IT for CPA and tax firms that cannot lose a week in March
Between late winter and mid-April, a locked workstation or a down file server is not an inconvenience — it is lost returns. We help Inland Empire accounting and tax firms keep systems available and build the written safeguards the FTC and IRS expect.
RanchoIT is a Rancho Cucamonga IT company. Call (909) 200-2535 or request a quote.
IT Challenges We See in This Work
- Tax applications, document portals, and email all spike at the same time of year, which is the worst time to discover an unpatched server or an untested backup.
- Clients still send returns and identity documents as ordinary attachments unless the firm gives them a better option.
- Seasonal and remote preparers need access that can be turned off when the season ends.
- Security work has to be scheduled around January 15, April 15, and October 15, not through them.
Compliance Rules That May Apply
The items below are requirements your organization may face. They are not claims that RanchoIT holds these certifications.
- Under the Gramm-Leach-Bliley Act, tax preparers and many accounting firms are "financial institutions," so the FTC Safeguards Rule (16 CFR Part 314) generally applies. It requires a written information security program, a designated qualified individual, a written risk assessment (with a limited exception for smaller firms, noted below), encryption of customer information, and multi-factor authentication for anyone accessing customer data.
- Since May 13, 2024, firms must also notify the FTC as soon as possible, and no later than 30 days after discovery, when unencrypted information about 500 or more consumers is acquired without authorization.
- IRS Publication 4557 discusses these safeguards, and Publication 5708 provides a written information security plan (WISP) template. A template still has to match the firm's real systems and vendors.
- Firms that maintain customer information on fewer than 5,000 consumers are exempt from some Safeguards Rule requirements (including the written risk assessment and certain reporting items) but still need a written program, MFA, and encryption.
- California Civil Code 1798.82 can add a separate resident-notice duty.
How We Can Help
- Help building or updating a WISP that reflects the firm's actual systems, then reviewing it annually — not dropping a blank template on the desk.
- A written look at where client data lives and how it is protected.
- Multi-factor authentication on email, remote access, and tax-software logins, and encryption on laptops, file storage, and backups.
- A secure way for clients to send documents, so sensitive files are not the default email attachment.
- A pre-season readiness check (ideally in the fall): patches, backups, licenses, workstation health, and a tested restore.
- Managed IT, monitoring, and incident help if notification duties to the FTC, the IRS, or California residents may be triggered.
Why This Matters Locally
We work with firms in Rancho Cucamonga, Upland, Claremont, Ontario, Fontana, Pomona, and the professional corridors toward Riverside and San Dimas. Emphasize local help during tax season rather than a ticket queue in another time zone.
Frequently Asked Questions
Does the FTC Safeguards Rule apply to a small tax practice?
Generally yes. The FTC treats tax preparers as financial institutions. Smaller firms that keep information on fewer than 5,000 consumers are excused from some paperwork requirements, but not from having a written program, MFA, and encryption.
What is a WISP?
A written information security plan: who is responsible, how client data is protected, and what the firm will do if there is a breach. IRS Publication 5708 is a starting template, not a finished plan.
When does a firm have to notify the FTC?
When unencrypted information about at least 500 consumers is acquired without authorization — as soon as possible, and no later than 30 days after discovery. California may require resident notice as well.
Can you work on our systems during tax season?
Emergency support, yes. Planned changes should be finished before returns are in full swing, which is why a fall readiness visit matters.
Ready to Talk About Your IT?
RanchoIT is a Rancho Cucamonga IT company. Call (909) 200-2535 or request a quote.
Office hours are Monday–Friday, 8:00 am–5:00 pm.