Skip to content
VITI Security
Contact

Industries · CPA Firms

IT support for CPA firms, plus the WISP the FTC Safeguards Rule requires.

Managed IT, cybersecurity and secure client file sharing for CPA and tax firms, plus a written information security plan built to IRS Publication 4557 and the FTC Safeguards Rule. Tax-season uptime planned for the busiest 90 days of the year.

Get a fixed WISP quote →Book a call

What CPA firms ask us for

What our IT support for CPA firms covers.

Your WISP, written with you

A Written Information Security Plan built to the FTC Safeguards Rule and IRS Publications 4557 and 5708. We build the safeguards and write the plan; you adopt and sign it.

Secure client portals

Encrypted file sharing - no more emailing 1099s. SOC 2-aligned audit trail.

Tax-season uptime

Engineered for Jan-Apr load: pre-tested failover, on-call rota, 24×7 monitoring during the season.

Email + endpoint security

M365 + Google Workspace hardening. Phishing simulations. Endpoint EDR.

Beyond the basics

Why CPA firms hire us as their IT support partner of record.

We handle the year-round substrate so partners can bill instead of firefighting tech tickets.

Engagement-document encryption

Workpapers, 1040s, K-1s, audit files - encrypted at rest in M365 / Google Workspace. Retention policies aligned with AICPA record-retention guidance and your state board rules.

Multi-factor everywhere

MFA enforced on every employee account, every admin console, every third-party app (CCH Axcess, ProSystem fx, UltraTax, QuickBooks Online). Hardware tokens for partner accounts. Backup codes vaulted in 1Password Business.

Phishing-resistant culture

Quarterly phishing simulations tuned to CPA-specific scams: fake IRS notices, fake bank wire requests, fake client document-sharing emails. Click rates published per-team so it stays visible.

Practice management integration

Single sign-on between Karbon / Canopy / Mango Practice and Microsoft 365. We wire the SCIM provisioning so terminated staff lose access in minutes, not days.

Backup + disaster recovery

Immutable cloud backups of M365 (Datto / Backupify) - IRS Pub 4557 calls for this, and many firms overlook it. Tested restore drill every quarter; report goes to your managing partner.

Vendor + sub-processor inventory

A living list of every SaaS that touches client PII. We update it as you add tools, so when a vendor breach hits the news (it will), we already know your blast radius.

What we commit to in year one

6 weeks
Target from kickoff to a signed WISP
Jan 15
Tax-season readiness deadline we plan to
< 2 hr
Tax-season ticket response target

CPA firm IT FAQ

Do we already have to be IRS WISP-compliant?
Yes. Under the Gramm-Leach-Bliley Act and the FTC Safeguards Rule, tax and accounting professionals count as financial institutions regardless of size, and the rule requires a written information security plan. IRS Publication 5708 sets out what one should contain. We build it to the FTC Safeguards Rule and IRS Pub 4557. (The IRS does not review or approve WISPs - your firm holds and signs it.)
Can you work with our existing CAS / outsourced bookkeeping team?
Yes. If your firm uses an offshore bookkeeping team, in India, the Philippines or elsewhere, we layer security on top so those engagements are auditable. We are vendor-neutral and have no conflict.
What about state-specific rules (NY DFS, Massachusetts 201 CMR 17, California CCPA / CPRA)?
Built into the WISP. We tailor the plan to your client geography so you do not get caught between conflicting state rules. Annual review covers any new state laws.
What happens during tax season if there is an outage?
Pre-tested failover paths and a tax-season on-call rota (Jan 15 - Apr 30), to keep unplanned downtime to a minimum during peak load.
We also run an SEC-registered advisory practice. Does that change anything?
Yes: SEC-registered investment advisers are also covered by Regulation S-P, which adds its own incident response and customer-notification requirements, so we scope it alongside the WISP (see SEC Regulation S-P compliance).

Further reading

Read more for tax and accounting firms

FTC Safeguards Rule: Naming Your Qualified Individual at a Small CPA Firm

For small CPA firms, the FTC Safeguards Rule mandates a "Qualified Individual" to lead the information security program. This vital role can be filled internally by an owner or senior manager with proper support, or more effectively, by an outsourced virtual CISO.

Penetration Testing for Non-Bank Lenders Under the FTC Safeguards Rule

What the FTC Safeguards Rule requires of mortgage brokers, consumer finance companies and other non-bank lenders: an annual penetration test and six-monthly vulnerability assessments, unless you run continuous monitoring, and who is exempt.

IRS Publication 4557 and the FTC Safeguards Rule: What Tax Preparers Must Do

What IRS Publication 4557 actually says, which parts are recommendations and which the FTC Safeguards Rule makes mandatory, with the IRS checklist and what to do after a data theft.

IRS WISP Checklist: Secure Your Tax Firm Before PTIN Renewal

Every tax preparer needs a robust Written Information Security Plan (WISP) to meet IRS requirements and ensure PTIN renewal. This checklist guides you through the essential controls and best practices.

Stopping Mirage2FA: A Practitioner's Guide to Microsoft 365 Phishing Defense

The Mirage2FA campaign actively bypasses Microsoft 365 MFA by exploiting login flows, putting thousands of organizations at risk. This article outlines concrete defense strategies to protect your SMB from these advanced phishing attacks.

Related: SEC Regulation S-P (for advisers)Managed IT in the US

Ready to get your WISP in place?

Scoping call. Fixed-price proposal. Our target: tax-season-ready in 6 weeks.

Get a fixed WISP quote →Book a call