CPA and tax offices
Keep client tax data safe and the Safeguards Rule handled.
The FTC Safeguards Rule covers tax preparation firms, including accountants who prepare returns. The rule asks less of a small firm than most owners think. We put the pieces in place and keep them current.
What the rule asks a small firm to do
In plain words. Firms with records on 5,000 or more people must write down a risk assessment and an incident plan. Smaller firms are exempt from those written items, the formal testing schedule, and the yearly report, but every firm still needs a security program with safeguards like the ones below.
Name a person responsible
The rule calls this the Qualified Individual. It can be you, with us doing the work behind it, or us, through the compliance point person add-on below once it reopens for sign-ups.
Turn on two-step login (MFA)
Anyone who can open client files, email, or tax software signs in with a code on their phone.
Encrypt client data
Laptops, backups, and files you send to clients are locked, so a lost device or an intercepted email doesn't expose anyone.
Control who can get in
Every person has their own login, former staff are shut off the same day, and client files are only open to the people who need them.
If you hold 5,000 or more records
We write the risk assessment and the incident plan with you, in a few pages that match how your office really works, and update them before tax season.
The nine things the Safeguards Rule names
The FTC lists nine elements of an information security program. For a small firm most of them are a short fixed-price project, and the written ones only apply at 5,000 or more records.
A Qualified Individual
One named person responsible for the program. It can be you, with the technical work done by us.
A risk assessment
Written for firms at 5,000 or more records. Smaller firms still do the practical work below.
Safeguards for the risks you found
Access controls, an inventory of where client data lives, encryption, two-step login, secure disposal, and change management.
Monitoring and testing
Continuous monitoring, or annual penetration testing plus vulnerability scans every six months, for firms at 5,000 or more records.
Staff training
A session with a record of who attended. Fake IRS notices and fake client emails are the ones that hit tax firms.
Service provider oversight
Your tax software, cloud storage, and IT provider should be able to show they protect client data too.
Keep the program current
When something changes, a new system or a new location, revisit the list.
An incident response plan
Written for firms at 5,000 or more records. Every firm should know who to call.
An annual report
From the Qualified Individual to the owner, for firms at 5,000 or more records.
The IRS also expects every tax preparer to keep a written information security plan, a WISP, and publishes a template in its Security Summit materials. The checklist above is the substance of that plan. We write it with you as part of the setup, dated and kept with your renewal records. Our Safeguards Rule checklist has the detail.
Want us to be the named person?
The Safeguards Rule lets the Qualified Individual work for an outside provider, as long as your firm keeps responsibility for the program, names someone senior to oversee it, and the provider keeps a security program of its own.
Our compliance point person add-on is $150 a month on top of a care plan. We hold that role in writing, keep the required checklist current, and sit in on your insurance renewal. Available after a care plan has been in place for 30 days. The compliance point person add-on is paused for new sign-ups while we finish reviewing its terms. Until then we help your firm with the technical work behind the role while you or a senior person holds it. See the pricing page.
How we usually help an established firm
Tax season leaves no room for a dead server or a fake direct deposit change. These are the projects worth booking before it starts.
Your written security plan, done
The rule requires a written information security plan at covered firms. We build yours from the free IRS template, Publication 5708, put the protections it describes in place, and keep it current. How the security plan works.
Not sure where your email stands? The free email security check grades your domain in about ten seconds.
Who we fit, and who we don't
We fit
- Solo preparers and growing firms, with larger firms reviewed before we quote
- Offices that want the paperwork and the tech handled by the same people
- Firms that use cloud tax software and Microsoft 365
We don't fit
- Firms that need staff on the phone all day in tax season
- Anyone looking for legal advice. We handle the technical side and the paperwork for it, your attorney handles the law.
Stop being your own IT person.
Tell us what's bugging you. In 15 minutes you'll know what it takes to fix and roughly what it costs.