Immediate
Enforce MFA, remove stale admin access, block legacy authentication, review mailbox forwarding, verify backups, and close exposed remote access.
Checklist And Evidence
CPA Firm Cybersecurity Checklist
This checklist helps CPA firms and tax preparers identify the security controls, evidence, and remediation priorities that matter before tax season, cyber insurance review, client security questionnaires, or a formal assessment.
CISO-Led25+ Years ExperienceIRS WISPFTC SafeguardsMicrosoft 365 Security
How To Use It
A Checklist Is A Starting Point, Not A Complete Audit
Use this page to organize what to check, why it matters, and which evidence should exist. The goal is not to treat a checklist as the final answer; it is to identify gaps that need assessment, remediation, validation, and ongoing ownership.
For a deeper review, OC Security Audit can assess the technical controls behind each item and create a prioritized remediation roadmap.
Core Checklist
Security Controls CPA Firms Should Validate
| Domain | What To Check | Business Impact |
|---|---|---|
| Governance | WISP owner, annual review, risk assessment, policy updates, leadership reporting | Supports accountability and readiness for IRS/FTC/client expectations. |
| Identity | MFA, Conditional Access, admin roles, offboarding, seasonal worker access | Reduces account takeover and unauthorized access to client data. |
| Anti-phishing, impersonation protection, forwarding rules, DMARC, user reporting | Reduces wire fraud, refund fraud, and client impersonation exposure. | |
| Endpoint | EDR/AV, patching, encryption, local admin, screen lock, device inventory | Protects laptops and desktops that process tax and payroll data. |
| Network | Firewall rules, VPN MFA, Wi-Fi segmentation, exposed services, remote tools | Reduces remote compromise and lateral movement risk. |
| Backup | Immutable/offline backup, restore testing, retention, tax software coverage | Improves ransomware recovery and tax-season continuity. |
| Applications | Tax software MFA, portal permissions, payroll/bookkeeping access, logging | Protects the systems where sensitive client data is processed. |
| Vendors | Provider inventory, contracts, access scope, security review, termination process | Supports oversight of third parties that touch client information. |
| Incident Response | Plan, contact list, insurance, legal counsel, tabletop test, evidence preservation | Improves response during ransomware, mailbox compromise, or data exposure. |
Next Steps
Prioritize The Highest-Risk Gaps First
30 Days
Document WISP gaps, review vendor access, improve endpoint protection, standardize staff onboarding/offboarding, and test restore procedures.
60-90 Days
Run deeper Microsoft 365, firewall, vulnerability, incident response, and cyber insurance readiness reviews with evidence tracking.
Useful OC Security Audit Pages
Continue The Same Review
If the checklist reveals gaps, the next logical reviews are IRS WISP compliance readiness, Microsoft 365 security audit, firewall security audit, and network vulnerability assessment.
Ali Hassani, CISO
Experienced Cybersecurity Guidance For Accounting Firms
Created by Ali Hassani, CISO, with 25+ years of IT, cybersecurity, compliance, Microsoft infrastructure, network security, firewall, cloud, and IT operations experience. Ali's background includes CISSP, CCISO, CCNP, CCNA, MCSE, MCSA Security, MCITP, MCP, and MCTS credentials.
For accounting firms, the focus is practical: protect taxpayer data, reduce email and ransomware exposure, document evidence, and help leadership understand which security fixes matter first.
From Findings To Implementation
Turn Security Findings Into Practical IT Work
OC Security Audit can identify the accounting-firm security gaps, evidence needs, and compliance risks. When the next step is implementation, IT Perfection can help with managed IT, Microsoft 365 support, endpoint operations, backup and disaster recovery, server work, and network infrastructure support for the same business environment.
CPA And Tax Firm Security Pathways
Continue The Accounting Firm Security Review
Accounting-firm security is strongest when the professional audit, IRS WISP documentation, FTC Safeguards expectations, Microsoft 365 controls, ransomware readiness, incident response, firewall, vulnerability, and backup evidence are reviewed together. These connected pages help your firm move from broad risk visibility into the exact controls that need attention.
CPA / Tax Firm Security
Cybersecurity Audit for CPA Firms & Tax Preparers
Use this service page when the firm needs a professional review of taxpayer-data risks, Microsoft 365, backups, ransomware, WISP evidence, and remediation priorities.
CPA / Tax Firm Security
IRS WISP Compliance Consulting
Use this compliance page when the firm needs help building, reviewing, or improving a Written Information Security Plan and the technical evidence behind it.
CPA / Tax Firm Security
Accounting Firm Cybersecurity Hub
Start with the broad CPA, accounting, and tax-preparer cybersecurity roadmap before drilling into WISP, Microsoft 365, ransomware, and response planning.
CPA / Tax Firm Security
FTC Safeguards Rule for Accounting Firms
Review GLBA/Safeguards Rule concepts such as risk assessment, access control, MFA, encryption, monitoring, vendor oversight, and evidence.
CPA / Tax Firm Security
Microsoft 365 Security Audit for Accounting Firms
Review identity, email, SharePoint, OneDrive, Teams, admin roles, logging, and device access for firms handling tax and client files.
CPA / Tax Firm Security
Tax Season Ransomware Readiness
Validate backup recovery, endpoint protection, remote access, Microsoft 365 security, continuity, and tax-season response readiness.
CPA / Tax Firm Security
Accounting Firm Incident Response Plan
Prepare for ransomware, mailbox compromise, lost devices, taxpayer data exposure, cyber insurance coordination, and client communication decisions.
FAQ
Questions Accounting Firms Ask
Can this checklist be used for IRS WISP preparation?
Yes. It helps identify the technical and administrative evidence that should support a WISP, but it does not replace a professional audit or legal review.
Should seasonal tax staff be included?
Yes. Seasonal staff access, remote work, training, device controls, offboarding, and least privilege should be reviewed before tax season.
What is the highest priority?
MFA, email security, admin access, backup recovery, endpoint protection, remote access, and client portal permissions are usually the first areas to validate.
Can this become a formal assessment?
Yes. OC Security Audit can convert the checklist into an evidence-based assessment with findings, risk levels, and a remediation roadmap.
Next Step
Review The Controls Before A Client, Insurer, Or Incident Forces The Issue
OC Security Audit can help your accounting firm understand the most important gaps, document what needs attention, and plan remediation in a practical order.