Photo by RDNE Stock project / Pexels
For a five-person accounting practice, the thing that matters most is not having a beautiful security binder on a shelf. It is making sure the written plan matches what is actually happening in the office.
The IRS requires tax professionals to maintain a Written Information Security Plan. The FTC Safeguards Rule requires an information security program appropriate to the size and complexity of the firm. In practice that means you need to know where client data lives, who can get to it, how it is protected, and what happens if something goes wrong. The phrase "appropriate to the size and complexity" is where small firms get stuck, because it means nobody is going to hand you a finished checklist.
The rules are federal. What is local is the size of the firm.
Nothing about the IRS requirement or the Safeguards Rule changes at the Rhode Island state line, and I am not going to pretend otherwise. What is different here is the shape of the firms. Most of the accounting practices we talk to in Warwick, Cranston and Providence are somewhere between two and ten people. There is no compliance officer, no IT department, and nobody whose job it is to read regulatory updates. The most technically comfortable person in the office ends up owning security by accident, usually on top of a full client load.
That matters because both requirements assume someone is maintaining the program, not writing it once and filing it. A large firm has staff for that. A five-person practice has to design something that survives without a dedicated person, which usually means fewer moving parts and more of it handled by an outside provider under a clear agreement.
Two other things are genuinely local. Rhode Island has its own breach notification law, which sits on top of the federal obligations, so if client data gets out a Rhode Island firm answers to the state as well as to the IRS and the FTC. And from January through April you cannot afford a bad week. Having someone able to walk into your office in Warwick on a Tuesday morning in March is worth more than the same ticket handled well from three time zones away.
Most of the risk is not in the tax software
The biggest mistake I see is a firm assuming the tax software or the secure portal protects everything else. Those vendors do their part. But client tax data does not stay inside them. It also ends up in:
- Email, including years of mailbox history nobody has looked at
- Microsoft 365 - SharePoint, OneDrive, Teams chats with documents attached
- Laptops and desktops, especially the downloads folder
- The office scanner or copier, which often stores images and can email them out
- Backups, which contain everything the live systems contain
- Personal phones and home computers used during busy season
Wherever the data goes, the obligation follows. The firm still has to control access, encrypt sensitive information, require MFA, monitor its systems, train the people who handle the data, and promptly remove access when somebody leaves. That last one gets skipped constantly. If you bring on seasonal help in February, somebody has to take the access back in May, and it has to be documented that you did.
"Am I compliant?" is not a question antivirus answers
When a CPA asks me point blank whether they are compliant, I tell them I cannot answer that based on whether they have antivirus and MFA. We have to compare the actual environment against the written security plan and the requirements that apply to the firm. Until somebody does that comparison, the answer is a guess.
Most of the time the honest answer is: you have some of the right pieces, but nobody has ever put them together and verified the whole thing. That is not an insult. It is what happens when security gets bought one product at a time over ten years. Across the accounting firms we support in Rhode Island, the gap is almost never a missing tool - it is that no one ever checked whether the tools cover what the plan claims they cover.
Compliance is not a product you buy from an IT company. If a provider tells you their package makes you compliant, they are selling you something. We can put the technical controls in place, document them honestly, and test them on a schedule. The firm still owns the program.
Stop emailing returns
I am not a fan of sending tax returns through ordinary email. A secure portal should be the normal workflow, not the thing you use when a client specifically asks for it. The Safeguards Rule addresses protecting customer information both when it is stored and when it is transmitted, and an unencrypted attachment is neither.
The reason firms backslide is not technical. A client complains that the portal is annoying, it is the third week of March, and somebody attaches the return to a normal message just this once. The fix is operational: one path for client documents, and staff do not have discretion to step off it under pressure. If email genuinely has to be used, it should be properly encrypted rather than attaching a return and hoping for the best.
There is a second reason worth saying out loud. An emailed return lives permanently in two mailboxes, and you only control one of them. Your client's email account is now part of your risk, and you have no idea whether it has MFA on it.
If you can only fix three things before busy season
- MFA and access control everywhere client data is reachable. Not just the tax software - Microsoft 365, remote access, the portal, file shares, anything a browser can reach from outside the office. Then cut the access nobody needs.
- Every workstation managed, patched, encrypted, and running modern endpoint security. Full disk encryption is the one people skip, and it is the difference between a lost laptop being an inconvenience and a lost laptop being a problem you have to explain to clients.
- Build or update the WISP, and use that process to verify backups, recovery, and incident response. Writing the plan is what forces the questions nobody asks otherwise - including whether your backup would actually restore, and what the firm does at 7pm on a Saturday in March when the files are encrypted and nobody can work.
Those three projects cover a large share of the practical risk and line up closely with what the IRS and the FTC are actually asking firms to do. They are also achievable for a small practice in an off-season, which the bigger security wish lists are not.
The point
If the plan on paper and the way the office actually runs are two different things, you do not have a security program. You have a document. The work is in closing that gap, and it is mostly unglamorous: inventory, access, encryption, testing, and writing down what you found.
If you want to know where your practice really stands before January, we are happy to compare your actual environment against your plan and tell you plainly what is missing. No binder required. Get in touch and we will take a look.
