Accounting and CPA Firms
Microsoft 365 for CPA Firms, Set Up So a Convincing Email Does Not Move Money.
Your inbox is where clients send tax documents, bank details and payment instructions. We secure the tenant and the mail flow, and put a verification step in front of every payment change.
For accounting firms that live in Outlook, Teams and SharePoint and send and receive sensitive documents all day.
Microsoft 365 and Email Security for Accounting and CPA Firms
Why Is Email Such a Risk for an Accounting Firm?
Clients email you Social Security numbers, bank account numbers and signed forms, and you email back returns and payment instructions. An attacker who controls one mailbox can read all of it and write convincing replies. Business email compromise is how a stolen login turns into a wire transfer or a diverted refund.
So the mailbox gets the strongest protection in the firm: multi-factor authentication on every account, filtering that blocks known phishing before it lands, and monitoring for suspicious sign-ins and inbox rules.
How Do You Stop Wire and Payment Change Fraud?
Technology narrows it, but the final control is a procedure. We help you write one: any change to bank details, any new payee and any unusual wire request is confirmed by a call to a number you already had on file, never by replying to the email that asked. The same rule applies to a client who suddenly sends new refund instructions.
We also set up email authentication and anti-spoofing for your domain, so it is harder for someone to send mail that looks like it came from your firm.
What About Client Portals and E-Signature Requests?
Fake document-share and e-signature notices are a common phishing lure, because your staff really do receive those every day. We review how your firm exchanges files with clients, move sensitive documents out of plain email attachments where a portal is available, and train staff to open a request from the portal itself and not from a link in an unexpected message.
We do not run your portal vendor's product. We set up the Microsoft 365 side, the access and the sign-in protection around it.
Does Microsoft 365 Meet the Safeguards Rule on Its Own?
No single product does. The FTC Safeguards Rule asks for multi-factor authentication for anyone accessing customer information and for encryption, among other things. Microsoft provides the tools, and the settings still have to be turned on, configured and watched. That is the work we do. Whether your firm is covered and how, confirm with your counsel.
What Is Included
6 PARTSTenant Administration
Users, licenses, mailboxes, Teams and SharePoint access, handled by your managed IT team.
MFA on Every Account
Multi-factor authentication on email and business applications.
Email and Web Filtering
Known phishing and malware blocked before it reaches an inbox or a browser.
Email Authentication
Anti-spoofing settings for your domain, so your firm's name is harder to forge.
Least Privilege
Individual accounts for everyone, and no daily work from administrator accounts.
Payment Change Procedure
A written process for verifying bank detail, payee and refund instruction changes.
Frequently Asked Questions
4 QUESTIONSWe use a client portal. Do we still need email security?
Yes. Clients and staff still email each other, and attackers imitate portal notices by email. The portal protects the files in it, not the inbox.
Can you help us write a payment verification procedure?
Yes. A short written rule that every payment or bank detail change is confirmed by a call to a known number is one of the most effective controls a firm can have, and we help you write it and train staff on it.
Does MFA slow staff down?
Very little once it is set up. Most sign-ins prompt rarely on a trusted device, and the protection it adds is far larger than the seconds it costs.
Is email security the same as the Safeguards Rule?
No. It covers part of it, mainly multi-factor authentication and the safeguards on the systems that hold client data. The written program and its other elements are broader. Confirm with your counsel which apply to your firm.
More for Accounting and CPA Firms
Managed IT and Help Desk
Unlimited remote support, monitoring and maintenance at a fixed monthly cost.
Managed Security Monitoring (MDR and SOC)
Round the clock monitoring, detection and response from a security operations center.
Managed Security Monitoring (MDR and SOC) for Accounting and CPA Firms
Backup and Ransomware Recovery
Encrypted, off-site backups that are tested, and a plan to restore the business after an attack.
Virtual CISO (vCISO)
Senior security leadership, a roadmap and governance, without a full-time hire.
Accounting and CPA Firms
Managed IT and security for CPA firms, with the WISP and FTC Safeguards Rule in view.
Talk Through Your Firm's Email.
Pick a time. Tell us how clients send you documents and how you handle payment changes today.
Looking for CMMC? Our Compliance Division, Capital Cyber Compliance, delivers it.
Under 25 people? Apply for an in-kind cybersecurity grant from Cyber Grants Alliance, a nonprofit. No cost to you.