Accounting and CPA firms sit on a concentrated pile of exactly what attackers want: Social Security numbers, bank details, payroll records, and signed authorizations for hundreds or thousands of clients. And unlike most businesses, your operational load is not evenly distributed — a system that works fine in September can fall over in February when every workstation, every scanner, and every tax package is running at once.
If you are evaluating I.T. support for an accounting firm, these are the areas that matter most, roughly in the order we would address them.
1. Written Security Plan Requirements
Under the FTC Safeguards Rule, tax preparers and other financial institutions are required to maintain a Written Information Security Plan. The IRS also asks preparers to attest to having one. Many firms discover this obligation during a PTIN renewal or an insurance application rather than during planning.
A usable plan is not a template with your name pasted in. It names a responsible individual, describes your actual controls — encryption, access control, MFA, logging, vendor management — and gets reviewed as the environment changes. Whoever supports your I.T. should be maintaining the technical evidence that backs it.
2. Multi-Factor Authentication Everywhere, Not Just Email
Business email compromise remains the most common way client data leaves an accounting firm. An attacker who gets into a partner's mailbox does not need malware — they read the thread, wait for a wire instruction, and change the account number.
MFA on Microsoft 365 is the baseline. The gap we most often find is everything else: remote desktop access, the tax software portal, the document portal, and the VPN. Those need to be behind the same identity controls, ideally with conditional access rules that flag logins from unexpected locations.
3. Secure Client File Exchange
Clients will email you a W-2 as an attachment unless you make the alternative easier than email. A managed document portal with per-client folders, expiring links, and an audit trail solves three problems at once: it keeps unencrypted PII out of inboxes, gives you a record of who accessed what, and stops the annual scramble to find which version of a return was actually sent.
4. Performance and Capacity Planning for Busy Season
Tax and audit applications are demanding, and many are still latency-sensitive when run against a shared data file or a hosted session. Capacity planning should happen in the fall, not in the third week of a filing crunch. That means reviewing workstation age, memory, and disk type; validating that your internet circuit and firewall can handle every remote session at once; and confirming your scanning and multifunction workflow is not the bottleneck.
It also means agreeing in advance on response expectations during peak weeks. A four-hour response window that is tolerable in July is not tolerable on April 14.
5. Backups You Have Actually Restored
Ransomware recovery is a backup problem, not a security-tool problem. The questions to answer before you need them: how much work would we lose in the worst case, how long would a full restore take, are backups stored where an attacker with domain access cannot delete them, and when did someone last perform a test restore and document the result?
6. Clean Onboarding and Offboarding
Firms that scale up with seasonal staff accumulate orphaned accounts fast. Every temporary preparer and intern should be provisioned from a documented template and fully disabled on a defined end date — accounts, mailbox access, portal access, MFA tokens, and hardware return all tracked in one place.
Where to Start
If you are picking one thing: get MFA in place across every system that touches client data, then confirm your backups restore. Those two controls prevent the majority of incidents that turn into client notification letters.
Trusted Cyber provides managed I.T. and cybersecurity for accounting and financial firms across the United States. Learn more about how we support financial and accounting firms, or review our managed cybersecurity services.
Request a complimentary consultation before your next busy season.