IT Support for Accounting Firms That Can't Afford a Bad Week in April

The tax season crunch. From January to April there’s no good time for a computer to slow down, a printer to quit or a login to lock up. A small problem in July is a big problem in March.

Client portals and files everywhere. Returns, statements and scanned documents come in through portals, email and the occasional thumb drive. Keeping track of where client files live, and who can open them, gets messy fast.

Remote and seasonal staff. Partners working from home, preparers working late from the kitchen table, seasonal help who need access for a few months. Every one of those connections needs to be set up safely and shut off cleanly when the season ends.

Phishing that gets sharper around tax time. The IRS (Internal Revenue Service) warns that criminals go after tax professionals by email, phone and other tricks to steal passwords, e-Services logins and EFINs (Electronic Filing Identification Numbers), or even take remote control of a computer. One convincing email to the wrong person can do real damage.

The WISP question. Sooner or later someone asks about your WISP (Written Information Security Plan). It might come up on your PTIN (Preparer Tax Identification Number) renewal, or a tax software vendor or other business partner may ask whether you have one. Plenty of firms know they need one but aren’t sure where to start or whether what they have is still accurate.

The cyber insurance form. The application or renewal shows up with a long list of questions about how your systems are protected, and you’re not sure how to answer half of them honestly.

We keep the computers running so your people can keep working. Ongoing care for your computers, network and email, with a real person to call when something breaks. We like to get the house in order before the busy season starts, not in the middle of it.

We help lock down logins and files. Setting up multifactor authentication (MFA, a second step beyond a password, like a code on your phone), tightening who can reach client files, and helping make sure client information is encrypted, which means scrambled so it’s unreadable without the right key.

We make remote work safer. Secure ways for staff to connect from home, plus a clean process for adding and removing seasonal staff.

We help your team spot phishing. Practical, plain English training so your staff knows what a suspicious email looks like and what to do about it.

We help you write it down. The rules expect a written plan and written records. We help you document how your systems are actually set up and protected, so your WISP reflects reality and you have something solid to point to when a form or a vendor asks.

We help you answer the insurance form honestly. We’ll walk through the technical questions with you so your answers match what’s really in place.

This section is a plain English overview to help you understand what the rules ask for. It isn’t legal advice. For questions about what applies to your firm, talk with your attorney. Our role is to help you meet these requirements on the technology side and document the work. The responsibility for your program stays with your firm, and we don’t promise or guarantee compliance.

The FTC Safeguards Rule (16 CFR Part 314)

The FTC (Federal Trade Commission) Safeguards Rule is found at 16 CFR Part 314. CFR stands for the Code of Federal Regulations. The rule comes from a federal law called the Gramm-Leach-Bliley Act.

Who it covers. The rule applies to “financial institutions” under the FTC’s jurisdiction, and the definition is broader than it sounds. The rule itself lists tax preparation firms as an example, and says an accountant or other tax preparation service in the business of completing income tax returns is a financial institution. IRS Publication 5708 says tax and accounting professionals are considered financial institutions regardless of size. The FTC notes that some provisions don’t apply to institutions that keep customer information on fewer than 5,000 consumers, so it’s worth checking which parts apply to you.

What it asks for, in plain terms:

• A Qualified Individual. One person designated to oversee and run your information security program. This person can be your own employee or can work for an affiliate or a service provider. If it’s a service provider, the FTC says the responsibility still stays with your firm, and you need a senior person at your firm to supervise them.
• A written program. Your information security program has to be written down and fit your firm’s size, complexity, activities and the sensitivity of the information you handle.
• A risk assessment. A written look at what client information you have, where it’s stored, and what could realistically go wrong, revisited as things change.
• MFA. Multifactor authentication for anyone accessing customer information on your systems, unless your Qualified Individual approves in writing an equivalent or more secure kind of access control.
• Encryption. Customer information should be encrypted both when it’s stored and when it travels over outside networks. If that isn’t feasible, your Qualified Individual can review and approve other effective controls instead.
• Breach notice to the FTC. If there’s a “notification event” involving the unencrypted information of at least 500 consumers, you must notify the FTC as soon as possible, and no later than 30 days after you discover it. Notice goes through an online form on the FTC website.

The rule also covers things like training staff, keeping an eye on your service providers, testing your safeguards, a written incident response plan, and regular written reports from your Qualified Individual to the firm’s leadership. The FTC’s guide below walks through each piece.

IRS Publication 4557, Safeguarding Taxpayer Data

Publication 4557 is the IRS guide to protecting client data for tax professionals, from sole practitioners to large firms. It covers basic security steps, recognizing signs of data theft, responding to and recovering from a data loss, and understanding the FTC Safeguards Rule. It also points to Publication 5708 for help writing your security plan.

Your WISP (Written Information Security Plan)

The IRS and the Security Summit, a partnership of the IRS, state tax agencies and the private-sector tax industry, say plainly that tax professionals are required by law to have a WISP. Their guide, IRS Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice, includes a sample template and notes that a WISP should be scaled to your firm. A sole practitioner can use a simpler plan than a larger firm. The guide also says a WISP should be reviewed and updated regularly as your firm changes.

The Security Summit’s Taxes-Security-Together Checklist also recommends creating a data security plan along with basics like antivirus software, a firewall, two-factor authentication, backups, drive encryption and VPNs (Virtual Private Networks, which are secure connections for remote work).

PTIN renewal. On Form W-12, the IRS PTIN application and renewal form, there’s a line where you check a box to acknowledge that you’re aware paid tax return preparers are required by law to create and maintain a written information security plan. It’s a good reminder to make sure your plan is real and current before you check it.