Industry guide

Managed IT diligence for accounting firms.

Firms hold client financials, payroll, and enough personal tax data to reconstruct anyone's identity. The federal government treats tax professionals as financial institutions: a written information security plan is required, and a firm's busiest weeks are exactly when an outage or a compromise costs the most.

What binds you

The frameworks

FTC Safeguards Rule (GLBA)The frameworkThe financial-institution security program requirement that covers professional tax preparers.
IRS written information security planThe frameworkThe WISP every professional preparer must maintain, per IRS Publication 4557.
State CPA board rulesThe frameworkLicensing-level confidentiality duties that vary by state.

The industry question

Will you help build and maintain the WISP, and is that inside the monthly fee?

It belongs on the checklist, in writing, next to the other 18.

The method

The bench, applied

Observe

The tactics

Lock-in contracts, stripped quotes, and exit traps, documented in the industry's own words with checkable sources.

See the tacticsAdapt

The standard

Fourteen marks of a fair managed IT agreement, stated plainly and provider-neutral.

See the standardProtect

The benchmark

The four-step method and the 18 questions to ask in writing, with a printable checklist.

Use the benchmark

Your state

Accounting Firms, state by state

The same diligence with your state's verification layer: the breach statute, the entity search, the regulator.

Choose your state

Educational reference, not legal advice. Frameworks are summarized at the framework level; confirm specifics for your situation with counsel or the primary source.