IT Services for Accounting and Financial Services Firms

Here’s something that should get the attention of every CPA firm, tax preparer, financial advisor, and bookkeeping firm in the Inland Empire: if your firm is covered by the FTC Safeguards Rule, it has specific, mandatory IT security requirements. It’s not a suggestion. It’s federal law.

We start with the rules your firm actually answers to: the FTC Safeguards Rule, the written security plan (WISP) it requires, and the compliance landscape accounting and financial services firms operate in. Then we build the IT to match.

The FTC Safeguards Rule Changed Everything

The updated FTC Safeguards Rule that took effect in June 2023 isn’t the vague “have reasonable security” standard that existed before. It now requires specific controls:

• A designated qualified individual responsible for overseeing your information security program
• Risk assessment documented and regularly updated
• Access controls limiting who can access customer financial information
• Encryption of customer information both in transit and at rest
• Multi-factor authentication (MFA, meaning two forms of verification to log in) for anyone accessing customer data
• Continuous monitoring, or annual penetration testing plus vulnerability assessments at least every six months
• Incident response plan that’s written down and ready to use
• Vendor management ensuring your service providers maintain appropriate safeguards
• A written report to your board (or equivalent governing body) from the qualified individual, at least once a year
• Notification to the FTC within 30 days of discovering that unencrypted customer information of 500 or more consumers was acquired without authorization; unauthorized access counts as acquisition unless you have reliable evidence otherwise (added in 2024)

Firms that hold information on fewer than 5,000 consumers are exempt from a few of these: the written risk assessment, the penetration-testing and vulnerability-assessment schedule, the written incident response plan, and the annual report.

If you’re reading that list and thinking “we don’t have half of this,” you’re not alone. Small firms rarely have the time to build all of it, and that’s exactly the gap we fill.

Your WISP Needs to Be More Than a Document

Covered tax-preparation firms must keep a WISP (Written Information Security Plan), and IRS Publication 5708 offers guidance and a sample template. A lot of firms downloaded a template, filled in the blanks, and stuck it in a drawer. That’s not compliance. That’s theater.

A real WISP needs to reflect your actual security controls, your actual procedures, and your actual risk environment. It needs to be reviewed and updated regularly. And most importantly, the controls described in your WISP need to actually exist in your IT environment.

We help firms build WISPs that are living documents tied to real, implemented security controls. When your WISP says you encrypt client data, we make sure your systems actually encrypt client data. When it says you have an incident response procedure, we make sure there’s a tested, documented process ready to go.

Tax Season Is Not the Time for IT Problems

We’ve been doing this long enough to understand the rhythm of an accounting firm. January through April is go-time. October extension deadlines add another peak. During those windows, every minute of downtime costs billable hours that you can never recover.

Our approach to tax season preparedness:

Pre-season infrastructure review. Before busy season, we audit your hardware, verify backups, check storage capacity, update software, and identify anything that might cause a problem when you can least afford it.

Change freeze during peak periods. We don’t push Windows updates or make infrastructure changes during tax season unless something is critical. Your systems stay stable when stability matters most.

Priority support. Your team gets escalated response times during busy season because we understand that a down workstation on March 15th isn’t the same as a down workstation in June.

Performance optimization. Tax software and accounting platforms like QuickBooks, Drake, Lacerte, and ProSeries can be resource-intensive. We make sure your infrastructure can handle the load when every user is running at full speed.

Secure Client Data Exchange

Let’s talk about how your clients send you their W-2s, bank statements, and tax documents. If the answer is “they email them to us,” that’s a problem. Unencrypted email is about as secure as a postcard. Anyone handling it along the way can read it.

We help firms implement secure client portals where clients can upload sensitive documents through an encrypted connection. No more tax returns sitting in someone’s Gmail inbox. No more bank statements attached to unencrypted emails bouncing across the internet. Your clients get a professional, easy-to-use upload experience and you get the peace of mind that their data is protected from the moment they send it.

The Security Stack Your Firm Actually Needs

Financial services firms are high-value targets. Attackers know you have Social Security numbers, bank account details, income information, and everything else needed for identity theft. We protect your firm with the same tools and monitoring that protect much larger organizations:

Huntress EDR on every endpoint, monitored 24/7 by a Security Operations Center. Advanced email security that catches the phishing attempts that specifically target accounting firms (and there are a lot of them, especially during tax season). Microsoft Intune managing every device, including the laptops your team uses to work from home during crunch time. DLP policies (Data Loss Prevention, rules that prevent sensitive data from being shared improperly) that stop accidental data exposure before it happens.

Why IE Financial Firms Choose eTop

Keeping computers running and email working is table stakes for any MSP (Managed Service Provider). What we add is sitting down with you, walking through the FTC Safeguards Rule requirements line by line, and building a compliance roadmap specific to your firm.

We’ve been doing IT in the Inland Empire since 2011. A breach at a firm that holds tax returns means notification letters, regulator questions, and clients who stop trusting you. Getting ahead of it is straightforward, affordable, and exactly what we do every day.

If you’re a CPA firm, tax preparer, financial advisor, or bookkeeper in the IE and you’re not sure where you stand on FTC Safeguards compliance, that’s the first conversation we should have.