Managed IT ServicesEvery CPA firm knows the feeling, and anyone who works on cybersecurity for CPA firms hears about it every fall. It’s November, tax season is weeks away, and somewhere in the back of a partner’s mind is the question nobody wants to ask out loud: if we got hit tomorrow, what would we actually do?
This case study walks through how eMDTec helped a New Jersey accounting firm answer that question in writing. It shows what cybersecurity for CPA firms looks like when it moves from a template in a drawer to a working program: a Written Information Security Plan, an Incident Response Plan, and a Business Continuity Plan that fit together, plus a disaster recovery test that proved the plans work.
The firm asked us not to use its name, so we haven’t. Everything here is a real-world look at cybersecurity for CPA firms. Everything else here comes from the real engagement.
Why Cybersecurity for CPA Firms Is Different
Accounting firms hold some of the most valuable data a criminal can steal: Social Security numbers, bank account numbers, income records, and everything needed to file a fraudulent return. That makes cybersecurity for CPA firms a business-critical issue, not an IT side project.
Cybersecurity for CPA firms is also a legal issue. Under the Gramm-Leach-Bliley Act, tax preparers and accounting firms are treated as financial institutions, which puts them under the FTC Safeguards Rule. The Rule requires a written information security program, a written incident response plan, a designated person in charge, ongoing monitoring or testing, and a yearly report to firm leadership. Firms that suffer a qualifying breach affecting 500 or more people must also notify the FTC, generally within 30 days of discovery.
The IRS reinforces the same point about cybersecurity for CPA firms every year. In August 2026, the IRS and the Security Summit again reminded tax professionals they need a Written Information Security Plan, and that the plan should be reviewed, tested, and updated regularly.
Then there’s timing. Most businesses can absorb a slow day. A CPA firm that loses access to its tax software on April 10th faces missed deadlines, client penalties, and reputational damage that lasts for years. Good cybersecurity for CPA firms has to be built around that calendar.
The Firm: A Busy Practice With Real Exposure
Our client is a 14-person CPA firm in Morris County, New Jersey. Two partners lead a team of CPAs, senior accountants, a bookkeeper, consultants, and administrative staff. The firm prepares individual and business tax returns, handles bookkeeping and payroll-related work for clients for its clients.
Before this project, the firm had already done a lot right. On the basics of cybersecurity for CPA firms, it was ahead of many practices. It had moved its environment to the cloud, with staff working on hosted virtual desktops, client files stored in Microsoft 365 instead of an office file server, and a cloud phone system staff can use from anywhere. Multi-factor authentication was in place for remote access. eMDTec was already managing its IT and security.
What the firm didn’t have was a complete, connected set of written plans. Its WISP had started from a standard tax-preparer template. There was no written incident response plan, which the FTC Safeguards Rule specifically requires, and no documented business continuity plan explaining how the firm would keep working through an outage during tax season.
The questions the partners wanted answered
- If a staff member clicks a phishing link at 9 p.m. on a Sunday, who finds out, and what happens next?
- If our email or file storage goes down in March, how fast can we be working again?
- Who do we have to notify after a breach, in what order, and how quickly?
- If an examiner, insurer, or client asks how we protect their data, what do we hand them?
Those four questions shaped the whole engagement. They’re the starting point for cybersecurity for CPA firms of any size.
The Solution: Three Plans That Work as One System
The core idea behind our approach to cybersecurity for CPA firms is simple. Three documents, three jobs:
| Plan | The question it answers | Completed |
|---|---|---|
| Written Information Security Plan (WISP) | What data do we protect, where does it live, and what safeguards are in place? | Refreshed January 2026 |
| Incident Response Plan (IRP) | What do we do, step by step, when something goes wrong? | Issued January 2026 |
| Business Continuity Plan (BCP) | How do we keep serving clients while systems are recovered? | Issued June 2026 |
Each plan points to the others. The incident response plan turns on the WISP’s breach notification steps when client data is involved, and it activates the continuity plan when systems go down. The continuity plan sends any security event back to the incident response plan. Nobody has to guess which binder to grab. That connection is what turns paperwork into real cybersecurity for CPA firms.
Step 1: A WISP for CPA firms that reflects reality
A WISP is only useful if it describes the firm as it actually operates. We worked with the partners to update the firm’s plan in January 2026, including:
- A named Data Security Coordinator responsible for the program, and a separate spokesperson for all outside communication during an incident.
- A complete hardware inventory. Every workstation, laptop, cloud desktop, and server that touches client data was listed and audited, with the date of review.
- An access list showing which employees can reach client data, at what level, and when that access was granted.
- Clear rules for encryption, password management, MFA, remote access, Wi-Fi separation, secure file exchange through a client portal, and secure disposal of old drives.
- Staff acknowledgement, so every employee signs that they’ve received the plan and been trained on it.
That inventory matters more than most firms realize. You can’t protect a laptop you don’t know about, and you can’t answer an insurer’s questions without knowing exactly where client data lives. A properly built WISP for CPA firms always starts there. Our WISP compliance services page explains how we build and maintain these plans.
Step 2: An incident response plan for CPA firms, written before it’s needed
An incident response plan for CPA firms is the document most practices are missing, and the one the FTC Safeguards Rule calls out by name. We issued the firm’s plan on January 7, 2026, ahead of tax season. It covers six phases: preparation, detection and reporting, triage, containment, eradication and recovery, and post-incident review.
Three parts of this incident response plan for CPA firms do most of the work.
Severity levels with response targets. Every event gets a level from 1 to 4. A Level 1 event, such as ransomware, confirmed data theft, or a compromised tax software account, means eMDTec engages immediately, the incident lead is notified within an hour, and the cyber insurer and legal counsel are contacted the same day. A Level 2 event, such as one compromised Microsoft 365 account, must be contained within four hours.
Playbooks for the attacks CPA firms actually face. The plan includes specific first steps for ransomware, business email compromise, phishing clicks, lost devices, misdirected emails containing client data, wire fraud, and compromise of tax software, EFIN, or IRS e-Services credentials. When an account is taken over, for example, the steps are already written: reset the password, revoke sessions, re-register MFA, remove malicious inbox rules and forwarding, review the audit logs, and warn affected clients through the firm’s designated spokesperson.
Simple rules for staff. Employees get a short list they can follow under stress: call the eMDTec support line, notify the incident lead, disconnect from the network but don’t power off, don’t delete anything, don’t talk to clients about it, and write down what happened. Good-faith reports are never penalized. A false alarm is always better than a late one.
The notification map in the incident response plan for CPA firms
Breach notification is where cybersecurity for CPA firms most often breaks down. Many firms simply freeze. Who gets called first? Who has a deadline? We built a single table into the plan so the firm never has to work it out in the middle of a crisis:
- Cyber insurance carrier and legal counsel: the same day, before outside vendors are hired, since many policies require it.
- IRS Stakeholder Liaison: as soon as possible after any theft or loss of client tax data, or any misuse of the firm’s EFIN or e-Services credentials.
- State tax agencies: on the same triggers, through the Federation of Tax Administrators.
- New Jersey State Police: before affected New Jersey residents are notified, as state law requires.
- Affected clients: without unreasonable delay, under each applicable state’s law.
- Federal Trade Commission: no later than 30 days after discovery when 500 or more people are affected.
- FBI and local police: promptly for cybercrime, extortion, or wire fraud.
Every decision on notifications runs through counsel and the insurer, and every message goes out through one designated spokesperson. That keeps the firm’s communication accurate and consistent when emotions are running high, which is a part of cybersecurity for CPA firms that has nothing to do with technology.
Step 3: A business continuity plan for accounting firms built around tax season
The continuity plan, effective June 1, 2026, starts with a question most plans skip: how long can each part of the business actually be down?
For this firm, the answer for tax preparation and e-filing was 24 hours in the off-season and just 8 hours during peak season. Email and client document access could tolerate about a day. Bookkeeping could stretch to two days. The phone system was lower risk, because staff can take calls from a mobile app if the office is unreachable.
With those numbers in hand, the plan sets a clear recovery order: email first, then the cloud desktops and file storage, then SharePoint and OneDrive, then directory services, phones, and individual workstations. It also includes:
- A remote-work fallback. Because the firm’s core systems are cloud-hosted, staff with a working internet connection and an approved device can keep working if the office is closed by a storm, fire, or power outage.
- A staff notification roster kept outside the firm’s systems, so partners can reach everyone even if email is down.
- A pre-written client holding statement, so the firm can tell clients what’s happening in minutes instead of drafting under pressure.
- A post-recovery checklist confirming data integrity and no remaining compromise before anyone declares the problem solved.
A business continuity plan for accounting firms has to account for the calendar in a way most generic templates don’t. Our post on why you need both a WISP and a business continuity plan goes deeper on how the two documents differ.
The Results: Cybersecurity for CPA Firms, Proven Not Promised
In cybersecurity for CPA firms, a plan nobody has tested is still a guess. On June 1, 2026, eMDTec ran a full disaster recovery test of the firm’s cloud environment and Microsoft 365 data. The target was to restore critical services within 36 hours, with no more than 12 hours of data loss.
| System | Recovery target | Actual result |
|---|---|---|
| Email (Exchange Online) | 36 hours | 8 hours |
| Cloud desktops and file storage | 36 hours | 12 hours |
| SharePoint and OneDrive | 36 hours | 14 hours |
| Data loss (recovery point) | 12 hours | 12 hours |
| Functional validation | 100% | 100% |
Every critical system came back well inside its target, and every function was checked and confirmed working afterward. For the partners, that turned “we think we’d be fine” into documented proof they can show an insurer, an examiner, or a nervous client.
Testing is only one part of cybersecurity for CPA firms. On June 18, 2026, eMDTec followed up with a full cybersecurity risk assessment, and its findings are built into the continuity plan’s priorities. If you haven’t had one recently, our security risk assessment is the right place to start.
What strong cybersecurity for CPA firms looks like now
- Written plans covering the Safeguards Rule’s requirements for a security program and an incident response plan
- A named owner and alternate for every decision, so nothing waits on one person
- Response targets by severity, so the firm and eMDTec agree on what “urgent” means
- A complete notification map with deadlines
- Recovery times proven in a live test, not estimated
- A yearly schedule for testing and review, including a tabletop exercise before tax season
- Copies of each plan stored both in Microsoft 365 and outside the firm’s network, so the plans are available even if the firm’s systems aren’t
The Honest Next Step
Good cybersecurity for CPA firms is never “done,” and this engagement surfaced an important gap. The firm decided its tax software and e-filing can tolerate no more than 8 hours of downtime in peak season. The tested recovery times of 8 to 14 hours are far better than the 36-hour target, but some of them are still longer than that 8-hour window.
That’s exactly the kind of finding a plan is supposed to produce. Faster recovery is achievable with additional investment, and the partners now have the numbers to make that decision clearly before April, instead of discovering the gap during an outage. It’s a standing item at every annual review.
5 Lessons on Cybersecurity for CPA Firms
Whether or not you work with eMDTec, these lessons about cybersecurity for CPA firms from the engagement apply to almost any accounting practice.
1. A template is a start, not a plan
The IRS publishes helpful WISP guidance, including Publication 4557. But a template becomes a plan only when it names your people, lists your devices, and describes how your firm actually works.
2. The incident response plan is required
Many firms have a WISP and assume that covers the rules on cybersecurity for CPA firms. The FTC Safeguards Rule separately requires a written incident response plan. If you don’t have one, that’s the first gap to close.
3. Write down your downtime limits
“As fast as possible” isn’t a recovery goal. Decide how many hours each function can be down in tax season and off-season, then build and test against those numbers.
4. Test before you need it
Backups fail silently. A recovery test is the only way to know your data comes back, and how long it takes. Our IT outage checklist for business is a practical place to start.
5. Make it easy for staff to report problems
The fastest detection tool in cybersecurity for CPA firms is an employee who feels safe saying “I think I clicked something.” Put one phone number on every desk, and never punish a good-faith report. Strong MFA, managed endpoint protection, and regular phishing training make that first line of defense much stronger.
Is Your Firm Ready for Tax Season?
Use this quick self-check on cybersecurity for CPA firms. Ask yourself these questions. If you can’t answer every one with confidence, your firm has work to do before January:
- Do you have a current WISP that names your Data Security Coordinator and lists every device holding client data?
- Do you have a written incident response plan, separate from your WISP?
- Do you know, in writing, who you’d notify after a breach and by when?
- Have you tested a full restore of your email and client files in the last 12 months?
- Do you know how many hours your firm can be down in March, and can you recover within that window?
- Is MFA turned on for every account that can reach client data?
- Does every employee know exactly who to call the moment something looks wrong?
Our FTC Safeguards Rule compliance checklist walks through each requirement in more detail, and our IT support for accounting firms page explains how we support practices like this one every day.
How eMDTec Approaches Cybersecurity for CPA Firms
eMDTec has supported New Jersey businesses in regulated industries since 2002. We see ourselves as your partner, not your vendor. Cybersecurity for CPA firms means more than keeping computers running. It means building the written program the FTC expects, keeping it current, and testing it so it holds up when it matters.
Our approach pairs managed IT services with cybersecurity services designed for firms that handle sensitive financial data: monitoring, endpoint protection, MFA, backups, recovery testing, staff training, and the documentation that ties it all together. If you’re still deciding how your firm should be supported, our guide to break-fix vs managed IT lays out the trade-offs.
Frequently Asked Questions About Cybersecurity for CPA Firms
Does the FTC Safeguards Rule apply to my CPA firm?
In most cases, yes. Tax preparers and accounting firms are considered financial institutions under the Gramm-Leach-Bliley Act, which brings them under the FTC Safeguards Rule. Some small-firm exemptions apply to certain requirements, so confirm the details with your advisor.
What’s the difference between a WISP and an incident response plan?
Both are core parts of cybersecurity for CPA firms. A WISP describes the safeguards you use to protect client data every day. An incident response plan describes what you do, step by step, when a security incident happens. The Safeguards Rule requires both.
How often should a CPA firm test its disaster recovery?
At least once a year, and again after any major change to your systems. The best time is before tax season, so any problems surface while there’s still time to fix them.
Who should be notified first after a data breach at an accounting firm?
Your cyber insurance carrier and legal counsel, usually the same day. They’ll guide which other notifications apply, such as the IRS Stakeholder Liaison, state tax agencies, state police, affected clients, and the FTC.
How long does it take to build these plans?
It depends on the firm’s size and how well its systems are documented. For this firm, the incident response plan was in place before tax season and the continuity plan and recovery test followed by early summer.
Get Your Firm’s Plans in Place Before Tax Season
Cybersecurity for CPA firms comes down to preparation. The firm in this case study now knows exactly what it protects, what it does when something goes wrong, and how fast it can recover. If you’d like the same clarity for your practice, let’s talk. We’ll review where your firm stands today and give you a straight answer on what’s missing.