{"id":5686,"date":"2026-02-24T12:51:57","date_gmt":"2026-02-24T17:51:57","guid":{"rendered":"https:\/\/verito.com\/blog\/?p=5686"},"modified":"2026-03-19T06:37:08","modified_gmt":"2026-03-19T10:37:08","slug":"it-compliance-gaps-cpa-firms","status":"publish","type":"post","link":"https:\/\/verito.com\/blog\/it-compliance-gaps-cpa-firms\/","title":{"rendered":"IT Compliance For CPA Firms: The Gaps Your IT Team Won\u2019t Tell You About"},"content":{"rendered":"\n

Ask most partners in a small or mid-sized CPA firm whether IT is \u201chandling compliance,\u201d<\/em> and the answer is usually yes.<\/p>\n\n\n\n

There are backups, antivirus is installed, remote access works, and an MSP says everything is fine. That may be enough to keep the firm running day-to-day, but it is not what regulators, cyber insurers, or auditors are looking for when something goes wrong.<\/p>\n\n\n\n

They want proof that specific safeguards are in place, monitored, and documented, not just a general sense that the technology team is competent.<\/p>\n\n\n\n

For U.S. tax and accounting firms, IT compliance is not optional or informal. The FTC Safeguards Rule treats many practices as financial institutions and expects a written, risk-based security program. The IRS reinforces this with Publication 4557 and the Written Information Security Plan (WISP)<\/strong><\/a> template in Publication 5708.<\/p>\n\n\n\n

In a review, the questions are direct: show your current WISP, your risk assessment, and evidence that controls like MFA, encryption, backups, and monitoring are actually working. If you cannot produce that on demand, \u201cour IT provider has it covered\u201d<\/em> stops being credible.<\/p>\n\n\n\n

This article is for firm owners, partners, and administrators who are responsible for risk but do not live in security jargon. We will clarify what IT compliance really means for CPA firms, highlight the gaps that internal IT and many MSPs routinely leave open, give you specific questions to ask your providers, and show what an audit-ready IT stack looks like in practice.<\/p>\n\n\n\n

By the end, you should be able to tell whether your firm is genuinely prepared for an audit, a cyber claim, or a serious incident, or whether you are relying on a story that will not survive serious scrutiny.<\/p>\n\n\n\n

\n\t<\/div>\n\n\n\n
<\/div>\n\n\n\n

What IT Compliance for CPA Firms Actually Requires in 2026<\/strong><\/span><\/h2>\n\n\n\n

IT compliance for CPA firms <\/a>is no longer about having antivirus software and nightly backups. Under the FTC Safeguards Rule, IRS Publication 4557, and GLBA requirements, tax and accounting firms must maintain a written, risk-based information security program.<\/p>\n\n\n\n

At a minimum, IT compliance for CPA firms requires:<\/p>\n\n\n\n

    \n
  1. A Written Information Security Plan (WISP)<\/li>\n\n\n\n
  2. A documented risk assessment updated regularly<\/li>\n\n\n\n
  3. Multi-factor authentication (MFA) across critical systems<\/li>\n\n\n\n
  4. Endpoint Detection and Response (EDR) on servers and workstations<\/li>\n\n\n\n
  5. Encrypted and tested backups, including immutable storage<\/li>\n\n\n\n
  6. Vendor risk management and third-party oversight<\/li>\n\n\n\n
  7. Ongoing monitoring and documented incident response procedures<\/li>\n<\/ol>\n\n\n\n

    If your firm cannot produce documentation proving these safeguards are implemented and actively monitored, you are not compliant (regardless of what your IT provider tells you).<\/p>\n\n\n\n

    <\/div>\n\n\n\n

    What IT Compliance Really Means for CPA Firms (Beyond Antivirus)<\/strong><\/span><\/h2>\n\n\n\n

    Most firms equate \u201cIT compliance\u201d<\/em> with having the basics in place: firewalls, antivirus, backups, and maybe MFA for remote access.<\/p>\n\n\n\n

    Those are necessary, but regulators and insurers are looking for something very different. They expect a structured security program that is written down, tied to clear responsibilities, and backed by evidence that the controls you claim to have are actually working.<\/p>\n\n\n\n

    For many CPA and tax practices, the starting point is the FTC Safeguards Rule<\/strong><\/a>. It treats covered firms as financial institutions<\/strong> and requires a written information security program that is appropriate to the size and complexity of the firm and the sensitivity of client data.<\/p>\n\n\n\n

    That program must include risk assessments, a designated Qualified Individual, policies and procedures, vendor oversight, and ongoing monitoring, not just one-time technology projects.<\/p>\n\n\n\n

    The IRS takes a similar approach with its own guidance. Publication 4557<\/strong> explains what \u201creasonable\u201d<\/em> security looks like for anyone who prepares or processes tax returns for a fee and explicitly tells firms to build a data security plan<\/strong> rather than relying on ad-hoc tools. Publication 5708<\/strong> goes further by providing a full Written Information Security Plan template for tax and accounting practices, with sections for risk assessment, access controls, encryption, incident response, and periodic review.<\/p>\n\n\n\n

    In other words, the IRS expects your safeguards to live in a WISP that is actively maintained, not in a collection of invoices from your IT provider.<\/p>\n\n\n\n

    What Is a WISP for CPA Firms?<\/strong><\/span><\/h3>\n\n\n\n

    A Written Information Security Plan (WISP) is a formal document that outlines how a CPA firm protects taxpayer data. It includes the firm\u2019s risk assessment, access control policies, encryption standards, vendor oversight procedures, incident response plan, and ongoing monitoring requirements.<\/p>\n\n\n\n

    The IRS provides a WISP template in Publication 5708, but firms are responsible for tailoring it to their specific systems and risk profile.<\/p>\n\n\n\n

    Cyber insurance carriers have quietly become the third force shaping IT compliance. Most current underwriting checklists for small and mid-sized businesses expect concrete controls such as multi-factor authentication across critical systems, endpoint detection and response on servers and workstations, encrypted and regularly tested backups, patch management, and an incident response plan. These requirements mirror the regulatory expectations and they come with real financial consequences, since the average cost of a data breach is now estimated at around 4.88 million dollars globally<\/strong> as per IBM\u2019s 2025 Cost of a Data Breach Report<\/strong><\/a>.<\/p>\n\n\n\n

    Put simply, IT compliance for CPA firms means that:<\/p>\n\n\n\n