IT for CPA firms is security, uptime in tax season and a written plan

The short answer

Good IT support for an accounting firm covers four things: protecting taxpayer data to the standard federal rules expect, keeping tax and accounting software running through filing season, giving clients a safe way to send documents, and fast help when deadlines are close. General office IT is not enough, because tax and accounting practices carry specific legal obligations.

The IRS says federal law requires tax and accounting professionals to create and maintain a written information security plan, often called a WISP. Firms that prepare taxes are also covered by the FTC Safeguards Rule, which sets out specific controls such as multi-factor authentication and encryption. This article is general information, not legal advice, so confirm your obligations with your counsel.

What federal rules expect

A written information security plan

In an August 2026 reminder, the IRS and its Security Summit partners repeated that a WISP is required and recommended that it cover three areas: employee management and training, information systems, and detecting and managing system failures. IRS Publication 5708 is a free template written for small practices, and Publication 4557 explains the safeguards in more detail. The IRS says the plan should be reviewed, tested and updated regularly, and it should match your firm’s size and the data you hold.

The FTC Safeguards Rule

The rule, at 16 CFR Part 314, applies to tax preparers as financial institutions. Its requirements include:

• Naming a Qualified Individual to oversee the security program. This can be an employee or a service provider, but the firm keeps responsibility.
• Basing safeguards on a risk assessment.
• Encrypting customer information in transit and at rest.
• Multi-factor authentication for anyone accessing systems that hold customer information.
• Monitoring, staff training and oversight of service providers.
• Notifying the FTC as soon as possible, and no later than 30 days after discovery, of a notification event (unauthorized acquisition of unencrypted customer information) involving at least 500 consumers.

The rule exempts firms holding information on fewer than 5,000 consumers from a few of its requirements, including the written risk assessment, written incident response plan and annual report to leadership. The core safeguards still apply.

Hosting tax and accounting software

Most firms run some mix of professional tax software, accounting or write-up software, document management and a practice management system. There are three common ways to host it.

• On a server in the office. Familiar and fast on the local network, but you own the backups, updates and hardware, and remote staff need secure access.
• Vendor-hosted or cloud editions. The software company runs the servers. Less hardware to maintain, but check what the vendor backs up, how you get your data out and what happens during their outages.
• Hosted desktops from a third party. Your desktop software runs on a provider’s servers and staff connect remotely. Useful for remote teams, but you add another vendor to oversee under the Safeguards Rule.

Whichever you choose, write down where client data lives, who can reach it and how it is backed up. That list becomes part of your WISP.

Client portals instead of email attachments

Clients will email W-2s, bank statements and ID scans if you let them. Email is easy to misdirect and hard to secure end to end. A client portal, or encrypted file requests through Microsoft 365 or your practice software, gives you:

• Encrypted upload and download, which supports the encryption requirement
• A record of who sent and opened what
• Automatic expiry of shared links
• Less sensitive data sitting in staff inboxes

Set a firm rule: no tax documents by plain email in either direction, and publish it on your engagement letters and website.

Remote and seasonal staff

Many firms add seasonal preparers and let staff work from home in peak weeks. Each of those people is a new way in.

• Give seasonal staff their own named accounts. Never share a login, even for a few weeks.
• Use company laptops where you can. If personal computers are allowed, require endpoint protection and keep client data in managed apps or a hosted desktop, not on the local drive.
• Put remote access behind multi-factor authentication, and avoid leaving remote desktop open to the internet.
• Set an end date on every seasonal account when you create it, so access stops on schedule.

The threats that hit accounting firms

• Phishing that impersonates clients or the IRS, aimed at stealing logins to tax software or e-file accounts.
• Account takeover on email, followed by fake requests to change a client’s refund or payment details.
• Ransomware timed for February to April, when firms are most likely to pay to get back to work.
• Former staff who still have access to portals, tax software or shared mailboxes.

Multi-factor authentication everywhere, endpoint protection, email filtering and same-day removal of leavers address most of this. Our employee offboarding checklist covers the last point step by step.

Is your firm ready for the next filing season? Accounting firms often find gaps in backups or remote access only when the pressure is on. Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your IT operations, cybersecurity, applications, business continuity and technology spending, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.

A pre-season IT checklist

Run this in November or December, before the January rush.

1. Install this year’s tax software updates and test e-file connections.
2. Test a full restore from backup, not just a backup report. Our backup and disaster recovery guide explains how.
3. Replace computers that are failing or near end of support.
4. Check scanners, printers and multi-monitor setups at every desk.
5. Review who has access to tax software, portals and shared folders. Remove anyone who no longer needs it.
6. Confirm multi-factor authentication is on for email, remote access and tax software.
7. Update your WISP and walk staff through it in a short training session.
8. Agree on a change freeze from late January to mid-April, so no non-urgent upgrades happen during peak weeks.

Repeat a shorter version before the October extension deadline.

What to ask an IT provider

• Have you supported firms with our tax and accounting software?
• How fast do you respond during filing season, and does that change after hours?
• Can you help us write and maintain our WISP, and support whoever serves as our Qualified Individual?
• How do you test restores, and how often?
• Can you help with cyber-insurance questionnaires?

JLB USA provides managed IT for firms with roughly 25 to 100 employees, including multi-factor authentication, access reviews, encryption, monitored backups with tested restores, a written recovery plan and help with insurance questionnaires. We reply within 5 minutes by email or phone, with on-site help in Atlanta, Birmingham and Chattanooga and remote support everywhere else.

Keep reading

• IT support for dental offices: imaging, practice software, backups and HIPAA basics
• IT support for construction companies: job sites, field devices and protecting bids
• Mobile device management for small business: what it does and how to roll it out
• Employee offboarding checklist: the IT and security steps

Related services

• Managed IT services
• Cybersecurity services
• Backup and disaster recovery
• Cyber insurance requirements in 2026