Accounting and CPA firms hold Social Security numbers, bank details and years of tax returns, and the workload peaks during filing season. We help firms of every size, anywhere in the U.S., choose and manage the internet, phones, security and IT that keep client data safe and the practice moving.
If your firm prepares tax returns, the FTC Safeguards Rule requires a written information security program. The IRS calls it a written information security plan, or WISP, and publishes a free template in IRS Publication 5708. The hard part is making the plan match how your computers, accounts and software are actually set up.
The Safeguards Rule calls for multi-factor authentication for anyone who signs in to systems that hold client information, and the IRS includes it in the Security Six, its list of basic protections for tax professionals.
Wage statements, bank statements and finished returns should travel through an encrypted client portal or encrypted email, not ordinary attachments. The Safeguards Rule also expects client information to be encrypted when it is stored and when it moves over the internet.
Fake new-client emails and messages pretending to be from the IRS or a tax software company are a common way criminals get into a firm's systems. Email filtering, staff training and a rule to confirm any change in bank or payment details by calling a number you already have on file greatly reduce the risk.
Cloud tax software, e-filing and client portals all depend on the internet, so an outage in deadline week is a real problem. A second internet line from a different provider takes over automatically if the first one fails.
Clients call most as deadlines approach. Calls should ring a queue or the right preparer, reach staff working from home and go to voicemail to email instead of a full mailbox.
Tap a glowing spot to see what goes there and the questions we ask tax and accounting firms. Add the ones that apply to your list.
Your main internet line plus a backup from a different carrier, so e-filing and cloud tax software keep working if one line drops.
Nothing yet. Add the spots that apply.
The Safeguards Rule lists accountants and other tax preparers in the business of completing income tax returns among the financial institutions it covers. Since May 2024, it also requires notifying the FTC as soon as possible, and no later than 30 days after discovering a breach involving unencrypted information of 500 or more people (16 CFR 314.4(j), in effect since May 13, 2024).
Criminals go after tax professionals to steal client data they can use to file fraudulent returns. The IRS regularly warns preparers about these scams and asks firms to report any theft of client data to their IRS Stakeholder Liaison.
When email, the client portal or tax software goes down in the weeks before a deadline, work stops and clients cannot reach you. Smaller firms often feel it most because they have no in-house IT team to call.
Help desk, Microsoft 365 administration, multi-factor sign-in, 24/7 endpoint detection and response, and backups, managed for you with committed response times.
See Managed IT →Find where your firm is exposed, from email and browsers to the internal network. An advisor reviews your current setup with you and gives you a shortlist of options.
Start a free security assessment →Security options from providers such as Cloudflare and Red Access protect email, web traffic and browser sessions without slowing your team down.
See security options →We check the carriers that serve your office, then pair a primary line with a backup from a different provider so one outage does not stop work in tax season.
Compare business internet →If your firm prepares tax returns, it most likely does. The rule lists accountants and other tax preparers that complete income tax returns among the businesses it covers. Firms that keep client information on fewer than 5,000 people are exempt from some parts, such as the written risk assessment and incident response plan, but still need a written security program (16 CFR 314.6). Your attorney can confirm how it applies to you.
The PTIN application and renewal asks paid preparers to confirm they know the law requires them to create and maintain a written information security plan. That form is Form W-12. The IRS also recommends six basic protections it calls the Security Six: anti-virus software, firewalls, multi-factor authentication, backups, drive encryption and a virtual private network (VPN).
Before filing season opens, if you can. New computers, software updates, account clean-ups and a test restore of your backups are far easier then than in the middle of the season.
No. We are based in New Jersey and work with firms anywhere in the U.S. and internationally, whether they have one office or offices in several states or countries. We compare providers, review contract terms and plan setup remotely, and the providers you choose handle installation at your offices.
Yes. Co-managed IT keeps your in-house IT person in charge of what they do well and adds our endpoint security, backups, after-hours coverage and escalation support where you need them.
Nothing. The first call is free, takes about 15 minutes, and you leave with a clear picture of your options and no obligation.