What a financial firm's IT has to handle
CPA firms, tax preparers, financial advisors and mortgage brokers hold Social Security numbers, bank account details, tax returns and account access. That makes them prime targets for phishing, account takeover and wire fraud. A single compromised mailbox can be used to send fake transfer instructions to clients who trust the sender.
The work is also seasonal. Tax firms see their heaviest load from January to April and again before the October extension deadline. A slow system or a locked account in March costs far more than the same problem in July. Our guide to IT for accounting firms covers busy-season planning.
- A secure client portal for tax documents and statements, instead of attachments in email
- Multi-factor authentication on email, tax software, portals and custodian platforms
- Maintenance and upgrades scheduled outside your busiest months
- Laptops, licenses and access ready before seasonal staff start, so they can work on day one
- A rule that any change to payment or transfer instructions is confirmed by phone at a known number
The rules financial firms work under
The FTC Safeguards Rule covers a wider group than most people expect. The FTC's own examples include mortgage brokers, finance companies, collection agencies, tax preparation firms, and investment advisers that are not required to register with the SEC. Covered firms need a written information security program based on a written risk assessment, with a qualified individual responsible for it, plus multi-factor authentication, encryption of customer information and staff training.
Since May 2024, covered firms must also notify the FTC within 30 days of discovering a security event involving the unencrypted information of at least 500 consumers. Firms that hold information on fewer than 5,000 consumers are exempt from a few parts of the rule, such as the written risk assessment and the incident response plan, but not from the rule itself.
Tax professionals have a further duty. The IRS states that federal law requires them to create and maintain a written information security plan, and its Publication 5708 provides a template. Broker-dealers and registered investment advisers answer to the SEC's Regulation S-P, amended in 2024 to require a written incident response program and customer notice within 30 days of learning that sensitive information was, or likely was, accessed without authorization. Larger firms had to comply by December 2025 and smaller firms by June 2026. FINRA members also have supervision, recordkeeping and business continuity rules; see what FINRA cybersecurity compliance requires.
Our work with financial firms starts by confirming which of these obligations apply to you, then building the program and the evidence to match.
Client communications and records
Regulated firms have to keep records of business communications, and regulators have fined firms heavily for business conversations held on personal texting apps that were never captured. Firms outside SEC or FINRA rules benefit from the same habit: business conversations on business systems that are retained and searchable. Our article on off-channel communications explains where the line sits.
Email is still the main channel for fraud. Attackers who get into a mailbox, or imitate one convincingly, send changed wiring instructions or fake invoices. Strong email filtering, domain protection such as DMARC and multi-factor authentication stop most of these attempts. A phone callback rule stops most of the rest.
Planning for an incident before it happens
The Safeguards Rule and Regulation S-P both expect you to know what to do before something goes wrong. A written incident response plan names who decides, who calls the insurer, who preserves evidence, and who notifies clients and regulators within the deadlines. We help you write it, walk through it with a short tabletop exercise, and keep it current.
Cyber insurers ask many of the same questions. Multi-factor authentication, tested backups, endpoint detection and staff training are now common conditions for coverage, and a clear record of them makes renewals easier.
How GlobeVM supports a financial firm
On top of our standard security, financial firms get help with the written security program and risk assessment, a secure way to exchange documents with clients, monitoring for stolen staff credentials on the dark web, tested backups for tax and accounting data, and maintenance scheduled around your busy season.
If your firm already has a qualified individual for the Safeguards Rule, we work with them. If not, we help you decide who should hold that role and give them what they need to report to leadership.