Accounting and CPA Firms
A Security Leader for Your CPA Firm, Without the Full-Time Salary.
The Safeguards Rule expects someone to own the firm's security program. A virtual CISO does that part time, writes the plan with you and reports to the partners, with our team behind them.
For partners who need security leadership and a written plan but not a full-time executive.
Virtual CISO (vCISO) for Accounting and CPA Firms
What Is a Qualified Individual, and Who Can Be One?
Under the FTC Safeguards Rule, a firm must designate one Qualified Individual to oversee and implement its information security program. The FTC says that person can be an employee or someone at an affiliate or service provider, and that the firm still remains responsible. How the role is filled for your firm is part of the compliance scope, delivered by our Compliance Division, Capital Cyber Compliance, so confirm the arrangement with your counsel.
What Is a WISP, and Who Writes It?
A Written Information Security Plan describes the administrative, technical and physical safeguards your firm uses to protect client information. The IRS publishes Publication 5708, a guide and sample template for tax and accounting practices. A template is a start, but it only helps if it describes what the firm actually does.
A virtual CISO writes the plan around your real environment: the systems that hold client data, who has access, how it is encrypted and how incidents are handled. Then the plan and the controls we run stay in step.
What Does the Partner Group Get Out of It?
A roadmap in order of priority, a written risk assessment, an incident response plan, and a regular report in plain language. The Safeguards Rule also expects the Qualified Individual to report in writing to the firm's governing body, such as the partners, at least once a year, and the virtual CISO prepares that report.
Who Else Asks Security Questions?
Cyber insurers, larger clients, banks and lenders send questionnaires, and the answers have to be true and backed by evidence. We help you answer them, and we check each answer against what is actually in place.
How Is This Different From Managed IT?
Managed IT runs the systems. A virtual CISO decides what the security program should be, sets priorities and checks that it is working. With us, both are the same company.
What Is Included
6 PARTSTechnology Roadmap
Your goals lined up with the right technology, in order.
Governance and Policy
A cybersecurity policy and the procedures under it.
Incident Response Planning
A written plan, tested so people know their part.
Program Oversight
Security program management and regulatory oversight.
Questionnaires and Reviews
Help with client, lender and insurer security questionnaires.
Leadership Reporting
Risk explained in plain language to the partners who decide.
Frequently Asked Questions
4 QUESTIONSCan your vCISO be our Qualified Individual?
The rule asks for a designated Qualified Individual to oversee your security program. How that role is filled for your firm is part of the compliance scope, delivered by our Compliance Division, Capital Cyber Compliance.
Do you write the WISP?
Yes, as part of the security program, written around the controls actually in place. Formal compliance engagements are delivered by our Compliance Division. We are not a law firm, so confirm with your counsel how the rule applies to your firm.
How much of the vCISO's time do we get?
It is scoped to what you need, from a regular cadence of meetings to deeper involvement during an incident or a review. We set it on the call.
Have you worked with a CPA firm before?
Yes. A New Jersey and New York CPA practice engaged us after a third-party penetration test, as published in the case study.
More for Accounting and CPA Firms
Managed IT and Help Desk
Unlimited remote support, monitoring and maintenance at a fixed monthly cost.
Microsoft 365 and Email Security
Microsoft 365 set up, secured and run, with email protection against phishing and spoofing.
Microsoft 365 and Email Security for Accounting and CPA Firms
Managed Security Monitoring (MDR and SOC)
Round the clock monitoring, detection and response from a security operations center.
Managed Security Monitoring (MDR and SOC) for Accounting and CPA Firms
Backup and Ransomware Recovery
Encrypted, off-site backups that are tested, and a plan to restore the business after an attack.
Accounting and CPA Firms
Managed IT and security for CPA firms, with the WISP and FTC Safeguards Rule in view.
Talk Through Security Leadership.
Pick a time. Tell us who asks your firm security questions today and who owns the plan.
Looking for CMMC? Our Compliance Division, Capital Cyber Compliance, delivers it.
Under 25 people? Apply for an in-kind cybersecurity grant from Cyber Grants Alliance, a nonprofit. No cost to you.