IT Support for Accounting Firms in Dallas-Fort Worth

What the FTC Safeguards Rule asks of your firm

IRS Publication 4557 is direct about coverage: the Gramm-Leach-Bliley definition of "financial institutions" includes professional tax preparers. The FTC requires covered firms to develop a written plan describing how they protect customer information, and the IRS publishes Publication 5708 to help you build one. Failing to create and enact a security plan, in the IRS's own framing, may result in an FTC investigation.

The plan has to be appropriate to your firm's size and complexity and the sensitivity of the information you handle. A sole practitioner and a forty-person firm do not owe the same artifacts. What every covered firm owes, per the IRS, is the same short list:

• A designated qualified individual accountable for overseeing, implementing, and enforcing the program
• Multi-factor authentication for anyone accessing customer information, using at least two of a knowledge factor, a possession factor, and an inherence factor. The IRS notes this applies to all firms regardless of size.
• A risk assessment across every relevant area of the operation, including how well current safeguards actually work
• A safeguards program that gets monitored and tested, not written once and filed
• Service provider oversight, including contract terms requiring your vendors to maintain safeguards
• Program review when the business changes or testing turns something up
• Security awareness training with scheduled refreshers

Read that list again as a hiring test. If a prospective IT provider cannot tell you which of those items it delivers, which ones stay with your firm, and how each one gets evidenced, it is selling you helpdesk hours. Confirm your specific obligations with your counsel; we build and operate the controls underneath them.

How to tell your firm has already been breached

Firms rarely discover a breach by noticing an intruder. They discover it because clients start calling. The IRS publishes the specific signals, and it is worth knowing them cold:

• Client e-filed returns start rejecting because a return was already filed under that Social Security number
• Clients who have not filed receive IRS authentication letters (5071C, 4883C, 5747C)
• Clients who have not filed receive refunds
• Clients receive tax transcripts they never requested
• The number of returns filed under your EFIN or PTIN exceeds the number you actually filed
• Machines run slow, turn themselves on, lock practitioners out, or cursors move on their own

The IRS recommends checking your e-File application and, where available, PTIN return counts weekly and deactivating unused EFINs. That is a five-minute habit that catches the single clearest sign your credentials are being used to file returns you never touched. Most firms we meet have never looked.

Audit logging is the other half. If something does happen, you need a record of who did what and when. Reconstructing an incident without logs is guesswork, and guesswork is not a defensible answer to a regulator or a client.

Busy season is a security problem, not just a capacity problem

From January to April your firm roughly doubles the number of people touching client data, many of them seasonal, many of them remote, and all of them onboarded in a hurry during the period when nobody has time. Then in May the access stays behind after the people leave.

IRS Publication 4557 treats multi-factor authentication and a secure VPN as minimum standards for remote access to a firm network, and advises against using public wireless for business email or sensitive documents. It also says to limit access to taxpayer data to individuals who need to know, and to withdraw outstanding authorizations for taxpayers who are no longer clients.

The offboarding half is where firms quietly accumulate risk. Every seasonal preparer who still has working credentials in September is an account an attacker can use without tripping anything that looks unusual. Access control, endpoint protection, and monitoring are what make that manageable, and they are what our packages cover.

The cost nobody prices in: your EFIN

Firms budget for downtime and for recovery. They rarely budget for the part where they cannot file.

IRS guidance on recovering from a data loss says to determine how the intrusion or theft occurred and make any required fixes before resuming tax preparation activities and being issued a new EFIN. Read that in the context of April. Reporting obligations run in parallel: your IRS Stakeholder Liaison, local law enforcement, and every state where you prepare returns.

This is the argument for tested backups rather than assumed ones. The IRS advises backing up to a secure external source that is not connected to your network full time, encrypting those backups, and backing up more often during filing season. Ransomware operators go after backups first. Ask your current provider when it last performed an actual test restore, not when it last checked that the backup job reported success.

What we actually provide

We sell defined packages with published pricing, so you can compare us against any proposal on your desk before you talk to us.

• SOC package: managed detection and response. Continuous monitoring and a security operations function that investigates alerts rather than forwarding them to your inbox. See our SOC package.
• NOC package: managed network operations. Continuous monitoring of the devices and links your firm runs on, early-warning alerting, and capacity trends on a single pane. See Managed NOC.
• IT consulting: strategy, projects, and fractional leadership through our consulting practice.

Pricing is published at /packages. No "call for a quote" games.

Who you are actually hiring

Adaptive IP Services was founded in 2014 by David Boggs, who has worked in technology since 1997 and spent 20+ years in enterprise IT, including senior network security architecture in the financial sector. That background is the relevant part here: the controls the Safeguards Rule asks for are the controls regulated financial institutions have run for years. Applied at CPA-firm scale, that discipline is the product.

One thing we will not promise is that your firm can never be breached. Nobody can honestly promise that. What we promise is disciplined controls, continuous monitoring, tested recovery, and straight answers.

Frequently asked questions