A written security plan is mandatory
Under the FTC Safeguards Rule, tax preparers must maintain a written information security program, and the IRS asks preparers to confirm it.
IT services for CPA and tax firms in Greater Boston
CMIT Solutions of Boston helps CPA, tax and advisory practices protect client data, meet FTC Safeguards Rule and IRS requirements, and keep tax software running through every deadline.
Ready for tax seasonSystems tuned and tested before the busy season starts.
Local office in NewtonServing Boston, Newton, Waltham and nearby towns- 24/7 monitoring and supportNights, weekends and holidays included
- 900+ CMIT IT professionalsA national network behind your local team
What IT does a CPA or tax firm need?
A CPA or tax firm needs a written information security program as required by the FTC Safeguards Rule and IRS Publication 4557, MFA on all systems, encrypted client portals and email, support for tax and accounting software, tested backups, and a help desk that responds quickly during tax season. Managed IT covers all of these at a flat monthly rate.
Tax professionals carry specific security obligations
The IRS and FTC treat tax preparers as financial institutions responsible for safeguarding client data.
Tax season can't wait
A software or network problem in March or April costs billable hours and deadlines.
Client files are identity-theft gold
Returns contain Social Security numbers and bank details that criminals want.
Clients still email documents
Unencrypted email and file sharing create risk the firm is accountable for.
IT built for accounting practices
Everything your firm needs to protect clients and stay productive through every deadline.
WISP and Safeguards Rule compliance
Written information security program and the controls behind it.
- WISP aligned to IRS Publication 4557
- Designated qualified individual support
- Annual risk assessment and report
Cybersecurity
Protection for returns, financial statements and client identities.
- MFA on every system
- Managed EDR and email security
- Staff phishing training
Tax and accounting software support
Keep your professional software fast and available.
- Support for UltraTax, Lacerte, CCH, Drake and QuickBooks
- Updates tested before busy season
- Hosted or on-premises setups
Secure client portals
Replace emailed attachments with encrypted exchange.
- Client portal setup and training
- Encrypted email
- Secure e-signature
Tax-season help desk
Fast help when deadlines are close.
- Priority support during filing season
- Remote and on-site help
- Seasonal staff onboarding
Backup and retention
Client files and returns backed up and retained.
- Encrypted, immutable backups
- Retention to your policy
- Tested restores
Managed IT
Monitoring and maintenance year-round.
- 24/7 monitoring
- Patching outside business hours
- Vendor management
Phones and remote work
Stay reachable from the office or home.
- Cloud phone systems
- Secure remote access
- Teams and video
Security built into every plan
Every managed IT plan includes these protections, so the basics are covered from day one.
EDREndpoint detection and response on every device- Email securityFiltering for phishing, malware and impersonation
- DNS filteringBlocks malicious and unwanted websites
- Access managementControlled accounts, permissions and directories
- Backup validationBackups checked so restores actually work
- Disaster recovery planA written plan to get you running again
EDREndpoint detection and response on every device
Email securityFiltering for phishing, malware and impersonation
DNS filteringBlocks malicious and unwanted websites
Access managementControlled accounts, permissions and directories
Backup validationBackups checked so restores actually work
Disaster recovery planA written plan to get you running againThe requirements tax professionals must meet
These obligations apply to most CPA and tax practices. We put the technical safeguards in place and document them.
| Standard | What it asks of you | What we put in place |
|---|---|---|
| FTC Safeguards Rule | A written information security program, a qualified individual, risk assessment, MFA, encryption and breach reporting to the FTC for larger events. | WISP, MFA, encryption, risk assessment and reporting support. |
| IRS Publication 4557 | IRS guidance on safeguarding taxpayer data, including creating a WISP. | Controls and documentation mapped to the publication. |
| IRS Publication 5708 | IRS sample template for a written information security plan. | Plan built and maintained with your firm. |
| 201 CMR 17.00 | A written information security program for personal information of Massachusetts residents. | One WISP that covers state and federal rules. |
| AICPA / SOC expectations | Client and peer review expectations about data security. | Documented controls and evidence. |
Which rules apply depends on your organization. We support your compliance program with technical controls and documentation; we don't provide legal advice.
A practical guide to IT for CPA and tax practices
Tax professionals carry specific data security duties and face hard deadlines. These are the practices that keep a firm compliant and productive through every season.
Write the WISP, then live by it
A written information security program is required for tax preparers under the FTC Safeguards Rule. It should describe who is responsible, how client data is protected and what happens after an incident. Our compliance services help write it with you and review it every year before busy season, so it reflects how the firm actually works.
Lock down every login
MFA on email, tax software, portals and remote access blocks most account takeovers. Combine it with managed endpoint protection and email filtering through our cybersecurity services. Stolen credentials are how most tax-season fraud begins.
Get documents out of email
Encrypted client portals and secure email replace attachments that can be intercepted or misdirected. Our cloud services set up the portal and help clients adopt it, which also saves staff time chasing documents.
Prepare systems before January
Test tax software updates, backups and remote access in the fall. Avoid big changes during filing season, and make sure IT support knows which issues are urgent. Tested data backup protects returns and workpapers. For finance departments inside other businesses, see our accounting team IT page, and for advisory firms, our finance and insurance page.
Questions to ask before choosing an IT provider
Ask whether the provider can help write and maintain your WISP, how they support tax software such as UltraTax, Lacerte, CCH or Drake, and how they prioritize issues during filing season. Ask how they would help you report an incident to the FTC and IRS if needed. Our managed IT plans include pre-season system checks, and our network management team keeps office and remote connections fast when your whole team is working long hours.
What the first 90 days look like
In the first month we review where client data lives, turn on MFA across email, tax software and portals, and start your written information security program. The second month moves client document exchange onto an encrypted portal, tests backups and confirms remote access is secure. By the third month, monitoring and help desk support are running, your WISP is complete and reviewed, and tax software and systems are checked ahead of busy season. We time major changes for after filing deadlines, so your staff never has to learn a new system in the middle of tax season.
Your WISP, written and kept current
Tax preparers are expected to have a written information security plan. We build it with you and keep it accurate as your firm changes.
- Inventory of client data and where it lives
- Risk assessment with a remediation plan
- Access, MFA and encryption controls documented
- Incident response plan including FTC reporting
- Annual review before tax season
Local IT support that respects your deadlines
Locally owned and operated in Newton, MA
We support CPA and tax firms across Greater Boston and plan our work around the filing calendar, so your busy season is quiet for IT.
You get a named local team that learns your people and systems, backed by more than 900 CMIT IT professionals nationwide. We serve Boston, Newton, Waltham, Allston, Brighton, Brookline, Weston, Watertown, Needham, Wellesley and Burlington.
- 275 Grove Street, Ste 2-400, Newton, MA 02466
- (617) 657-1075
How we get started
Major changes are scheduled after tax season.
Assessment
Review of systems, client data handling and security.
WISP and plan
Written security program and remediation plan.
Off-season rollout
Upgrades and migrations outside peak weeks.
Managed operations
Monitoring, help desk and a pre-season check every year.
Does our firm need a written information security plan?
Yes. The FTC Safeguards Rule requires tax preparers to maintain a written information security program, and the IRS asks preparers to confirm they have one. We help write the plan and put the required controls in place.
What does the FTC Safeguards Rule require?
It requires a qualified individual to oversee security, a written risk assessment, safeguards such as MFA and encryption, staff training, vendor oversight, an incident response plan and, for larger breaches, notification to the FTC. We handle the technical parts and documentation.
Do you support our tax and accounting software?
Yes. We support UltraTax, Lacerte, CCH, Drake, QuickBooks and similar applications, including updates, hosting and troubleshooting, and coordinate with vendors when needed.
How do you keep us running during tax season?
We test updates and systems before busy season, avoid non-urgent changes during peak weeks and give tax-season issues priority handling, so problems are fixed quickly when deadlines are close.
How can clients send us documents securely?
We set up an encrypted client portal and encrypted email, and help you train clients to use them, which replaces risky email attachments.
What should we do if client data is compromised?
Contact us immediately. We contain the incident, preserve evidence and support the notifications your counsel determines are required, including reporting to the IRS and the FTC where applicable.
How is pricing structured?
Managed IT is billed at a flat monthly rate per user, agreed in writing after the assessment, so you know your costs before busy season.
What happens during the free IT assessment?
We review your network, devices, backups, Microsoft 365 or Google Workspace setup and security controls, then give you a written summary of risks ranked by business impact and a clear list of what to fix first. There is no cost and no obligation, and for cpa and tax firms we include the compliance requirements that usually apply to you.
Can you work alongside our in-house IT person?
Yes. Many clients keep an internal IT person and use us to extend their team. We can take on monitoring, security, backups, after-hours coverage or specific projects, so your internal staff can focus on the work that needs someone on site every day.
Is support available on nights, weekends and holidays?
Yes. Systems are monitored 24/7, and you can reach our support desk at any time of day, including nights, weekends and holidays. Urgent issues are handled immediately, and our local team comes on site when a problem needs hands-on work.
Which areas of Greater Boston do you serve?
Our office is at 275 Grove Street in Newton. We support organizations in Boston, Newton, Waltham, Allston, Brighton, Brookline, Weston, Watertown, Needham, Wellesley and Burlington, plus surrounding communities. Remote support covers every location, and on-site visits are scheduled when hardware or a site survey requires it.
Protect your clients before the next filing season
Book a no-obligation IT and WISP assessment with a written summary of what to fix first.
- Review of your network, devices, backups and security
- Risks ranked by their impact on your day-to-day operations
- Compliance requirements that apply to you
- A written plan for what to fix first
Prefer to talk?(617) 657-1075
Visit us275 Grove Street, Ste 2-400, Newton, MA 02466