Managed IT for Accounting & Tax Firms
IT for CPA and tax practices built around the Safeguards Rule and tax season: a written security plan, multifactor sign-in everywhere, encrypted devices, and systems that hold up in April.
Overview
Tax preparers are regulated on security, whatever their size.
Under the Gramm-Leach-Bliley Act, the FTC treats tax preparers and many accounting firms as financial institutions, and its Safeguards Rule requires a written information security program: a qualified person in charge, a risk assessment, multifactor authentication, encryption of customer information, staff training, vendor oversight and an incident response plan. The IRS points practitioners to the same controls in Publication 4557 and expects a written information security plan.
The other constant is the calendar. A slow server in July is an annoyance; in the second week of April it is lost revenue. We plan upgrades, replacements and major changes for the quiet months, and treat tax-season problems as the priority they are.
Capabilities
What's included
- Written information security planA plan that describes the controls you actually run, kept current as the firm changes.
- Multifactor sign-in everywhereMicrosoft 365, remote access, tax software portals and admin accounts, enforced rather than optional.
- Encrypted, managed devicesEvery laptop and desktop encrypted, patched and monitored, with a report per device.
- Secure client file exchangeA portal or encrypted sharing in place of attachments, so returns and statements are not sitting in inboxes.
- Backup with tested restoresWorkstations, servers and cloud data backed up daily, with restores tested before the season starts.
- Staff training and offboardingPhishing simulations, completion records and same-day removal of access for seasonal staff when they leave.
How We Work
Our approach
- 01
Assess
The Safeguards Rule elements checked against what the firm runs today.
- 02
Close the gaps
MFA, encryption, backup and access fixed first, ahead of the next filing season.
- 03
Run
Monitoring, patching and help desk all year, with change frozen during peak weeks.
- 04
Review
An annual review of the plan, the risk assessment and the controls behind them.
What You Get
Commitments
A security plan that matches the controls in place.
Enforced on every account that reaches client data.
Per managed device, month to month.
To Get Started
What we need from you
- The tax, accounting and portal software the firm uses
- How many permanent and seasonal staff need devices and accounts
- Any existing security plan or insurer questionnaire
Common Questions
Questions we get asked
Does the FTC Safeguards Rule really apply to a small tax practice?
In most cases, yes. The FTC treats paid tax preparers as financial institutions under the Gramm-Leach-Bliley Act, and the Safeguards Rule applies to them. A few of its requirements, such as some written reporting, are relaxed for firms with fewer than five thousand customers, but the core controls, including multifactor authentication, encryption and a written program, apply regardless of size.
Can you write our written information security plan?
We write it with you. The plan has to describe your firm: who is responsible, what client data you hold and where, which controls protect it and what happens if something goes wrong. We draft it from the controls we run, you review and adopt it, and we keep it current. A downloaded template that does not match reality is worse than useless in an investigation.
Will you make changes during tax season?
As few as possible. Upgrades, migrations and hardware replacements are scheduled for the months after the deadlines, and we freeze non-urgent changes during peak weeks. Security patches still go out, because an unpatched machine in April is a bigger risk than a reboot, but they are tested first and scheduled outside working hours.
Do you support tax and accounting software?
We support the devices, network, backups and sign-ins that tax and accounting applications depend on, whether they are installed locally, hosted or fully in the cloud, and we work with the software vendor on issues inside the application. Part of onboarding is documenting every application, who has access to it and how it is backed up.
Tell us how
your season runs.
Tell us how many people and devices you have and what rules you answer to. We respond within one business day with a scope and a monthly price.