Many professional services firms have a single in-house IT person. Sometimes it's a dedicated systems administrator. Often it's an office manager, engineer, or operations lead who became "the computer person" because they were good at it.

That person is valuable. They know the firm's people, software, and quirks. But one person can't do everything. They take vacations, get sick, and have limited hours. Security monitoring, compliance documentation, and after-hours emergencies can stretch them beyond what's reasonable.

Co-managed IT offers a middle path: keep your in-house person, and add an outside team to support them.

What Is Co-Managed IT?

Co-managed IT is a shared arrangement where your internal IT staff and an outside managed IT provider divide responsibilities. Your in-house person stays in charge of what they do best, often day-to-day user support and firm-specific applications. The outside provider fills gaps such as security monitoring, backup management, after-hours coverage, or major projects.

It's not about replacing anyone. It's about giving your IT person a team.

How Co-Managed IT Differs From Fully Managed IT

To understand what a managed provider typically handles behind the scenes, see what a managed IT support provider actually does all day.

Common Ways Firms Divide the Work

Every arrangement is different, but common splits include:

• Internal IT: user support, onboarding, firm-specific software, vendor relationships.
• Provider: security monitoring, endpoint protection, patch management, backups, after-hours alerts.
• Shared: projects like office moves, system upgrades, or Microsoft 365 migrations.

The key is writing the division down so nobody assumes the other side has something covered.

Is Co-Managed IT a Good Fit? A Quick Checklist

Co-managed IT may be a strong fit if several of these are true:

• ☐ Your firm has one or two internal IT people.
• ☐ That person regularly works evenings or weekends to keep up.
• ☐ There's no backup when they're on vacation or sick.
• ☐ Security monitoring is limited or inconsistent.
• ☐ Clients or insurers are asking security questions that are hard to answer.
• ☐ Big projects keep getting pushed because daily support always comes first.
• ☐ Leadership worries about what would happen if that person left.

Benefits for the Firm

• Continuity: Support doesn't stop when one person is unavailable.
• Depth: Access to specialists in security, networking, and cloud services.
• Better security: Consistent monitoring and tools that are hard for one person to manage alone.
• Retention: Internal IT staff are less likely to burn out.
• Documentation: Systems get documented, reducing risk if staff change.

Benefits for Your IT Person

Co-managed IT works best when the internal IT person sees the provider as a resource, not a threat. They gain a team to escalate to, tools they couldn't justify alone, and the ability to take time off without worrying. Many internal IT staff tell us it lets them focus on the work they enjoy.

Making Co-Managed IT Work

1. Define responsibilities in writing.
2. Use shared tools for tickets and documentation so everyone sees the same information.
3. Agree on escalation paths for urgent issues.
4. Meet regularly to review security status and priorities.
5. Keep leadership informed with simple reports.

Support Your Team Without Replacing It

Your in-house IT person built a lot of what keeps your firm running. Co-managed IT protects that investment while filling the gaps no single person can cover. Maise Technology provides co-managed IT through our managed IT support and help desk services.

Curious whether co-managed IT fits your firm? Schedule A 15 Minute Discovery Call. We'd be glad to include your IT person in the conversation.

Accounting and CPA firms have technology needs that don't fit a generic IT package. Tax season compresses months of work into a few intense weeks. Client data includes Social Security numbers, bank accounts, and income details. And federal rules require many firms to maintain a written information security program.

When a firm evaluates managed IT services, the question isn't just "Will you fix our computers?" It's "Will you support how an accounting firm actually works?" Here's what a complete managed IT arrangement for an accounting firm should include.

1. Tax Season Readiness

The worst time for a server failure, a software update gone wrong, or a slow network is the week of a filing deadline. A strong provider plans around your calendar:

• Major updates and upgrades scheduled before busy season.
• Extra attention to performance and capacity in the weeks before deadlines.
• Faster response commitments during peak periods.
• Seasonal staff set up quickly and removed promptly when the season ends.

2. Support for Tax and Accounting Software

Your provider should be comfortable supporting the professional tax, write-up, document management, and practice management applications you use, and willing to coordinate with those vendors when problems arise.

3. Security Aligned With the FTC Safeguards Rule

The FTC Safeguards Rule requires many accounting and tax firms to maintain a written information security program with specific safeguards. A managed IT provider can't make you compliant on its own, but it should help you implement and document key technical controls, such as:

• Multifactor authentication for anyone accessing client information.
• Encryption of client data in storage and in transit.
• Access controls so staff only see what they need.
• Monitoring and logging of system activity.
• Secure disposal of old devices and data.

Our compliance services can help firms build and maintain their written security plan.

4. Secure Client File Exchange

Clients send tax documents in every way imaginable: email attachments, photos from phones, and paper. Managed IT should include a secure way to receive and share files, such as a client portal or properly configured cloud sharing, and help training staff to steer clients toward it.

5. Email Protection Against Fraud

Accounting firms are frequent targets of phishing and business email compromise, especially during tax season. Expect email filtering, external sender warnings, domain protection, and phishing awareness training that uses realistic examples from the accounting world.

6. Reliable Backups and Recovery

Losing client files or tax data in the middle of the season could be catastrophic. Your provider should back up local and cloud data, protect at least one copy from ransomware, and test restores regularly. Ask specifically whether your tax software's data is included.

7. Remote and Hybrid Work Support

Many firms allow staff to work remotely, especially during long seasonal hours. Managed IT should include secure remote access, laptop encryption, and the ability to lock or erase a lost device.

8. Help Desk Support Your Team Will Actually Use

Accountants are busy. Support should be easy to reach and quick to resolve common issues, so staff aren't tempted to work around problems.

9. Planning and Reporting

Expect regular reviews covering security status, upcoming equipment replacements, software end-of-life dates, and recommendations for the coming year. Partners should get clear, nontechnical summaries.

What Affects Cost

The cost of managed IT for an accounting firm depends on the number of users and devices, the software environment, compliance documentation needs, seasonal staffing, and the level of after-hours support required. A good provider will walk through these factors openly before proposing anything.

Questions to Ask Before Signing

• What other accounting or financial firms do you support?
• How do you prepare for tax season?
• How will you support our written information security program?
• What's included, and what's billed separately?
• How quickly do you respond during our busiest weeks?

Built for Accounting Firms

Maise Technology provides managed IT support for accounting, tax, and financial firms. Learn more on our IT support for financial firms page.

Planning ahead for next tax season? Schedule A 15 Minute Discovery Call.

Ask the owner of a small accounting, engineering, or consulting firm whether they're prepared for a disaster, and the answer is often, "We have backups."

That's a good start. But backups and business continuity aren't the same thing. Knowing the difference can determine whether a firm is back to work in a few hours or struggling for weeks.

The Short Version

• Backup is a copy of your data.
• Disaster recovery is the process of restoring your systems and data from those copies.
• Business continuity is your plan for keeping the firm operating and serving clients while recovery happens.

Think of it like a spare tire. The backup is the spare. Disaster recovery is changing the tire. Business continuity is figuring out how you'll still make your client meeting on time.

Side-by-Side Comparison

Why Backups Alone Fall Short

Restoring takes longer than expected

A backup might contain everything you need, but restoring several hundred gigabytes of files and a practice management database can take a day or more. During that time, staff can't work normally.

Backups don't tell people what to do

When systems go down, someone has to decide whether to send staff home, how to contact clients, and which deadlines need extensions. A backup can't make those decisions.

Backups can be compromised

Ransomware often targets backups first. If your only backup is connected to the same network with the same passwords, it may be encrypted along with everything else.

Some things aren't backed up at all

Firms are often surprised to learn that certain cloud applications, email archives, or software configurations aren't included in their backup.

What Business Continuity Adds

A business continuity plan for a small professional firm usually covers:

• Critical functions: client deliverables, deadlines, billing, and communication.
• Recovery targets: a recovery time objective (how fast each system must return) and a recovery point objective (how much data you can afford to lose).
• Alternate work arrangements: remote work, a backup location, or loaner laptops.
• Communication: how to reach staff and clients if email is down.
• Decision authority: who declares an emergency and who speaks to clients.
• Vendor contacts: software providers, internet carriers, and your IT partner.

A Realistic Scenario

An eight-person accounting firm loses its server to a hardware failure on March 30, two weeks before a major tax deadline.

Firm A has backups only. The backups are intact, but nobody has tested a full restore. A replacement server takes three days to arrive, and restoring data takes another day. Staff spend most of a week unable to work.

Firm B has backups and a continuity plan. Its plan includes cloud-based recovery that runs critical systems temporarily in a hosted environment. Staff are working remotely by the afternoon. The partners notify a few clients about short delays, and the firm meets its deadlines.

Both firms had backups. Only one had a plan. Downtime affects more than productivity, as we explain in the real cost of IT downtime.

Questions to Ask Your IT Provider

• What exactly is included in our backups, and what isn't?
• How long would a full restore take?
• Is at least one backup protected from ransomware?
• When did we last test a restore?
• Can critical systems run temporarily in the cloud if our office equipment fails?

Build Both

Backups are essential, but they're the foundation, not the whole house. Maise Technology helps firms build complete plans through our business continuity services and disaster recovery services.

Not sure whether your firm has backups only or a real continuity plan? Schedule A 15 Minute Discovery Call and we'll help you find out.

Consulting, engineering, architecture, and marketing firms run on documents. Proposals, client deliverables, financial models, designs, and contracts all live in Microsoft 365 for a growing number of firms. That's a good thing. Microsoft 365 makes collaboration easier than ever.

The catch is that the platform makes sharing easy too. Over time, firms end up with hundreds of links to client files floating around, some of them accessible to anyone who happens to get the URL.

You don't need to be an IT expert to understand the settings that matter. This guide explains the key sharing controls in plain language so firm leaders can ask the right questions.

Why Sharing Settings Drift Over Time

When most firms set up Microsoft 365, they leave the default settings in place. Then people start sharing. A project manager sends a link to a client. A designer shares a folder with a subcontractor. Someone creates a link that anyone can open because it was the fastest way to meet a deadline.

None of these choices is unusual. But added together, they mean the firm may not know who can see its client data. Unapproved tools make this worse, as we explain in our article on shadow IT.

Setting 1: External Sharing Level

SharePoint and OneDrive let administrators choose how widely files can be shared outside the firm. The options generally range from:

• Anyone: links that work for anyone who has them, with no sign-in.
• New and existing guests: outside people must verify their identity.
• Existing guests only: sharing is limited to people already approved.
• Only people in your organization: no external sharing at all.

Question to ask: "Do we really need 'Anyone' links, or can we require outside people to verify who they are?"

Many professional services firms choose to require verification for external sharing, which still allows client collaboration while blocking anonymous access.

Setting 2: Default Link Type

When someone clicks "Share," Microsoft 365 suggests a default type of link. If the default is a broad link, people will use it, simply because it's selected.

Question to ask: "What's our default sharing link, and can we change it to 'specific people'?"

Changing the default doesn't block anyone from working. It just makes the safer choice the easy choice.

Setting 3: Link Expiration

Links to client deliverables often stay active for years after a project ends. Administrators can set external links to expire automatically after a set number of days.

Question to ask: "Do our external links expire, and is the timeframe right for how long our projects usually last?"

Setting 4: Guest Accounts

When firms collaborate in Microsoft Teams or SharePoint with outside people, those people often become "guests" in your environment. Former subcontractors and past clients may still have access long after the work ends.

Question to ask: "How often do we review guest accounts, and who removes the ones we no longer need?"

A quarterly review is a reasonable starting point for most firms.

Setting 5: Sign-In Protections

Sharing settings protect files from outsiders. Sign-in protections protect your own accounts. Key controls include:

• Multifactor authentication for every user.
• Conditional access policies, available in some Microsoft 365 plans, which can block sign-ins from risky locations or unmanaged devices.
• Blocking older sign-in methods that don't support modern security checks.

Question to ask: "Does our Microsoft 365 plan include conditional access, and are we using it?"

Setting 6: Sensitivity Labels and Data Loss Prevention

Some Microsoft 365 plans include tools that label documents by sensitivity and warn users before sharing confidential information outside the firm. These tools take more planning but can be valuable for firms that handle financial data, personal information, or trade secrets.

Question to ask: "Do we handle client information sensitive enough to justify labels or data loss prevention?"

A One-Hour Review Plan

If you're not sure where your firm stands, a focused review can uncover most issues quickly:

1. Check the external sharing level for SharePoint and OneDrive.
2. Check the default link type.
3. Confirm whether external links expire.
4. Pull a list of guest users and flag any that are no longer needed.
5. Confirm multifactor authentication is on for every account.
6. Run a sharing report to find files shared with "Anyone" links.

Security That Doesn't Slow Down Client Work

The goal isn't to stop sharing. It's to make sure sharing happens deliberately. Firms that tighten these settings usually find that staff barely notice the change, while client data becomes far easier to control.

Maise Technology helps professional services firms configure Microsoft 365 through our cloud services and protect accounts with our cybersecurity services. If you'd like a second set of eyes on your settings, Schedule A 15 Minute Discovery Call.

A written information security plan (WISP) is a documented set of policies and safeguards that explains how a business protects sensitive customer information. It describes who is responsible for security, what risks the business faces, which protections are in place, and what happens if something goes wrong.

For many accounting firms, tax preparers, and other financial professionals, a WISP isn't optional. Federal rules require it. For other professional services firms, it's still one of the clearest ways to show clients that their information is handled responsibly.

Who Needs a WISP?

The FTC Safeguards Rule requires businesses that the rule treats as "financial institutions" to develop, implement, and maintain a written information security program. That category is broader than most people expect. It includes tax preparers, many accounting firms, mortgage brokers, and other businesses that handle consumers' financial information.

The IRS reinforces this for tax professionals. It published IRS Publication 5708, a guide and template for creating a WISP for tax and accounting practices.

Other firms, such as consultants, engineers, architects, and marketing agencies, may not fall under the Safeguards Rule. Many still create a WISP because clients ask for one, cyber insurance carriers expect one, or state privacy laws encourage reasonable security programs.

What Goes Into a WISP?

A WISP should fit your firm's size and complexity. Under the FTC Safeguards Rule, a written program generally covers these elements:

• A qualified individual who oversees the security program. This can be an employee or an outside provider.
• A written risk assessment identifying threats to customer information.
• Safeguards to control those risks, such as access controls, encryption, and multifactor authentication.
• Testing and monitoring to confirm those safeguards work.
• Staff training on security awareness.
• Service provider oversight for vendors who handle customer data.
• An incident response plan describing what to do after a security event.
• Regular reporting to firm leadership on the program's status.

Some requirements are scaled back for smaller businesses that maintain information on fewer than 5,000 consumers. Check the rule carefully, or with a qualified advisor, to see which apply to you.

WISP vs. IT Policy: What's the Difference?

An IT policy usually describes rules for employees, such as acceptable use or password requirements. A WISP is broader. It ties policies to risks, assigns responsibility, and explains how the whole program is maintained over time. Think of IT policies as chapters inside the WISP.

Common Mistakes Firms Make

Downloading a template and stopping there

Templates are helpful starting points. But a WISP that describes safeguards you don't actually have can create more trouble than having no plan at all. The document must match reality.

Writing it once and never updating it

Your firm changes. You add software, hire staff, open remote access, or switch vendors. The WISP should be reviewed at least once a year and after significant changes.

Leaving out the incident response plan

Many WISPs explain how to prevent problems but not what to do when one happens. Under amendments to the Safeguards Rule, covered businesses must also notify the FTC of certain security events involving the information of 500 or more consumers. Knowing your steps in advance matters.

Forgetting vendors

Cloud tax software, document portals, and outsourced bookkeeping all handle client data. Your WISP should explain how you evaluate and monitor them.

Frequently Asked Questions

How long should a WISP be?

Long enough to cover your real systems and risks. For a small firm, that might be 10 to 20 pages. Larger firms often have more.

Do I need to file my WISP with the government?

No. You keep it on file. You may need to show it to regulators, auditors, insurers, or clients who ask.

Can my IT provider write it for me?

An IT provider can help significantly, especially with the technical safeguards. Firm leadership should still review and own the final plan, because it reflects business decisions about risk.

Is a WISP the same as being compliant?

No. A WISP documents your program. Compliance depends on actually carrying out what the plan describes.

Getting Started

Begin with an inventory of the client information you hold and where it lives. Then review the IRS template or another reputable framework, adapt it honestly to your firm, and assign a qualified individual to keep it current.

For a look at what firms commonly overlook, see the compliance blind spot that could cost you thousands. Maise Technology helps firms build practical security programs through our compliance services, and we support accounting and financial practices through our IT support for financial firms.

Have a question about your firm's WISP? Get In Touch.

This article provides general information and is not legal advice. Consult qualified counsel about how the FTC Safeguards Rule applies to your business.