What an accounting firm's IT has to handle
A CPA or tax practice runs on a short list of systems that all have to work at once: professional tax software, accounting software such as QuickBooks, a document management system or shared file store, a client portal, email, e-signature, scanners and printers, and remote access for staff who work from home in the evenings. If any one of them stops in the weeks before a deadline, returns stop with it.
Accounting firms also hold exactly what identity thieves want. A single client file can contain Social Security numbers for a whole family, bank account and routing numbers, W-2s and prior-year returns. A stolen set of those documents can be used to file a fraudulent return before the real one goes in. That is why the IRS and the FTC both treat tax and accounting firms as holders of sensitive financial data, with written rules to match.
- Tax and accounting software that opens quickly for every preparer, in the office or at home
- A client portal for uploads and downloads, so tax documents never sit in email
- Multi-factor sign-in on email, tax software, the portal and remote access
- Laptops, accounts and licenses ready before seasonal staff start
- Backups kept separate from the network, tested before January
Tax season uptime: get ready before January
Most of the year's work lands between January and the April 15 filing deadline, with a second rush before the October 15 extension deadline. A slow server or a failed laptop in July is an annoyance. The same problem in the second week of April means missed filings, extension requests you did not plan to make, and staff working through the night.
The fix is planning. Tax software updates, Windows updates, hardware replacements and any server or cloud move happen in the slow months, not in February. Seasonal preparers get their laptops, accounts and access set up before they start, so they bill on day one. We watch the systems around the clock, and when something does break in March, your staff reach a person in under 15 minutes.
Our busy season checklist for accounting firms walks through the preparation step by step. The downtime cost calculator shows what an hour without your systems costs a firm your size.
Tax software, QuickBooks and remote access
Many firms still run desktop programs such as QuickBooks Desktop and professional tax software like Drake, Lacerte, UltraTax or ProSeries. Others have moved to cloud versions. Both work, but each needs care. Desktop programs need a server or hosted setup that is fast, backed up and patched, and data files that only the right people can open. If you host desktop software with a third party, check that your software license allows it.
Remote work is where many firms get exposed. Opening a remote desktop port to the internet, or letting staff reach the office from personal computers, gives attackers an easy way in. Staff working from home should connect through a secure VPN or a remote access service with multi-factor sign-in, from company laptops that are encrypted and kept up to date. Our guide to secure remote access explains the options.
We set up and look after this layer for you. New hires get the right access on day one, departing staff lose it the same day, and when the problem is on the software vendor's side, we open the ticket and follow it so your staff are not stuck on hold in the middle of tax season.
The written security plan: IRS Publication 4557, 5708 and the FTC Safeguards Rule
The IRS states that federal law requires tax and accounting professionals to create and maintain a Written Information Security Plan (opens in a new tab), often called a WISP. Under the Gramm-Leach-Bliley Act, the IRS notes, tax and accounting professionals are considered financial institutions. The IRS offers a free template in Publication 5708 (opens in a new tab) and broader security guidance in Publication 4557, Safeguarding Taxpayer Data (opens in a new tab). The IRS groups a good plan into three areas: employee management and training, information systems, and detecting and managing system failures.
The requirement now comes up every year. On the PTIN application and renewal form, line 11 asks paid preparers to check a box acknowledging that they are required by law to create and maintain a written information security plan, according to the Form W-12 instructions (opens in a new tab). Checking that box is easy. Having a real plan behind it is the part that protects your clients and your firm.
The plan exists to meet the FTC Safeguards Rule (opens in a new tab), which lists tax preparation firms among the businesses it covers. The FTC's summary of the rule includes a qualified individual who runs the security program, a written risk assessment, multi-factor authentication for anyone accessing customer information, encryption of customer information on your systems and in transit, staff training, oversight of service providers, a written incident response plan, and a written report to your board or other governing body at least once a year. Firms without continuous monitoring need annual penetration testing and vulnerability scans every six months.
Two more parts are easy to miss. Customer information should be securely disposed of no later than two years after you last used it to serve the customer, unless there is a legitimate business or legal need to keep it. And the FTC must be notified no later than 30 days after discovering a security event that involves the unencrypted information of at least 500 consumers. Firms that hold information on fewer than 5,000 consumers are exempt from certain provisions, but not from the rule itself. Our FTC Safeguards Rule guide goes through each part, and our compliance and risk management team helps you write the plan and keep the evidence.
Phishing aimed at tax professionals
Tax preparers are a favorite target of email scams. The IRS warns about "new client" scams (opens in a new tab): emails from people pretending to be potential clients, with links or attachments that infect your computers and steal client data. These are often spear phishing, written for one firm and harder to spot than mass spam. In its 2026 Dirty Dozen list (opens in a new tab), the IRS also warns that scammers who break into a client's email account can find a genuine email that client sent to their tax professional, which makes a fake follow-up far harder to spot.
This works because a tax office opens attachments from strangers all day. The defense has three parts: email filtering that checks links and attachments before they reach staff, multi-factor sign-in so a stolen password alone is not enough, and short, regular training so staff know to send new clients to the portal instead of opening what they email. You can check how well your domain is protected against spoofing with our free email security check.
A phone callback rule matters too. If a client emails new bank details for a refund or a payment, confirm by phone at a number you already have on file before anything changes. Our guide to business email compromise shows how these scams unfold.
Backups, retention and what to do after a breach
Ransomware groups know that a tax firm locked out of its files in April will feel pressure to pay. Backups are what remove that pressure, but only if they are kept separate from the office network, cover cloud apps like Microsoft 365 as well as the server, and have been restored in a test. The 3-2-1 backup rule is a good starting point.
Retention cuts both ways. You need to keep client records for as long as your firm's policy and your professional rules require, and the Safeguards Rule expects you to dispose of customer information you no longer need. A written data retention policy settles how long each type of record is kept, where, and how it is destroyed at the end.
If client data is stolen, the IRS asks tax professionals to report it to their local IRS Stakeholder Liaison (opens in a new tab), and lists other calls to make: the FBI, local police, the state tax agencies where you prepare returns, possibly each state's attorney general, your insurer, and the FTC if 500 or more people are affected. Writing those steps into an incident response plan before anything happens saves hours when it counts.
How GlobeVM supports an accounting firm
On top of our standard security, accounting and tax firms get help writing and maintaining the written information security plan, a secure way to exchange files with clients, multi-factor sign-in on every system with client data, tested backups for tax and accounting files, and maintenance scheduled around tax season.
If your firm already has someone acting as the qualified individual, we work with them. If not, we help you decide who should hold that role. When someone on your team needs help, they reach a person in Los Angeles in under 15 minutes, in English or Farsi. Firms that also advise on investments or lending can see our page for financial services firms.
