No second factor on the tax software
Email has multi-factor authentication, but the tax software, the client portal, or the remote desktop doesn't. The Safeguards Rule requires it for anyone accessing a system with customer information.
For CPA Firms & Financial Advisors
Managed IT services for CPA firms and financial advisors.
Your firm holds Social Security numbers, bank accounts, and tax returns for every client. Federal rules treat a tax practice as a financial institution, and the IRS expects a written security plan. We run the IT behind all of it, from the help desk to the backups, for one flat monthly fee.
Quick Answer
What are managed IT services for a CPA or financial firm?
Managed IT services for a CPA firm, tax practice, or advisory firm cover the firm's whole IT operation: help desk, workstations and servers, network, security, backup, and the calls to software vendors. An outside team does the work, so the firm doesn't hire IT staff. For a tax or accounting practice, that work should also cover the controls the FTC Safeguards Rule requires, such as multi-factor authentication and encryption, and the written information security plan the IRS reminds preparers they must keep.
✓15-minute response
✓MFA on every login
✓Encrypted client data
✓Tested backups
✓Flat monthly fee
✓Serving Central Texas since 2006
The IT Reality
What we find inside most small financial firms.
The same gaps show up at most firms we walk into. Each one started as a shortcut that got a return out the door in March.
A security plan nobody wrote
The PTIN renewal asks preparers to confirm they know a written information security plan is required. Many firms check the box and never write it, or downloaded a template years ago.
Returns and statements sent by email
Clients send W-2s and bank statements as plain email attachments, and the firm replies the same way. Every copy in every mailbox is customer information the firm is responsible for.
Fake requests in the busy season
A caller or email poses as a client, a partner, or the IRS and asks for a refund change, a wire, or a copy of a return. The request comes in March, when everyone is too busy to call back and check.
Seasonal staff who keep their logins
Extra preparers come on in January and leave in April. Their accounts often stay open on the tax software, the portal, and email until someone notices in the fall.
Backups nobody has restored
Most firms have backups. Far fewer have restored the tax software data and client files from one, so nobody knows how long recovery takes until the week of a deadline.
30 days
To notify the FTC when 500 or more consumers' unencrypted data is breached
5,000
Consumers or more brings the full Safeguards Rule, including security testing and a written incident plan
30 days
To notify the Texas Attorney General when 250 or more Texans are affected
Annual
Written report from the Qualified Individual to the firm's leadership
Sources: FTC Safeguards Rule, 16 CFR Part 314. Texas Attorney General, data breach reporting. The annual report and the 5,000-consumer threshold are in 314.4(i) and 314.6.
One Flat Monthly Fee
IT support for financial firms, on one monthly fee.
One team answers for the help desk, the workstations, the network, the security tools, the backups, and the software vendors. Your partners go back to client work.
Managed IT and help desk
24/7 monitoring, unlimited help desk, hardware lifecycle management, and remote or on-site support, with a 15-minute engineer-response guarantee in writing. It matters most from January through April.
Tax and accounting software support
We support the workstations, servers, network, and sign-in security your tax, accounting, and portfolio software runs on. When an application breaks, we are the ones on the phone with the vendor.
Client data security and access
Multi-factor authentication on every login, encrypted laptops and servers, and access set by role. Seasonal staff get accounts that close the day they leave.
Backup and recovery
Automated, encrypted backups of client files, tax software data, and email. We restore from them on a schedule, so the recovery time you plan for is the one you get. How our backup works →
Written security plan support
We write and keep current the technical sections of your written information security plan, using IRS Publication 5708 as the starting point, and give your Qualified Individual the reports the annual review needs.
Vulnerability scanning and testing
Vulnerability scanning on our plans, and penetration testing as a separate engagement for firms that need it under the Safeguards Rule or for a cyber insurance carrier.
Rules and Statutes
What federal rules and Texas expect from a financial firm's IT.
The rules that reach a small financial firm depend on what it does. Tax and accounting practices fall under the FTC Safeguards Rule. SEC-registered advisers fall under Regulation S-P. Anyone who takes card payments deals with PCI DSS. Texas breach law applies to all of them.
Federal rules
FTC Safeguards Rule
The rule names accountants and tax preparation services as financial institutions. Every covered firm needs a Qualified Individual to run the security program, multi-factor authentication for anyone accessing customer information, and encryption at rest and in transit.
Read Part 314 ↗The small-firm exemption
A firm holding information on fewer than 5,000 consumers is exempt from the written risk assessment, the annual penetration test and six-month scans, the written incident response plan, and the annual board report. MFA, encryption, and the Qualified Individual still apply.
Read 314.6 ↗FTC breach notice
When unencrypted customer information of 500 or more consumers is taken, the firm must notify the FTC no later than 30 days after discovering it. This is separate from the Texas notice and the IRS report.
Read Part 314 ↗Written information security plan
The IRS reminded tax professionals again in August 2026 that they need a written information security plan. The PTIN renewal form asks preparers to confirm they know it is required. Publication 5708 is the IRS template.
IRS reminder ↗SEC-registered advisers
Smaller SEC-registered advisers had to comply by June 3, 2026: a written incident response program, notice to affected customers within 30 days, and oversight of service providers, who must report incidents within 72 hours. State-registered advisers fall outside it.
SEC compliance guide ↗Card payments
Firms that take card payments for fees fall under PCI DSS. The requirements that were future-dated in version 4 became mandatory on March 31, 2025. Most small firms meet it by keeping card data off their own systems entirely.
PCI SSC ↗Texas law
Protect it, then destroy it
A business in Texas has to keep reasonable procedures to protect sensitive personal information, such as a name with a Social Security number or financial account number. Records holding it must be shredded, erased, or made unreadable once the business stops keeping them.
Read Chapter 521 ↗Breach notice in Texas
Affected people must be told no later than 60 days after the breach is determined. When 250 or more Texans are affected, the Attorney General must be told within 30 days. Those reports are posted publicly.
Attorney General reporting page ↗Credit for a security program
Since September 1, 2025, a business with fewer than 250 employees that had a qualifying cybersecurity program when a breach happened can't be hit with exemplary damages in a suit over it. A program that meets the Safeguards Rule or another recognized framework counts. Other liability and the notice duties stay.
Read SB 2610 ↗safemode IT is an IT provider and does not give legal, tax, or compliance advice. These summaries reflect the published rules and statutes as of October 2026. For the longer version, read does the FTC Safeguards Rule apply to a small Texas CPA firm.
Cybersecurity
The security work behind your client files.
The IRS lists six basic protections for tax professionals: antivirus, a firewall, two-factor authentication, backups, drive encryption, and a VPN. We put all six in place for every client we manage, and the work goes further from there.
Cybersecurity protection
Attackers try the same places first at a financial firm: email, sign-ins, laptops, and the client file store.
- ✓Endpoint detection and response (EDR) on every workstation and server
- ✓Email security with phishing, impersonation, and malware filtering
- ✓Multi-factor authentication on email, tax software, the client portal, and remote access
- ✓24/7 threat monitoring and incident response
- ✓Tested, encrypted backups for ransomware recovery
- ✓Security awareness training for partners and staff
Client data handling
These are the everyday controls: who can open a client file, how documents move between the firm and clients, and what happens when someone leaves.
- ✓Access set by role, reviewed before and after busy season
- ✓Same-day account shutoff for departing and seasonal staff
- ✓Encrypted laptops, servers, and backups
- ✓Business-tier Microsoft 365 with retention configured
- ✓Vendor security review before a new tool touches client data
- ✓Documented device wipes before reuse or disposal
Coverage follows your plan. See what safemode Shield and safemode Fortress include →
Why safemode IT
A local IT team that answers in April.
safemode IT has served Central Texas since 2006. A workstation that dies on April 14 can't wait until next week, and a client's tax records are the one thing the firm can't replace.
You get the same Kyle-based team every time you call. We bill flat-rate on a 36-month agreement, so the invoice matches the number you planned for. We support firms in Kyle, San Marcos, Austin, Bastrop, and Lockhart.
Book a 10-Minute Discovery Call →Built for how financial firms work
- ✓Serving Central Texas since 2006
- ✓Guaranteed 15-minute response time on support requests
- ✓Controls built around the FTC Safeguards Rule
- ✓Help writing and maintaining your written security plan
- ✓Tax and accounting software vendor coordination handled for you
- ✓Flat-rate pricing on a 36-month agreement, with no surprise invoices
15 min
Guaranteed engineer response on every support request
24/7
Monitoring, alerting, and incident response, all year
Since 2006
Serving Central Texas offices
1 fee
Flat monthly pricing, no surprise invoices
From the Blog
More on IT for financial firms.
Safeguards Rule
Does the FTC Safeguards Rule apply to a small CPA firm?
What the rule requires, what a firm under 5,000 consumers is exempt from, and where to start.
Read the post → Buying GuideManaged IT for CPA firms: what a provider should cover
The IRS Security Six, the written plan, and the questions to ask before you sign.
Read the post → Breach ResponseData breach steps for a Texas CPA firm
FTC, Texas Attorney General, and IRS deadlines after an incident.
Read the post →
Common Questions
FAQ: managed IT services for financial firms.
What are managed IT services for a CPA or financial firm?
Managed IT services for a CPA firm, tax practice, or advisory firm cover the whole IT operation: help desk, workstations and servers, network, security, backup, and vendor coordination. An outside team does the work. safemode IT does this for firms in Kyle, San Marcos, Austin, Bastrop, and Lockhart, with a 15-minute response guarantee and tested backups for one flat monthly fee.
Does the FTC Safeguards Rule apply to a small CPA firm?
Yes. The rule names accountants and tax preparation services as financial institutions, with no minimum size. A firm holding information on fewer than 5,000 consumers is exempt from a few parts, including the written risk assessment and the annual penetration test, but multi-factor authentication, encryption, and a Qualified Individual still apply.
Do tax preparers really need a written information security plan?
Yes. The IRS says paid tax return preparers are required by law to create and keep one, and the PTIN renewal form asks preparers to confirm they know it. IRS Publication 5708 is a template. We fill in and keep current the technical sections for our clients.
Who should be our Qualified Individual?
The Safeguards Rule lets the firm designate an employee or use a service provider. If it uses a provider, the firm still keeps responsibility and has to designate someone senior to oversee that provider. We give whoever holds the role the technical reports and documentation they need for the annual review.
How fast do you respond during tax season?
An engineer is working the problem within 15 minutes, all year. That guarantee is in writing in every managed IT services agreement. During office hours a person answers 512-761-7652, and after hours the same number reaches the on-call engineer.
Do you support our tax and accounting software?
We support the IT those programs run on, including workstations, servers, networking, sign-in security, and backup, and we deal with the software vendor directly when the application has a problem. If your firm runs a program we haven't worked with, we learn it.
We are a registered investment adviser. Does Regulation S-P apply to us?
It applies to SEC-registered advisers. Smaller ones had to comply with the 2024 amendments by June 3, 2026, including a written incident response program and customer notice within 30 days. Advisers registered only with the Texas State Securities Board fall outside Regulation S-P, though Texas breach law still applies. Your compliance consultant should confirm which rules cover your firm.
How do you stop fake refund changes and wire requests?
Mostly with email security and sign-in protection. Impersonation filtering catches look-alike senders, and multi-factor authentication keeps a mailbox from being taken over quietly. Staff training covers the rest: any change to bank details gets a call back to a number already on file.
Can you help with our cyber insurance application?
Yes. We put in place the controls carriers ask about, including multi-factor authentication, EDR, tested backups, and documented policies, and we complete the questionnaire with you so the answers hold up if a claim is reviewed. More on cyber insurance →
We already have an IT person. Can you work alongside them?
Yes. Co-managed IT leaves your person in charge of what they know best. We add after-hours coverage, 24/7 monitoring, and the security and documentation work most one-person IT departments don't have time for.
Is IT for a financial firm priced differently?
No. Every client is on the same flat-rate model: one monthly number per device on a 36-month agreement. The two plans are safemode Shield and safemode Fortress. Compare the plans →
Reviewed by the safemode IT team. Last updated October 16, 2026. safemode IT is an IT provider and does not give legal, tax, or compliance advice.
Ready for IT that just works?
Start with a 10-minute call. Tell us what's going on with your IT and we'll tell you straight whether we can help. No pressure, no obligation.
By phone or Teams, on your schedule. If we're a fit, we'll plan the next step together.
Book a 10-Minute Discovery Call →