Accounting & tax office IT
IT that holds through tax season.
A tax office holds Social Security numbers, bank details and years of returns. Federal law expects a written plan for protecting them. This page explains what that plan covers and how to keep the office running when the calendar is tightest.
Sample data · “Your Business”
Quick answer
Do tax preparers have to have a written information security plan?
Yes. The Gramm-Leach-Bliley Act treats tax preparers as financial institutions, which places them under the FTC Safeguards Rule, and the IRS reminds preparers that the rule requires a written information security plan. IRS Publication 5708 offers a template sized for small practices. The plan can be short, and it has to be written and followed.
The rule, in plain words
What the Safeguards Rule asks for.
The FTC’s Safeguards Rule requires covered businesses, including tax preparation firms, to develop, implement and maintain a written information security program that fits the size of the business and the sensitivity of what it holds. The FTC’s own guidance lists these elements:
- One named person in charge of the program (the rule calls this the Qualified Individual). It can be someone at a service provider, and the firm remains responsible.
- A written risk assessment: where client data lives, what could go wrong, and what you do about it.
- Safeguards: limited access, an inventory of data, encryption of customer information stored and sent, multi-factor sign-in, secure disposal and activity logging.
- Testing and monitoring to confirm the safeguards work.
- Staff training on security awareness.
- Oversight of service providers, with security expectations in the contract.
- A written incident response plan, and a periodic written report to whoever runs the firm.
- Notifying the FTC of a breach involving unencrypted information of at least 500 consumers, as soon as possible and no later than 30 days after discovery.
The rule relieves businesses holding information on fewer than 5,000 consumers of certain provisions. Read the FTC’s guide and IRS Publication 4557, and ask your attorney which parts apply to your practice.
Handling it day to day
Five habits that carry the plan.
A portal, not an attachment
Emailing a return puts a Social Security number in every inbox it passes through. A client portal or an encrypted, expiring link keeps the document in one controlled place and shows who opened it.
Guard the e-file credentials
Your e-file and IRS online account logins are worth more to a thief than any one return. Use multi-factor sign-in, never share a login, and treat a client return rejected as already filed as a warning sign worth investigating the same day.
Multi-factor sign-in everywhere
Tax software, email, the portal, remote access and payroll services. One stolen password should never be enough.
Encrypt and limit
Encrypt laptops and backup drives. Give seasonal staff access only to what their work needs, and remove it the day the season ends.
Dispose on purpose
Decide how long you keep client records, then shred paper and securely wipe old computers, copiers and drives before they leave the office.
Verify-by-phone applies here too: never act on emailed changes to a client’s bank account for a refund or a payment without calling a number you already had.
Tax season uptime
Do the risky work before January.
- 01
Replace and upgrade in the fall
New computers, software updates and network changes belong in the quiet months. Freeze everything except security patches once the season starts.
- 02
Test a restore
Restore a real client folder from backup before the season. Follow 3-2-1: three copies, two kinds of storage, one off site.
- 03
Have a second way online
A backup internet connection on a different technology keeps e-filing moving when the main line fails.
- 04
Plan for one dead machine
Keep a spare computer ready with the tax software installed, so a failed hard drive costs an hour and not a day.
- 05
Bring seasonal staff on properly
Named accounts, multi-factor sign-in and training before they touch a return.
What it costs
One plan, all year.
Managed IT is $175 per user, per month with a 5-user minimum. The price does not rise in tax season.
The same single plan every client gets. Microsoft 365 licenses billed separately at Microsoft’s price.
- Unlimited remote help desk (phone & email)
- 24/7 monitoring and alerting
- Patch management
- Microsoft 365 administration and support
- Multi-factor sign-in setup
- Backup monitoring and management
- Advanced security monitoring
- Network & firewall management
- Security awareness training
- Onboarding and same-day offboarding
- Quarterly on-site visits
- Vendor management
Priced in writing before any work starts.
- IT and security assessment with plain-English findings
- Help drafting and reviewing your written information security plan
- Written incident response plan
- vCIO strategy sessions
- Software and server migrations
This page is general information, not legal advice. We put security controls in place and document them; we do not certify anyone or make an organization compliant. Ask your attorney or your regulator what applies to you.
Questions
Accounting and tax IT questions, plainly answered.
Does a one-person tax practice need a written security plan?
The IRS says the requirement applies to tax preparers regardless of size. A solo preparer’s plan can be brief, and IRS Publication 5708 includes a template written for small practices.
Can you write our security plan for us?
We help you draft it and put the technical safeguards behind it, as quoted documentation work. The plan is the firm’s own document: you decide what it says, name the person in charge and follow it.
Is it acceptable to email a tax return to a client?
Ordinary email is a poor way to send a document full of personal information. Use a client portal or an encrypted link. If a client insists on email, encrypt the file and give them the password by phone.
What happens if our office is breached?
Follow your incident response plan: contain it, find out what was reached, and get advice quickly. The IRS asks preparers to contact their local IRS stakeholder liaison, and the FTC and state law may require notices. Ask your attorney.
How much does IT cost for an accounting office?
$175 per user, per month with a 5-user minimum. That covers the help desk, 24/7 monitoring, security, Microsoft 365 administration, backups and quarterly on-site visits. Microsoft 365 licenses are billed separately.
Do you support our tax and accounting software?
Yes. We support the computers and network it runs on, handle installs and updates, and deal with the software vendor for you as part of vendor management.
Does using you make us compliant with the Safeguards Rule?
No provider can make that promise. The rule puts the responsibility on the firm. We put safeguards in place, help document them and tell you what remains open.
Contact
Request an IT assessment.
A hands-on review of your computers, network, security and backups, quoted up front, with findings in plain English.