IT challenges accounting firms face
Accounting and CPA firms hold Social Security numbers, financial statements and tax returns for every client. Professional tax preparers are required to have a written information security plan, and the busiest weeks of the year are exactly when a slow server or a phishing email does the most damage.
- Written information security plan — Tax professionals must maintain a written data security plan under the FTC Safeguards Rule and IRS guidance.
- Tax-season peaks — Applications, servers and remote access have to perform when every preparer is working at once.
- Phishing aimed at preparers — Tax season brings targeted phishing and account takeover attempts against firms.
- Secure client file exchange — Clients sending documents by email instead of a secure portal.
How we support accounting firms
- Compliance
Written information security plan
We implement and document the safeguards behind your WISP — MFA, encryption, access controls, monitoring and incident response.
WISP · IRS Pub 4557 - Systems
Tax and accounting application support
Servers, hosted environments and workstations for tax, practice management and accounting software, updated ahead of filing deadlines.
Tax · practice management - Remote
Secure remote work
Remote access for preparers and partners that’s fast during busy season and protected with MFA.
VPN · remote desktop - Security
Phishing and account protection
Email security, MFA, phishing training and managed detection and response across every device.
MxDR · email security - Files
Secure client portals and file sharing
Encrypted file exchange and portals so client documents never travel as email attachments.
Encryption · portals - Recovery
Backup and fast recovery
Backups of servers, files and Microsoft 365 with tested recovery, so a failure in March doesn’t become a missed deadline.
Backup · DR
Ready before tax season starts
We plan upgrades, hardware refreshes and software updates for the slower months so your systems are ready before January. During busy season our service desk is staffed from 5 AM to 6 PM on weekdays and the same local team is on call 24×7 for emergencies, with a 20-minute engineer response on every ticket — because waiting on IT during the final week before a deadline isn’t an option.
Tax software, client portals and the IRS rules behind them
Most firms run a mix of professional tax and practice applications — CCH Axcess or CCH ProSystem fx, UltraTax CS and the rest of the Thomson Reuters CS Professional Suite, Lacerte, Drake or Intuit ProConnect — alongside QuickBooks, document management and a client portal such as SmartVault, ShareFile or NetClient CS. Some run on an office server, some are hosted and many firms use both. Each has its own update calendar, and the federal updates that arrive in January can’t wait.
The rules are specific. The FTC Safeguards Rule treats tax preparers as financial institutions. It requires a written information security plan, a qualified individual to oversee it, multi-factor authentication for anyone accessing customer information and encryption of that information. Since May 13, 2024, it also requires notice to the FTC within 30 days of discovering a breach involving unencrypted information of 500 or more people. IRS Publication 4557 explains the safeguards, and Publication 5708 provides a sample plan you can adapt.
We map those requirements to your actual environment: MFA on tax software, email and remote access; encrypted laptops and backups; a secure portal in place of email attachments; and documented access reviews when seasonal staff come and go. Then we help write it into your plan, so your WISP describes what’s really in place. See our security and compliance services.
Why Accounting firms choose CAL IT Group
- Response
A real engineer in under a minute
96%LIVE of calls answered by an engineer in under 60 seconds, and a 20-minute engineer response on every ticket — numbers we publish live on our homepage, because we’re proud of them.
Live metrics · fully transparent - Security
SOC 2 Type II attested
Our own operations are independently audited across all five Trust Services Criteria, and our full security stack with 24×7 NOC & SOC monitoring is included in Managed Care.
24×7 NOC & SOC - Local
Your team, in Huntington Beach
Over 10 years in business, grown 100% organically, with a 100% local team that learns your firm, your applications and your people — with on-site support included.
No call center - Pricing
One all-inclusive per-user price
Help desk, monitoring, security and backups in one predictable monthly price, published on our website — no surprise invoices.
See your price
Related services: security and compliance, IT help desk and private cloud management.