Most IT companies sell the same bundle to a dental office, a law firm and a tax practice. A CPA firm has different pressures: client Social Security numbers and bank details, software that must work on April 14, and federal rules about how all of it is protected.
Here is what a well run accounting firm has in place, grouped from must-have to nice-to-have.
1. The baseline: the IRS Security Six
IRS Publication 4557 lists six protections every tax professional should have. They are the floor, not the ceiling.
| Protection | What it looks like in a small firm |
|---|---|
| Antivirus | Endpoint detection and response (EDR) with a 24/7 security team watching alerts |
| Firewall | A business firewall with current security subscriptions, not the internet provider’s router |
| Multi-factor authentication | On email, tax software, the client portal and remote access |
| Backup | Encrypted, offsite copies that ransomware cannot delete, with restore tests |
| Drive encryption | BitLocker or FileVault on every laptop and desktop |
| VPN | A secure connection for anyone working from home or a second office |
If any of these is missing, fix it before anything else on this list.
2. Email security
Most incidents at tax firms start with an email: a fake client request, a phishing link, or someone impersonating the firm to a client. A firm needs:
- Email filtering that catches impersonation and malicious links, not just spam.
- SPF, DKIM and DMARC records so no one can send email that appears to come from your domain. You can check yours with our free domain security grade.
- Security awareness training so staff recognize what slips through.
3. Help desk and day-to-day management
Security tools only work if someone keeps them running. Day-to-day IT for an accounting firm means:
- Patching Windows and tax software on a schedule that avoids filing deadlines.
- A help desk your staff can call, with someone who already knows your setup.
- Microsoft 365 administration: users, licenses, sharing settings and mailbox retention.
- Onboarding and offboarding, including seasonal preparers who need access from January to April and none after.
4. Tax software support
Drake, UltraTax CS, Lacerte, ProSeries and CCH all have their own quirks: network data paths, workstation installs, annual updates and multi-user locking. Your IT provider should install and update them, keep the data folder in the backup, and call the vendor for you. See which tax software we support.
5. A written security plan (WISP)
Paid tax preparers are required to keep a Written Information Security Plan. IT puts the safeguards in place; the plan documents them, names a Qualified Individual and describes what happens after an incident. Our sister firm, Sunesis Services, writes and maintains WISPs.
6. Planning and reporting
Once the basics run, the value shifts to planning: replacing hardware before it fails in March, budgeting for next year, and a monthly report that shows what was done in plain English. This is where a provider who understands a firm’s finances earns its fee.
What a firm can skip
Small firms rarely need a full-time IT employee, a server room, or a 24/7 help desk. Business-hours support with 24/7 security monitoring covers almost every accounting practice we see.
Where to start
If you are not sure where your firm stands, start with the six protections in section 1. Our IT assessment checks all of them on-site in Spokane, Coeur d’Alene and North Idaho and gives you a written list you keep either way.