An accounting practice runs on two things: client trust and a calendar that doesn’t move. Between January and the April and October deadlines, a frozen tax-software server or a locked-out partner costs billable days you can’t get back. The rest of the year, your file server and inboxes hold exactly what identity thieves want most: Social Security numbers, bank account details, W-2s and prior-year returns.
Aspendora Technologies has supported Houston-area businesses from our La Porte office since 2010. For CPA firms, tax preparers and bookkeepers, we keep the systems running through busy season and put real security controls behind the data security plan the law already expects you to have.
Most firms can live with a slow computer in July. Nobody can in the second week of April. We plan around your calendar: hardware is replaced and major upgrades are done before the season starts, updates are scheduled so they don’t interrupt preparers mid-return, and your tax, write-up and document-management software is checked for its annual updates before you need it. When something does break, you reach a local team that already knows your setup.
Tax season brings a predictable wave of phishing: fake client emails with “my documents are attached,” messages impersonating the IRS or your software vendor, and new-client inquiries designed to get a preparer to open a malicious file. A single stolen password can let a criminal read your mail, file fraudulent returns using your clients’ data, or send your clients fake payment instructions from your real address. See phishing threat patterns in Houston’s professional services.
Clients will email a photo of a W-2 if you let them. We help you give them a better option, whether that is the portal built into your tax or practice-management software or secure sharing in Microsoft 365, and we set up Microsoft 365 message encryption so staff can send sensitive documents from Outlook when email is the only practical choice.
If you prepare tax returns or provide certain financial services, the FTC Safeguards Rule (part of the Gramm-Leach-Bliley Act) treats your firm as a financial institution. Since the 2021 amendments took full effect in 2023, it requires a written information security program, a designated qualified individual to oversee it, a risk assessment, access controls, multi-factor authentication for anyone accessing customer information, encryption of customer information, staff security training, oversight of your service providers, and an incident response plan. Firms holding information on fewer than 5,000 consumers are exempt from a few provisions, such as the written risk assessment, the incident response plan and the annual report, but not from having the written program itself. Since May 2024, a security event involving unencrypted information of 500 or more consumers must also be reported to the FTC within 30 days of discovery.
The IRS reinforces this. IRS Publication 4557, Safeguarding Taxpayer Data, explains the protections tax professionals are expected to have, and the IRS and its Security Summit partners publish a sample written information security plan (WISP) for small practices in Publication 5708. The PTIN renewal also asks preparers to confirm they know about their obligation to have a written data security plan.
A WISP is only as good as the controls behind it. We implement and document those controls so your plan describes what actually happens in your office. Read more in the FTC Safeguards Rule for tax preparers and accountants and what a real WISP looks like, or see our compliance services. We are your IT and security partner, not your attorney; we work alongside your legal and insurance advisors.
Multi-factor authentication and Conditional Access on every Microsoft 365 account, a hardened security baseline, and around-the-clock monitoring of sign-ins for account takeover, such as logins from unexpected countries or new mailbox rules that hide replies. A compromised account can be locked and its sessions revoked quickly. See our cybersecurity services.
An advanced filtering layer catches the phishing and malicious attachments that get past Microsoft’s own filters, and SPF, DKIM and DMARC are set up and monitored so criminals can’t easily send email that appears to come from your firm to your clients.
Endpoint detection and response on every workstation and server, watched 24/7 by a security operations center, plus regular patching of Windows and third-party software. Staff work without administrator rights, and laptops are encrypted with BitLocker so a lost laptop doesn’t become a reportable breach.
Partners and seasonal staff reach the office tax server through zero-trust remote access instead of a VPN or an exposed remote desktop port. Each person gets only the systems they need, and access can be switched off as soon as a seasonal employee leaves.
Your tax and document-management data is backed up to immutable offsite storage that ransomware can’t encrypt or delete, and Microsoft 365 email, OneDrive and SharePoint are backed up separately, because Microsoft doesn’t do that for you. See data backup and recovery and Microsoft 365 backup.
Short security lessons and simulated phishing emails give your staff practice spotting the lures they’ll see between January and April, and give you training records for your WISP.
Already have an IT person, or a partner who handles the technology? Our co-managed IT adds the security layer and after-hours coverage without replacing them. For everything else, see managed IT services.
The server, the scanner or the tax software fails in March, when every hour is billable and every deadline is fixed.
Fake client documents and IRS look-alike emails target preparers exactly when they’re busiest and least suspicious.
You have a written plan, or a template of one, but no one could show an examiner or insurer the controls it describes.
Tell us how your practice works: your software, your busy-season staffing, and how clients send you documents.
We review your systems against the FTC Safeguards Rule and IRS guidance and give you a prioritized, plain-English plan.
We run and protect the technology, so tax season is about your clients, not your computers.
For most firms that prepare tax returns, yes. The FTC treats tax preparers as financial institutions under the Gramm-Leach-Bliley Act, so the Safeguards Rule requires a written information security program with specific elements, including multi-factor authentication, encryption, staff training and an incident response plan. Firms with information on fewer than 5,000 consumers are exempt from a few requirements, but not from the written program. Confirm how it applies to your practice with your attorney or professional association; we implement and document the technical side.
A written information security plan (WISP) documents how your firm protects client data: who is responsible, what the risks are, and which safeguards are in place. Tax professionals are expected to have one under the FTC Safeguards Rule, and IRS Publication 5708 provides a sample for small practices. The plan should describe controls you actually run, which is where we come in.
Yes. We support the servers, workstations, networks and Microsoft 365 your tax, write-up and document-management applications run on, whether they are installed in the office or hosted in the cloud, and we work directly with your software vendors’ support teams when an issue is on their side.
By doing the risky work before it starts: replacing aging hardware, applying major upgrades, testing backups and confirming your software’s annual updates in the fall and early winter. During the season, updates are scheduled around your hours and our team monitors your systems so problems are caught early.
Not ordinary email. A client portal, often included with tax or practice-management software, or secure sharing links in Microsoft 365 keeps documents out of inboxes. When email is unavoidable, Microsoft 365 message encryption protects the message. We set up whichever fits your clients and train staff to steer clients toward it.
Act quickly. Contain the problem (we can lock accounts and isolate affected computers), preserve evidence, and notify the people who need to know. IRS Publication 4557 advises tax professionals to contact their IRS Stakeholder Liaison, and Texas law and the FTC Safeguards Rule have their own notification requirements and deadlines. Involve your attorney and your cyber insurer early. See Texas breach notification deadlines.
Small firms hold the same kind of data as large ones, with fewer people to protect it, and the Safeguards Rule applies regardless of size. Managed IT gives a small practice the monitoring, backups and security controls of a larger firm on a predictable monthly plan. See managed IT services.
Book a free discovery call, ideally well before busy season. We’ll learn how your practice works, review your current protections against the FTC Safeguards Rule and IRS guidance, and give you a clear, prioritized plan. Prefer to talk now? Call 281-941-4028.
Book a free 15-minute discovery meeting. No pressure, no obligation.
We ask before we track you.
Nothing from Google, Microsoft, or Meta loads on this site unless you say yes. We keep basic, cookieless visit counts on our own server either way. Details in our Privacy Policy.
Essential site function and first-party, cookieless visit counts run either way and can't be switched off here.
