One less thing to explain to a regulator.
CPA and bookkeeping firms, tax preparers, financial advisors, title and closing companies and small lenders holding client financial data that the FTC and the IRS both expect you to protect, not just back up.
What matters here
- The FTC Safeguards Rule applies to you, and the IRS requires tax preparers to have a written information security plan.
- Title and closing companies move large wires and are a prime target for spoofed emails.
- Clients email you their documents unless you give them something better.
- Filing season is a peak nothing can go down in.
What we set up in the first ninety days
Each item is written in plain words and becomes part of your documentation vault and evidence file.
The written plan
- Written information security plan that matches what you actually do
- Named security lead, as the rule requires
- Risk assessment and yearly review on the calendar
- Vendor list with security requirements
Email and wires
- Domain protection so nobody can send as you
- Filtering that flags payment-change and wire requests
- A written rule: wire details change only by phone verification
- MFA on email, the tax software and the bank
Client data
- Secure client portal for documents and signatures
- Encryption on every laptop and the file server
- Access logging: who opened which client file
- Retention and deletion schedule
Season readiness
- InfraGuard on every system before January
- Backups tested in December
- Spare laptop and a failover internet line
- After-hours coverage through April 15
Services for this industry, in order
Most start with the first three. The rest come up when the business grows or an audit does.
- Compliance & Cyber Insurance ReadinessThe written plan, the risk assessment and the evidence.
- CybersecurityMFA, encryption, email and endpoint protection.
- Managed ITLaptops, server, accounts and tax software updates.
- 24/7 Monitoring & Incident ResponseInfraGuard with retained access logs.
- Automation & IntegrationsClient intake, document requests and signatures without email attachments.
- Training & WorkshopsWire-fraud and phishing practice before season.
Where CRM-NG fits
One record per client, vendor and asset.
A CRM-NG Cloud workspace handles the business side: the people, companies, equipment, tickets and documents everyone keeps asking for. We will tell you plainly what should never go in it, and configure it so it cannot by accident.
Questions we get
We have never written a security plan. Is that a problem?
It is a gap, not a crisis. We write the plan from what you already do, close the obvious holes, and give you the yearly review process.
Can you stop wire fraud?
We cannot stop criminals sending emails. We can make sure they cannot send as you, that payment-change requests get flagged, and that your staff verify by phone every time.
Will clients actually use a portal?
Yes, when it is one link, no account creation, and it works on a phone. We set it up that way.
First call
Start with a safeguards review. We compare what the rule requires with what you have and hand you the written plan to sign.