Industries
Accounting & Tax Firms
If you are a paid tax preparer, a written information security plan is not optional — and most firms discover this the first time somebody asks to see it.
What makes this different
The problems specific to your sector
Not a generic list. These are the things that come up repeatedly in this kind of business.
Tax season concentrates everything
Ten weeks carry the year's revenue. An outage in March is not comparable to an outage in August, and neither is a ransomware event.
You hold exactly what identity thieves want
Social security numbers, dependants, bank details and income for hundreds of households, in one place.
Seasonal staff, permanent access
Temporary preparers get accounts in January and often still have them in September because nobody owns offboarding.
Client document exchange by email
Clients email W-2s and statements because it is easy. Without a secure portal that habit is very hard to break.
Compliance
What you are actually required to do
Named obligations rather than the word 'compliance'. If one of these does not apply to you, we will say so.
IRS Publication 4557
Requires paid preparers to have a written information security plan and safeguard taxpayer data.
FTC Safeguards Rule
Applies to tax preparers as financial institutions: named security lead, risk assessment, MFA and encryption.
IRS e-Services requirements
Account protection and prompt reporting of data theft incidents.
Your software
We expect to find these
We work around your line-of-business software rather than asking you to change it, and we deal with the vendor when needed.
- UltraTax
- Lacerte
- Drake Tax
- ProSeries
- QuickBooks
- Sage
- Secure client portals
Recommended
Where we would start
Compliance Support
The technical controls and evidence trail behind HIPAA, PCI DSS and cyber-insurance questionnaires.
Cybersecurity Services
Layered defence built around how small businesses actually get breached: email, credentials and unpatched endpoints.
Backup & Disaster Recovery
Backups that are tested on a schedule, with a recovery time you have actually seen demonstrated — not assumed.
Managed IT Services
Proactive monitoring, patching and unlimited help desk for a flat monthly fee — so problems are fixed before they reach your staff.
Questions
Common questions
What is a WISP and do we really need one?
A Written Information Security Plan documenting how you protect taxpayer data — who is responsible, what the risks are and what controls exist. The IRS requires it of paid preparers, and the FTC Safeguards Rule reinforces it.
Can you get us ready before tax season?
Yes, and the work should be done well before January. Changing authentication and backup arrangements mid-season is exactly the wrong time.
How do we stop clients emailing us their W-2s?
Give them something easier than email — a portal link in your signature and on your website — then stop replying to the ones that arrive by email with anything other than the portal link.
Ready to secure your business?
A free assessment: we review your network, backups, Microsoft 365 settings and exposure, then hand you the findings in writing — whether or not you hire us.