Accounting and CPA Firms
Round the Clock Security Monitoring for Firms That Hold Their Clients' Tax Data.
Attackers go after tax professionals because one office holds hundreds of identities. Our managed detection and response watches your systems around the clock and acts when something is wrong.
For accounting firms with sensitive client data and no security team of their own.
Managed Security Monitoring (MDR and SOC) for Accounting and CPA Firms
Why Do Attackers Target Tax Professionals?
Because a firm's files contain what fraudsters need to file a believable return in someone else's name: names, Social Security numbers, dates of birth and bank details. The IRS has said that data thefts at tax professionals' offices are on the rise and that every tax professional needs data security, as stated in IRS Publication 4557.
That is the reason monitoring matters here. A quiet intrusion that sits in a mailbox or file server for weeks is the worst case, and detection is what shortens it.
What Do You Watch?
Logs and alerts from your endpoints, Microsoft 365 accounts and network, 24/7. Analysts look for the signs that matter to a firm like yours: a sign-in from somewhere unusual, a new mailbox forwarding rule, a bulk download of client files, a program that should not be running on a preparer's workstation.
When something looks wrong they act: isolate a device, disable an account, stop a process, and tell you what happened in plain language.
What Does Monitoring Have to Do With the Safeguards Rule?
The FTC Safeguards Rule asks for safeguards that include regular testing or monitoring of the program, and for a written incident response plan. Monitoring and incident response are the working parts of both. We run them; the written program and formal compliance work sit with our Compliance Division. Confirm with your counsel how the rule applies to your firm.
What If There Is an Incident During Filing Season?
You hear from us, and the response has already started. Your incident response plan is written ahead of time so everyone knows who decides what, including who calls your insurer, your counsel and, where required, the regulators. Under the FTC Safeguards Rule, certain breaches of unencrypted customer information must be reported to the FTC, so knowing quickly what was touched matters.
What Is Included
6 PARTS24/7 SOC Monitoring
Logs and alerts from cloud, network and endpoints watched around the clock.
Managed Detection and Response
Analysts who investigate and act, not just forward an alert.
Incident Response
A formal plan, and a team that runs it with you.
Threat Detection on Accounts
Suspicious sign-ins and mailbox rules flagged and acted on.
Reporting
What we saw and what we did, in plain language.
Ransomware and Phishing Defense
Detection tuned to the attacks small firms see most.
How Managed Security Monitoring (MDR and SOC) Works for Every Client
Frequently Asked Questions
4 QUESTIONSIs monitoring enough to protect a CPA firm?
No, and we do not sell it that way. It works on top of the basics: multi-factor authentication, endpoint protection, patching, backups and trained staff. Managed security is the program that keeps all of those in place.
Who responds when an alert fires?
Our security team. Alerts go to analysts who investigate, not to an inbox nobody reads.
Will this tell us if client data was taken?
It is designed to detect the signs of intrusion early and to give you the evidence of what was accessed. No monitoring can promise to catch everything, and we say so up front.
Does a firm our size need a SOC?
Small firms hold the same kind of data as large ones. We provide the monitoring as a service so you do not have to staff it. We scope it on the call.
More for Accounting and CPA Firms
Managed IT and Help Desk
Unlimited remote support, monitoring and maintenance at a fixed monthly cost.
Microsoft 365 and Email Security
Microsoft 365 set up, secured and run, with email protection against phishing and spoofing.
Microsoft 365 and Email Security for Accounting and CPA Firms
Backup and Ransomware Recovery
Encrypted, off-site backups that are tested, and a plan to restore the business after an attack.
Virtual CISO (vCISO)
Senior security leadership, a roadmap and governance, without a full-time hire.
Accounting and CPA Firms
Managed IT and security for CPA firms, with the WISP and FTC Safeguards Rule in view.
Talk Through Monitoring for Your Firm.
Pick a time. Tell us what systems hold your client data and who watches them today.
Looking for CMMC? Our Compliance Division, Capital Cyber Compliance, delivers it.
Under 25 people? Apply for an in-kind cybersecurity grant from Cyber Grants Alliance, a nonprofit. No cost to you.