Does the CRA require an incident response plan?

Not on the pages that set out an electronic filer's and a representative's responsibilities. What those pages require is that you protect the confidentiality of client information and of your filing credentials, that you stay current on security practices, and that you tell the CRA immediately about any loss or suspected loss of client information obtained through electronic filing. The last one is a notification duty with no plan behind it unless you write one.

When should a practice run this?

Between June and October. The people you need are hardest to get from February to May, and an exercise scheduled into tax season is easy to cancel. Book it when the same people would be available for a partners' retreat.

We are a small practice. Is this proportionate?

The obligations do not scale down with headcount. What scales down is the session: fewer people, one scenario, the same written record at the end.

Cybersecurity tabletop exercises for accounting firms in Canada

Same three hours, same room, one extra party. An accounting practice answering to a cyber incident may have the CRA to call as well as a client, an insurer and possibly a privacy commissioner, and the CRA asks to be told immediately, on a suspected loss rather than a confirmed one. The scenario that fits best is a compromised mailbox or credential during filing season, because it puts the firm’s obligations to many clients at once into a single decision.

Who asks an accounting firm about incident response?

Three parties, and they want different things.

The CRA, first, because the terms of participation in electronic filing carry security obligations. Electronic filers are told to Stay up-to-date on security best practices and take proper care to protect the confidentiality of taxpayer information and to use only the filing number and password issued to them, kept confidential (Canada Revenue Agency, EFILE eligibility and responsibilities, 2026). The CRA states that it monitors the activities of electronic filers, and it can revoke an authorization for failure to protect the confidential information obtained to electronically file the returns of your clients or for failure to protect the confidentiality of the filing number and password.

Then there is the duty that is easy to miss. The CRA asks filers to Let us know immediately of any loss, suspected loss, or unauthorized disclosure of client information obtained through electronic filing (Canada Revenue Agency, EFILE eligibility and responsibilities, 2026). Immediately, on suspicion, not on confirmation. Authorized representatives separately agree to ensure the security and privacy of all transactions you conduct on behalf of the taxpayer(s) (Canada Revenue Agency, Responsibilities of authorized representatives, 2026).

Second, your insurer, whose application can ask whether the plan has been tested (Beazley Cyber Application, Canada, 2026).

Third, any client that asks, particularly one with its own audit or questionnaire obligations.

Which scenario fits a firm, and why does tax season change it?

A credential or mailbox compromise, discovered during filing season.

It fits because of the blast radius. A practice’s filing credentials and client correspondence reach the tax affairs of many clients at once, so one compromised account is not one client’s problem. It fits because the notification duty triggers on suspicion, which means the room has to decide whether to call the CRA before anybody knows the extent. And it fits because a partner personally checking something is the control least available in March.

Tax season changes three things: nobody is free, every delay has a filing deadline behind it, and the temptation to keep working through an incident is at its highest. Run the exercise outside that window and make the scenario happen inside it.

Who has to be in the room, and who holds the answer?

Role	What only they can answer
Managing partner	Whether the practice stops filing while the compromise is scoped
Tax practice lead	Which clients and which deadlines are exposed
Whoever administers filing credentials	What was reachable from the compromised account, and how fast access can be cut
Payroll or client funds, if the practice handles either	Whether money could have moved
One technical lead	What the logs can and cannot show

Whoever administers the credentials may be junior, and in this scenario they can hold the most consequential answer in the room.

What does the report have to survive?

Three readers, each wanting something different from it.

For the CRA, a practice that has already decided who calls and how fast is ready to report immediately, as the agency asks, rather than reconstructing a timeline after the fact. That matters because the agency states that it monitors filer conduct and reserves the right to withdraw the ability to file.

For the insurer, a dated report naming the scenario, the roles present and the findings, which is what backs up a yes to the application’s testing question.

For the practice itself, a decision already made about the hardest call: whether to notify on suspicion, before you know how bad it is. That call is much easier in June than in March.