Accounting and CPA firms have technology needs that don't fit a generic IT package. Tax season compresses months of work into a few intense weeks. Client data includes Social Security numbers, bank accounts, and income details. And federal rules require many firms to maintain a written information security program.
When a firm evaluates managed IT services, the question isn't just "Will you fix our computers?" It's "Will you support how an accounting firm actually works?" Here's what a complete managed IT arrangement for an accounting firm should include.
1. Tax Season Readiness
The worst time for a server failure, a software update gone wrong, or a slow network is the week of a filing deadline. A strong provider plans around your calendar:
- Major updates and upgrades scheduled before busy season.
- Extra attention to performance and capacity in the weeks before deadlines.
- Faster response commitments during peak periods.
- Seasonal staff set up quickly and removed promptly when the season ends.
2. Support for Tax and Accounting Software
Your provider should be comfortable supporting the professional tax, write-up, document management, and practice management applications you use, and willing to coordinate with those vendors when problems arise.
3. Security Aligned With the FTC Safeguards Rule
The FTC Safeguards Rule requires many accounting and tax firms to maintain a written information security program with specific safeguards. A managed IT provider can't make you compliant on its own, but it should help you implement and document key technical controls, such as:
- Multifactor authentication for anyone accessing client information.
- Encryption of client data in storage and in transit.
- Access controls so staff only see what they need.
- Monitoring and logging of system activity.
- Secure disposal of old devices and data.
Our compliance services can help firms build and maintain their written security plan.
4. Secure Client File Exchange
Clients send tax documents in every way imaginable: email attachments, photos from phones, and paper. Managed IT should include a secure way to receive and share files, such as a client portal or properly configured cloud sharing, and help training staff to steer clients toward it.
5. Email Protection Against Fraud
Accounting firms are frequent targets of phishing and business email compromise, especially during tax season. Expect email filtering, external sender warnings, domain protection, and phishing awareness training that uses realistic examples from the accounting world.
6. Reliable Backups and Recovery
Losing client files or tax data in the middle of the season could be catastrophic. Your provider should back up local and cloud data, protect at least one copy from ransomware, and test restores regularly. Ask specifically whether your tax software's data is included.
7. Remote and Hybrid Work Support
Many firms allow staff to work remotely, especially during long seasonal hours. Managed IT should include secure remote access, laptop encryption, and the ability to lock or erase a lost device.
8. Help Desk Support Your Team Will Actually Use
Accountants are busy. Support should be easy to reach and quick to resolve common issues, so staff aren't tempted to work around problems.
9. Planning and Reporting
Expect regular reviews covering security status, upcoming equipment replacements, software end-of-life dates, and recommendations for the coming year. Partners should get clear, nontechnical summaries.
What Affects Cost
The cost of managed IT for an accounting firm depends on the number of users and devices, the software environment, compliance documentation needs, seasonal staffing, and the level of after-hours support required. A good provider will walk through these factors openly before proposing anything.
Questions to Ask Before Signing
- What other accounting or financial firms do you support?
- How do you prepare for tax season?
- How will you support our written information security program?
- What's included, and what's billed separately?
- How quickly do you respond during our busiest weeks?
Built for Accounting Firms
Maise Technology provides managed IT support for accounting, tax, and financial firms. Learn more on our IT support for financial firms page.
Planning ahead for next tax season? Schedule A 15 Minute Discovery Call.
A written information security plan (WISP) is a documented set of policies and safeguards that explains how a business protects sensitive customer information. It describes who is responsible for security, what risks the business faces, which protections are in place, and what happens if something goes wrong.
For many accounting firms, tax preparers, and other financial professionals, a WISP isn't optional. Federal rules require it. For other professional services firms, it's still one of the clearest ways to show clients that their information is handled responsibly.
Who Needs a WISP?
The FTC Safeguards Rule requires businesses that the rule treats as "financial institutions" to develop, implement, and maintain a written information security program. That category is broader than most people expect. It includes tax preparers, many accounting firms, mortgage brokers, and other businesses that handle consumers' financial information.
The IRS reinforces this for tax professionals. It published IRS Publication 5708, a guide and template for creating a WISP for tax and accounting practices.
Other firms, such as consultants, engineers, architects, and marketing agencies, may not fall under the Safeguards Rule. Many still create a WISP because clients ask for one, cyber insurance carriers expect one, or state privacy laws encourage reasonable security programs.
What Goes Into a WISP?
A WISP should fit your firm's size and complexity. Under the FTC Safeguards Rule, a written program generally covers these elements:
- A qualified individual who oversees the security program. This can be an employee or an outside provider.
- A written risk assessment identifying threats to customer information.
- Safeguards to control those risks, such as access controls, encryption, and multifactor authentication.
- Testing and monitoring to confirm those safeguards work.
- Staff training on security awareness.
- Service provider oversight for vendors who handle customer data.
- An incident response plan describing what to do after a security event.
- Regular reporting to firm leadership on the program's status.
Some requirements are scaled back for smaller businesses that maintain information on fewer than 5,000 consumers. Check the rule carefully, or with a qualified advisor, to see which apply to you.
WISP vs. IT Policy: What's the Difference?
An IT policy usually describes rules for employees, such as acceptable use or password requirements. A WISP is broader. It ties policies to risks, assigns responsibility, and explains how the whole program is maintained over time. Think of IT policies as chapters inside the WISP.
Common Mistakes Firms Make
Downloading a template and stopping there
Templates are helpful starting points. But a WISP that describes safeguards you don't actually have can create more trouble than having no plan at all. The document must match reality.
Writing it once and never updating it
Your firm changes. You add software, hire staff, open remote access, or switch vendors. The WISP should be reviewed at least once a year and after significant changes.
Leaving out the incident response plan
Many WISPs explain how to prevent problems but not what to do when one happens. Under amendments to the Safeguards Rule, covered businesses must also notify the FTC of certain security events involving the information of 500 or more consumers. Knowing your steps in advance matters.
Forgetting vendors
Cloud tax software, document portals, and outsourced bookkeeping all handle client data. Your WISP should explain how you evaluate and monitor them.
Frequently Asked Questions
How long should a WISP be?
Long enough to cover your real systems and risks. For a small firm, that might be 10 to 20 pages. Larger firms often have more.
Do I need to file my WISP with the government?
No. You keep it on file. You may need to show it to regulators, auditors, insurers, or clients who ask.
Can my IT provider write it for me?
An IT provider can help significantly, especially with the technical safeguards. Firm leadership should still review and own the final plan, because it reflects business decisions about risk.
Is a WISP the same as being compliant?
No. A WISP documents your program. Compliance depends on actually carrying out what the plan describes.
Getting Started
Begin with an inventory of the client information you hold and where it lives. Then review the IRS template or another reputable framework, adapt it honestly to your firm, and assign a qualified individual to keep it current.
For a look at what firms commonly overlook, see the compliance blind spot that could cost you thousands. Maise Technology helps firms build practical security programs through our compliance services, and we support accounting and financial practices through our IT support for financial firms.
Have a question about your firm's WISP? Get In Touch.
This article provides general information and is not legal advice. Consult qualified counsel about how the FTC Safeguards Rule applies to your business.
