Does a two- or three-preparer office really need CPA-specific IT?

Yes, if you complete tax returns. The FTC Safeguards Rule treats tax preparation businesses as financial institutions, and IRS Publication 5708 says that applies "regardless of size." The written plan is required. CPA-specific IT means the controls and the written plan match, and both are ready when an underwriter or the IRS asks.

We use Drake / UltraTax / Lacerte / ProSeries. Do you replace it?

No. We build around the tax software you already chose and the workflow your preparers already know. What we handle is the infrastructure beneath — Microsoft 365, endpoint security, backup, network — plus the QuickBooks hosting path, the client portal, and the workstation performance curve from January through April.

How do you handle QuickBooks: hosted, desktop, or Online?

Depends on where you are today. For firms on Right Networks, Swizznet, or similar hosted QuickBooks, we manage the access layer — user provisioning, MFA, audit logs, offboarding discipline — and scope local bandwidth so the hosted sessions stay responsive. For firms running desktop QuickBooks locally or on a server, we scope storage, backup versioning, and the file-locking behavior that tends to surface in March. For QuickBooks Online, we handle the identity and access controls and the integration audits.

What do you do before tax season starts?

A December readiness pass: workstation health, patches, disk space, bandwidth, tax-software prerequisites, and a test restore from backup. Then a change freeze on preparer machines through the March and April deadlines.

Do you write the WISP for us?

We write it with you, tie each section to a control that's actually deployed, and review it every year. You own the document.

Do we have to report a breach to the FTC?

Under the Safeguards Rule, a security event involving unencrypted information of 500 or more people must be reported to the FTC within 30 days of discovery (IRS Publication 5708 summarizes this). Nevada's breach-notice law (NRS 603A.220) and IRS reporting steps may apply too. Your attorney should guide the notices. This is not legal advice.

What happens if we get hit with ransomware the week returns are due?

Recovery-time planning, not cleanup planning. Immutable versioned backups tested on a schedule; endpoint isolation playbooks rehearsed in advance; a documented response procedure your managers have reviewed; and a direct line to the person handling the incident. For a tax practice, the deliverable is that Form 4868 extensions get filed on time and the client files do not have to be reconstructed from paper.

Industries · Accounting & CPA · Southern Nevada

IT for Henderson and Las Vegas CPA firms that holds up through tax season.

CyberSmart supports accounting and tax practices across Southern Nevada, from Henderson and Summerlin to Boulder City. We come to you when hands are needed and keep watch the rest of the year.

Get a Practice Assessment How we work with firms

Six failure modes

What generic managed IT misses in a tax practice.

Every practice hits a version of these six failure modes. A provider that has not seen them before is a provider that will run into them the week Form 1065 is due.

Peak-season uptime

Every hour of downtime in late March costs more than two weeks in July. Extensions (Sept 15, Oct 15), year-end planning, and January W-2 / 1099 prep each have their own capacity curve. We pre-validate the environment in front of every peak — workstation health, bandwidth, patches, backup verification — so deadlines do not collide with avoidable failures.

QuickBooks hosting reliability

Whether QuickBooks lives on Right Networks, Swizznet, a local server, or QuickBooks Online, we handle the identity, access, and bandwidth discipline that keeps hosted sessions stable and desktop files intact when the whole team is in the file at once.

Audit-trail integrity

Who touched which client file, when, from where, with what credentials. That record has to exist — for internal review, for regulator inquiries, and for the one time a staff member has to be let go mid-engagement.

Client portal security

The client portal is where 1099s, W-2s, and K-1s live. It is also the most common target for credential-phishing attacks targeting practices. Enforced MFA, anomaly detection, and session controls are baseline — not premium features.

Staff-turnover IT handoffs

The week a senior preparer leaves is the week their access has to be revoked cleanly, their data ownership has to transfer without breaking, and their workstation has to be reset for the replacement. We document that path in advance so offboarding is a checklist, not an emergency.

IRS Publication 4557 / WISP compliance

Every paid preparer is expected to maintain a written information security plan. We write it with you, keep it aligned with what is actually deployed, and review it annually — so when a regulator or a carrier asks, the answer is a document that matches reality.

A practice-year checklist we actually run

Keep this one as a calendar, not a pitch. Each line is something that happens on a client's environment:

When	What we check
Early December	Workstation health, disk space, patch state, tax-software install prerequisites, backup restore test
Late December – January	W-2 phishing warning to staff; payroll-change requests confirmed by phone, never by email alone
February	Bandwidth and hosted-QuickBooks session load with the whole team in at once; portal MFA audit
Mid-March / mid-April	Change freeze on preparer machines; same-day help desk priority
May	Offboard seasonal staff: sign-ins disabled, files transferred, devices wiped
August – October	Extension-season check; refresh the WISP against what's actually deployed

Pub 4557, the FTC Safeguards Rule, and Nevada law

Three sets of rules touch a tax practice's data. Under the FTC Safeguards Rule, a business that completes income tax returns counts as a "financial institution" (16 CFR 314.2), and the rule requires a written information security program. The IRS says tax and accounting professionals are covered "regardless of size." It lists MFA, a designated qualified individual, and reporting a security event that affects 500 or more people to the FTC within 30 days of discovery (IRS Publication 5708, which includes a sample WISP template). IRS Publication 4557 is the IRS's guide to safeguarding taxpayer data. In Nevada, NRS 603A requires reasonable security measures for records holding residents' personal information, and notice to affected residents after a breach. We build the technical controls and the WISP together, so the document describes the office you actually have. (Not legal advice. Your firm's counsel or state board is the authority.)

The engagement

How we scope the engagement.

We start with the calendar — and the calendar has more than one peak. March 15 for partnerships and S-corps. April 15 for individuals and C-corps. September 15 and October 15 for extensions. Year-end planning through November and December. W-2 and 1099 prep in January. Each peak has a different staffing profile, a different phishing-threat shape (fake IRS notices in extension season, W-2 imitation attacks in December and January), and a different IT failure mode. The environment has to be pressure-tested in front of each one — not once a year in December and called good.

Three tracks run in parallel. Security controls — enforced MFA, Conditional Access, endpoint detection and response — bring the environment up to the WISP baseline IRS Publication 4557 expects. Backup and continuity — immutable, versioned, tested monthly — cover the ransomware-during-return scenario without hand-waving. Practice-platform support — Drake, UltraTax, Lacerte, QuickBooks, your client portal — stays on tier-one alerting through every peak, not just April.

The advisory part is the difference. The same team keeps notes on your software stack, your partners, and your deadline calendar. That continuity is what a ticket queue cannot produce — and it is the part that actually moves the risk needle in a regulated practice.

Three services, one workload

The stack behind a practice engagement.

Three services, scoped to a tax-and-accounting workload.

Managed IT for busy-season firms

Continuous monitoring, patching, backup verification, and a help desk that answers during the 60-hour weeks. December readiness checks, workstation health reports, and notes on your calendar so you do not start from zero.

Learn more →

Cybersecurity tuned for tax practices

24/7 threat detection on every device, enforced MFA, conditional access, and phishing simulations calibrated to the lures that actually hit CPAs — fake IRS notices, fraudulent 1099 amendments, client-impersonation wire-transfer requests.

Learn more →

Cloud, Microsoft 365, and portal stack

Microsoft 365 Business Premium configured for a regulated practice — Conditional Access, Defender for Business, Purview retention — plus the integration between your tax software, QuickBooks, and the client portal so the workflow is not held together by shared drives.

Learn more →

Common questions from practices

Does a two- or three-preparer office really need CPA-specific IT?: Yes, if you complete tax returns. The FTC Safeguards Rule treats tax preparation businesses as financial institutions, and IRS Publication 5708 says that applies "regardless of size." The written plan is required. CPA-specific IT means the controls and the written plan match, and both are ready when an underwriter or the IRS asks.
We use Drake / UltraTax / Lacerte / ProSeries. Do you replace it?: No. We build around the tax software you already chose and the workflow your preparers already know. What we handle is the infrastructure beneath — Microsoft 365, endpoint security, backup, network — plus the QuickBooks hosting path, the client portal, and the workstation performance curve from January through April.
How do you handle QuickBooks: hosted, desktop, or Online?: Depends on where you are today. For firms on Right Networks, Swizznet, or similar hosted QuickBooks, we manage the access layer — user provisioning, MFA, audit logs, offboarding discipline — and scope local bandwidth so the hosted sessions stay responsive. For firms running desktop QuickBooks locally or on a server, we scope storage, backup versioning, and the file-locking behavior that tends to surface in March. For QuickBooks Online, we handle the identity and access controls and the integration audits.
What do you do before tax season starts?: A December readiness pass: workstation health, patches, disk space, bandwidth, tax-software prerequisites, and a test restore from backup. Then a change freeze on preparer machines through the March and April deadlines.
Do you write the WISP for us?: We write it with you, tie each section to a control that's actually deployed, and review it every year. You own the document.
Do we have to report a breach to the FTC?: Under the Safeguards Rule, a security event involving unencrypted information of 500 or more people must be reported to the FTC within 30 days of discovery (IRS Publication 5708 summarizes this). Nevada's breach-notice law (NRS 603A.220) and IRS reporting steps may apply too. Your attorney should guide the notices. This is not legal advice.
What happens if we get hit with ransomware the week returns are due?: Recovery-time planning, not cleanup planning. Immutable versioned backups tested on a schedule; endpoint isolation playbooks rehearsed in advance; a documented response procedure your managers have reviewed; and a direct line to the person handling the incident. For a tax practice, the deliverable is that Form 4868 extensions get filed on time and the client files do not have to be reconstructed from paper.

Serving Southern Nevada

A twelve-question practice assessment.

Tell us about your tax software, your hosting path, and where you are on WISP and IRS 4557 evidence. We review it and follow up within one business day with an honest read — even if the honest read is that you do not need to change providers.

Start My Practice Assessment Talk to us first

Or call us directly: 702-293-2864