items, such as a security code sent to a mobile phone. Use this sequence:

1. Open the admin security settings. Look for a section named Security, Authentication, or Login Policies.
2. Turn on the organization-wide MFA requirement. A per-user opt-in leaves gaps, so choose the setting that applies to all users.
3. Choose the second factor. A code sent to a mobile phone is the IRS's own example.
4. Apply it to every account type. That includes partners, staff, seasonal preparers, and any contractor with a login.
5. Test with a new user. Create a test account and confirm the CRM prompts for the second factor.
6. Record it in your WISP. Write down the setting, the date, and who verified it.

The IRS recommends using MFA wherever it is offered, particularly for cloud-storage and email providers. Turn it on for your email and file storage too, not only the CRM.

IRS guidance also recommends multiple forms of identity verification for any system or application containing sensitive information. Your CRM qualifies.

Is MFA legally required for tax preparers using cloud CRM software?

Publication 4557 instructs tax professionals to implement MFA, and the IRS recommends it wherever it is offered. The IRS WISP guide, Publication 5708, says MFA must be implemented for any individual accessing an information system. The one exception is when a qualified individual approves reasonably equivalent or more secure controls in writing.

We did not find a single federal statute that names MFA in a cloud CRM specifically, so we do not claim one. Treat MFA as a firm requirement in your WISP. If you ever skip it for a system, get the written approval first and keep it on file. Your attorney or compliance advisor can tell you how your state and your engagements apply.

How do you set up role-based access for seasonal tax preparers in a CRM?

Give each seasonal preparer a unique login and only the permissions the job needs. Intuit's security white paper describes least-privilege access, including limiting backup personnel to only the rights needed for backup duties. Apply the same idea to seasonal staff.

A typical setup for a firm that adds temporary preparers each filing season:

1. List the duties. For example, a seasonal preparer enters intake data for assigned clients, and a seasonal receptionist books appointments.
2. Create one role per duty set. Name them clearly, such as "Seasonal Preparer" and "Seasonal Front Desk."
3. Restrict records. Limit each role to assigned clients or a specific pipeline stage, if your CRM supports record-level rules.
4. Block bulk actions. Remove export, mass delete, and bulk email rights from seasonal roles.
5. Create named accounts only. Never share one login across several temporary workers.
6. Require MFA at the first login. Do this before the person touches any client record.
7. Set an end date. Put the access removal date on your calendar when you create the account, and disable the user the day the engagement ends.

Your CRM's permission model decides how fine these controls can be. Ask the vendor whether it supports custom roles, record-level restrictions, and an activity log before you buy.

How do you configure encrypted, automated backups?

Publication 4557 recommends backing up sensitive data to a secure external source that is not continuously connected to a network. The publication does not set a backup frequency, a retention period, or a restore-testing schedule, so your WISP has to define those. Choose them based on how much work your firm could afford to redo.

Use this checklist with your CRM vendor or IT provider:

1. Find the backup setting. Check whether the CRM backs up automatically or needs you to schedule exports.
2. Ask about encryption in writing. Ask whether backups are encrypted and who holds the keys, and keep the answer with your vendor records.
3. Keep a copy on a secure external source. It should not be continuously connected to your network.
4. Limit who can run or read backups. Give that duty to as few people as possible.
5. Test a restore. Pick a schedule, write it in your WISP, and log each test.

What do the penalties look like for non-compliance?

The sources we rely on do not state a dollar penalty for accounting firms that fall short of the FTC Safeguards Rule, so we do not quote one. Ask your attorney what exposure applies to your firm's services and structure. What you can control today is documentation: a current WISP, a dated MFA setting, and a role list.

Does QuickBooks Online provide enough security to act as a standalone CRM?

QuickBooks Online lists several security controls, but these are Intuit's product claims. They do not show that your whole WISP, incident response, vendor management, and staff training are covered. We also did not find a source stating that QuickBooks Online alone works as a standalone CRM for an accounting firm. For that comparison, see our QuickBooks CRM page.

Control	What Intuit states
Backups	QuickBooks Online states it backs up data automatically and provides automatic offsite storage. Users can download a local copy of their data.
Point-in-time restore	QuickBooks Online Advanced states it continuously backs up company books in the background and can restore data to a specific point in time.
Passwords and permissions	Each invited user must create a unique password, and administrators can use multiple permission levels to limit access.
Custom roles	QuickBooks Online Advanced administrators can manage access using custom roles and permissions.
MFA	Intuit documentation says account protection includes mandatory MFA on unrecognized devices and optional two-step verification for every login.
Other controls	Intuit lists SSL encryption, MFA, password-protected logins, firewall-protected servers, audit trails, and activity logs.

One detail matters for your WISP. Intuit describes the MFA prompt as mandatory on unrecognized devices and the every-login option as optional. If your plan requires MFA for every access, turn the optional two-step verification on for every user. Intuit's white paper says QuickBooks Online provides granular role-based security that lets authorized users decide who can access data and what privileges each user receives.

What should you check before you sign with a CRM vendor?

• Can an administrator require MFA for all users, with no per-user opt-out?
• Does it support custom roles, so seasonal staff get fewer rights than permanent staff?
• Does it keep audit trails or activity logs you can review?
• Does it back up automatically, and can you keep a copy on a secure external source?
• Will the vendor answer your encryption questions in writing?

Our how we pick page explains how we evaluate tools. Run every candidate through this list, then write the answers into your WISP.