IT Services for Accounting and CPA Firms

What IT services for accounting firms include

IT services for accounting firms cover day-to-day help desk work plus three needs specific to the profession. Tax software has to work every day from January to April, a federal security rule applies to tax preparers of every size, and a steady flow of client documents needs a safe way in and out of the firm.

Typical scope for IT support for CPA firms:

• Tax, write-up, payroll and practice management software support, including annual version installs.
• Client portal and secure file exchange.
• Remote access for staff who work from home in busy season.
• MFA, endpoint protection, email security and encryption.
• Backups with tested restores before filing deadlines.
• Help writing and maintaining the firm's written information security plan.

Typical published ranges for fully managed IT are $100 to $250 per user per month, with security-heavy plans reaching $300 or more ³⁴. Seasonal staff matter for pricing: ask whether you can add and remove users month by month, or whether you pay for peak headcount all year. Our managed IT pricing guide explains common contract models.

The FTC Safeguards Rule for accounting firms

The FTC Safeguards Rule treats an accountant or tax preparation service that completes income tax returns as a financial institution, so most CPA and tax firms must run a written information security program ¹. The rule implements the Gramm-Leach-Bliley Act, and the FTC's business guide summarizes it as nine elements ⁷.

The parts your IT provider will carry out or document:

• A Qualified Individual to oversee the program. That person can work for the firm, an affiliate or a service provider, but the firm stays responsible ¹.
• A written risk assessment ¹.
• Encryption of customer information in transit and at rest, unless infeasible and a compensating control is approved ¹.
• MFA for anyone accessing any information system ¹.
• Monitoring and testing: continuous monitoring, or else annual penetration testing and vulnerability assessments every six months ¹.
• Service provider oversight, staff training and a written incident response plan ⁷.
• An annual written report from the Qualified Individual to the partners or board ¹.

Firms that hold customer information on fewer than 5,000 consumers are exempt from four provisions (the written risk assessment, the monitoring or pen testing requirement, the written incident response plan and the annual report), but MFA, encryption and the rest still apply ¹. Since May 13, 2024, firms must also notify the FTC within 30 days of discovering unauthorized acquisition of unencrypted information about 500 or more consumers ¹. Confirm how the rule applies to your firm with counsel.

IRS Publication 4557 and your WISP

The IRS expects every paid preparer to have a written information security plan (WISP), and it publishes the guides to build one. Publication 4557, Safeguarding Taxpayer Data, says tax return preparers must create and enact security plans to protect client data, and that protecting taxpayer data is the law ⁵. Publication 5708 is a sample WISP template aimed at smaller practices; it says tax and accounting professionals are financial institutions regardless of size and that a sole practitioner can use a shorter plan than a 10-partner firm ². Publication 5709 is a shorter how-to companion ⁸.

In August 2026 the IRS and Security Summit repeated that federal law requires tax and accounting professionals to create and maintain a WISP ⁹.

A WISP is only useful if it matches what the firm actually does. A good IT provider helps by supplying:

• An inventory of devices, software and cloud services that hold client data.
• A description of the safeguards in place (MFA, encryption, EDR, backups).
• Access lists showing who can reach what.
• The incident response steps and contacts.

Our written information security plan guide walks through each section of a WISP.

The PTIN W-12 data security question

Form W-12, the PTIN application and renewal, includes a Data Security Responsibilities question on line 11. Preparers check Yes or No to a statement that they are aware paid tax return preparers are required by law to create and maintain a written information security plan ⁶.

Two practical points:

• The question asks about awareness, not approval. Answering it does not mean the IRS has reviewed your plan. It does put on record that you knew the requirement existed.
• Answer it truthfully, then close the gap. If the firm has no WISP at renewal time, the fastest path is Publication 5708's template ², filled in with the facts from your IT provider. Then turn on the controls it describes.

Each PTIN renewal is a natural point to review the WISP and update it for new staff, software and vendors.

Tax season uptime and client portals

Accounting firm IT has to be most reliable in the weeks when the firm can least afford a visit from IT. That means doing the work early. Before January each year:

• Install and test new tax software versions on every workstation.
• Replace aging laptops and anything still on Windows 10, whose support ended October 14, 2025 ¹⁰.
• Run a full restore test of the tax database and document storage. CISA advises small organizations to regularly test partial and full restores ¹¹.
• Confirm the support plan covers evenings and weekends through the filing deadlines.
• Freeze nonessential changes from late January to the April deadline.

Client portals deserve the same attention. Clients send W-2s, brokerage statements and Social Security numbers, and email attachments are the wrong channel for them. A portal with MFA for both staff and clients, automatic expiration of shared links, and an audit log is the safer route, and it helps with the Safeguards Rule's encryption requirement ¹.

Backups for a firm of 20 to 50 people run $300 to $800 a month for managed backup alone and $500 to $1,200 with quarterly DR testing, according to one provider's 2026 guide ¹². Our backup and disaster recovery guide compares options.

Cybersecurity for accounting firms: BEC and client data

Accounting firms face the same email fraud that hits every business, with the added risk that criminals use the firm's mailbox to target its clients. The FBI recorded about $3.05 billion in business email compromise losses across 24,768 complaints in 2025 ¹³. Fake requests to change direct deposit details, redirect refunds or pay a vendor all arrive by email.

Controls that matter most:

• MFA on email, tax software and the client portal. Microsoft research found MFA cuts the risk of account compromise by 99.22% ¹⁴.
• Callback verification for any change to bank details, using a number already on file.
• Endpoint detection and response on every device.
• Email security and phishing training timed before tax season.

Firms that do work for healthcare clients should also know HIPAA can reach them as business associates. In August 2025 OCR announced a $175,000 settlement with BST & Co. CPAs, LLP, an accounting firm, in what it called its 15th ransomware enforcement action ¹⁵.

For a fuller security plan see cybersecurity for small business and managed security services. To compare providers, use our guide to choosing an MSP. Firms with investment advisory or lending arms should also read our financial services IT page, and other sectors are on the industries overview.