Weekly articles on FTC Safeguards Rule, IRS Publication 4557, cybersecurity best practices, and governance strategies for accounting firms of every size.
All 50 states plus DC have breach notification laws, each with different timelines, definitions, and penalties. If your firm has clients in multiple states, a single breach can trigger a dozen different notification obligations. Here's a practical reference guide for CPA firms.
Read articlePublication 4557 is the IRS's security blueprint for every tax professional. It overlaps with the FTC Safeguards Rule but adds requirements specific to tax preparers. Here's what it covers, where it differs from the FTC rule, and how to make sure your firm satisfies both frameworks without doing the work twice.
Read articleThe FTC Safeguards Rule (16 CFR Part 314) applies to every CPA firm in the country, with penalties up to $50,120 per violation per day. Here's what all nine requirements actually mean for a 20-person accounting firm, without the legal jargon.
Read articleNearly 70% of workers receive formal training, but only a fraction can produce the records to prove it. Under the FTC Safeguards Rule, training without documentation is training that didn't happen. Here's exactly what to record, how to store it, and what "evidence of training" means in practice.
Read article35% of all data breaches in 2024 originated from third-party compromises. The FTC requires you to periodically assess your service providers, but most firms have never done it. Here's a practical framework with 10 questions you can send to your vendors this week.
Read article34% of employees click on phishing emails before training, but that number drops 86% after 12 months of simulations. You don't need expensive software to run your first drill. Here's a step-by-step guide for small teams, from setup to debrief, with free tools and documentation tips.
Read articleYour firm needs a Written Information Security Plan, and the IRS requires it for every PTIN renewal. But a WISP doesn't need to be 80 pages. Here's a practical walkthrough of what each section should cover, what you can skip, and how to build a plan that actually reflects your firm.
Read articleThe post-season lull is your best window to tackle the security projects that got pushed aside during tax season. Here are three high-impact improvements you can complete this summer, each with a realistic time estimate and a clear first step.
Read articleGartner predicts 99% of cloud security failures through 2025 will be the customer's fault. 82% of cloud breaches stem from human error, not provider failures. If your firm uses cloud-based tax software or document storage, here's what you're actually responsible for.
Read articleOnly 17% of small businesses have cyber insurance, and 40% of claims were denied in 2024. The most common reason? Lack of documented security controls. Here are the questions your broker needs to hear before your next renewal.
Read articleMore than half of U.S. adults avoid companies that have experienced a breach. SOC 2 demand is surging, and security questionnaires are becoming routine in vendor selection. Your clients are paying attention. Here's how to answer their questions before they start asking someone else.
Read articleThe FTC Safeguards Rule requires you to periodically assess your service providers' security. But 90% of small businesses rely on their MSP for cybersecurity, and MSP-targeted attacks jumped 73% last year. Here's how to have the compliance conversation without damaging the relationship.
Read articleThe FTC Safeguards Rule doesn't just require you to write a policy. It requires you to develop, implement, and maintain a comprehensive information security program. Ten FTC enforcement complaints have specifically cited inadequate implementation. Here's what separates a document from a program.
Read articleA data breach costs financial services firms an average of $6.08 million. But for a CPA firm, the real damage isn't the fine. It's the client attrition, the operational shutdown, and the reputational erosion that follows. Here's what the full cost picture actually looks like.
Read articleTax season is over. Your team is finally breathing. But the IRS received over 250 data breach reports from tax professionals last year, and many of those gaps opened during the rush. Here's your post-season security checklist before those gaps become next year's headlines.
Read articleThe absence of a breach is not evidence of security. Attackers spend a median of 11 days inside compromised systems before detection, 47% of small businesses have no incident response plan, and the FTC requires ongoing monitoring whether you've had an incident or not. Here's why "nothing has happened" might be the most dangerous assumption your firm can make.
Read articleMulti-factor authentication blocks 99.9% of automated attacks. But in 2025, token theft accounted for 31% of Microsoft 365 breaches, and 79% of business email compromise cases involved organizations with MFA in place. Here's what CPA firm owners need to understand about MFA's limits.
Read articleTax season means new hires who need system access fast. But new employees are 71% more likely to click on phishing links in their first 90 days, and the FTC requires security training for every person who touches client data. Here's the checklist your firm is probably missing.
Read articleYour IT provider manages firewalls, patching, and email filters. But the FTC Safeguards Rule puts compliance responsibility squarely on the firm owner. Here's where IT security ends and your obligations begin.
Read articleSmall CPA firms are 2.5 times more likely to be targeted by cyberattacks than larger organizations. Attackers don't choose by size. They choose by vulnerability. Here's what the data actually says and what firm owners can do about it.
Read articleCanadian transcription firm VIQ Solutions secretly offshored thousands of sensitive Australian court files to India, violating its contracts for months while ignoring employee warnings. The breach exposed domestic violence cases, national security documents, and witness identities. Here's what CPA firm owners need to know about vendor oversight — and why your contracts alone won't protect your clients.
Read articleHackers used a simple voice phishing call to trick a Harvard administrator into handing over credentials. No malware. No code exploit. Just a convincing conversation. Here's what CPA firm owners need to know about preparing their people.
Read articleBuy the WISP yourself if you need the document.
Talk to us if you want the platform.
We use cookies to measure site performance. No data is sold to third parties. You can opt out at any time. Privacy Policy