Accounting firm IT support for everything but the returns

No vendor can hand you compliance, and you should be suspicious of one that promises it. Under the FTC Safeguards Rule, tax preparers and CPA firms are financial institutions, and the rule expects a written information security plan, a WISP, that belongs to the firm. What we do is implement and document the technical controls that plan calls for: multi-factor authentication, encryption, access logging, monitored and tested backups, offboarding that actually happens. IRS Publication 4557 and the IRS Security Six cover the same ground in tax-practice terms, and we work in that vocabulary with whoever owns your plan.

With a calendar, not promises. A readiness pass in the fall: restore tests run, workstations updated, spares staged, seasonal accounts built before the first W-2 arrives. A freeze once filing opens, so nothing changes underneath a working firm. Monitoring through the season that reports trouble while it is still small. We do not promise nothing will break; we make sure the season starts on equipment that has been proven and stays watched.

As a lifecycle, not a scramble. Seasonal staff get named accounts built before the first day, multi-factor authentication from the first login, and access scoped to the role. The end date is recorded when the account is created, and in May the accounts are disabled and you get that confirmed in writing. Accounts that appear in January and quietly live forever are among the first things we find at a new firm.

Plenty. The application belongs to its vendor and the hosting belongs to the host; everything the session rides on is ours: the internet connection and the firewall, the workstations and scanners, identity and MFA, email and its retention, and the local files that never made it into the hosted environment. When the host’s support line says the problem is on your end, we pick up that ticket and work it with them instead of leaving a partner to referee.

The honest answer is that the outcome was decided before the laptop went missing. On machines we manage, the disk is encrypted, so a thief holds hardware rather than client files; the device can be wiped remotely the next time it touches the internet; and named accounts tell us exactly what it could reach. From there the firm’s own incident response plan, the one in its WISP, drives any notification decisions, working from facts instead of guesses. We will not pretend a lost laptop is nothing. Preparation is what turns it from a disclosure question into a hardware purchase.

Hourly for project work, or a flat monthly rate for full coverage, with the price in writing before work starts. Our published plans run $65, $80 and $99 per user per month; what each includes is on the MSP packages page. Firm specifics, like seats that double in January and empty out in May, get priced in the first conversation.

No, and we would rather not. Co-managed is a normal arrangement here: your person keeps what they are good at, often the tax software and the way the firm actually works, and we carry the rest, monitoring, backups, security and the helpdesk depth one person cannot provide in the middle of March. Who owns what goes on paper, so nothing falls between two chairs.

No, that is the arrangement we expect. Firms grow by merger, and each acquired practice tends to arrive with its own server, its own backup tool and its own password spreadsheet. Every office goes onto the same monitoring, the same backup standard and the same helpdesk, so the whole firm behaves like one office with long hallways. The multi-location version of this page is our multi-site IT support page.