Accounting firm IT services
We keep client tax data safe and protect CPA firms, bookkeepers and tax preparers from Charleston to Savannah from fake payment-change requests.
Client money and records
Firm mailboxes carry client tax documents, bank details and payment requests. The FBI IC3 2025 report describes business email compromise as compromised email accounts used to conduct unauthorized transfers of funds.
Tax documents and internal records sit in partner and staff inboxes, making them targets for intrusion or social engineering.
Attackers use hijacked mailboxes to send new bank details for wire transfers or refunds the firm is about to process.
Staff must call a known phone number to verify any changed bank detail before releasing funds or updating financial records.
Federal agencies publish annual reports tracking business email compromise complaints, security event reporting requirements and the size of local accounting offices.
24,768
FBI IC3 recorded 24,768 complaints in 2025 with $3,046,598,558 in reported losses, up from 21,442 complaints in 2024.
500
IRS Publication 5708 and FTC Safeguards Rule mandate reporting a security event affecting 500 or more people as soon as possible and within 30 days of discovery.
385
Census Bureau data from 2022 counts 544 employer offices across six counties from Charleston to Savannah, with 385 having fewer than five employees.
Figures from FBI IC3 2025 report, IRS Publication 5708 and Census Bureau.
Most local accounting offices are small, with Census figures showing 385 local offices have fewer than five employees, and IRS guidance states the Safeguards Rule covers tax and accounting professionals regardless of size.
Select an office type
Common threats
Each stage shows attacker actions followed by specific controls set up beforehand in Microsoft 365 or Google Workspace. Screens feature Microsoft documentation screenshots with sample data.
Set up beforehand
Facts from FBI IC3 2025 report, IRS Publication 5708 and Microsoft Learn.
System controls limit attacker movement, generate alerts for unauthorized forwarding and add safety tips to messages arriving from impersonated domains.
Software
See also
IRS Publication 5708 says tax and accounting professionals are financial institutions under the Safeguards Rule regardless of size and must keep a written, accessible WISP. Firms write and own their plans, while CloudCentric sets up technical controls the plans describe. Not legal advice.
1
Designate a qualified individual to coordinate the information security program, maintaining responsibility whether the person is an employee or at an affiliate or service provider.
Firm decisions
Firm management designates this person to oversee the security plan.
System settings
Nothing is set up in software for this requirement.
2
Identify and assess risks to customer information and evaluate current safeguards to guide the design of the security program.
Firm decisions
Firm evaluates its own risks and reviews internal processes.
System settings
Settings above are among the technical safeguards the assessment looks at.
3
Implement multi-factor authentication for any individual accessing any information system unless the qualified individual approves a reasonably equivalent control in writing.
Firm decisions
Firm mandates secure sign-ins for all staff members accessing client data.
System settings
Conditional Access and sign-in rules decide who can sign in and from where, and 2-Step Verification covers Google Workspace.
4
Train all employees on protecting client information at least annually, with periodic refreshers, and train new employees before granting access.
Firm decisions
Firm ensures staff acknowledge training in writing and hold monthly security meetings in tax season.
System settings
Attack simulation training provides harmless test phishing messages and short educational modules.
5
Select service providers capable of maintaining appropriate safeguards, requiring them by contract to implement protections, and provide ongoing oversight.
Firm decisions
Contract with an IT provider is the firm's to set and review.
System settings
CloudCentric configures system controls and provides emergency on-site and remote IT support.
6
Maintain written incident response and breach notification plans detailing steps to re-secure devices, data, passwords and networks, plus a reporting process.
Firm decisions
Firm keeps written incident response and breach notification plans, with a copy offsite or in the cloud.
System settings
CloudCentric tracks Defender alerts as incidents followed to closure and supplies mailbox data when an event occurs.
Facts from IRS Publication 5708 and FTC Safeguards Rule page.
Response work for CloudCentric's own clients follows Microsoft's compromised account steps and incident procedures outlined in IRS Publication 5708.
Details from Microsoft Learn and IRS Publication 5708.
Fake requests supply new bank details for a payment or refund. Attackers compromise email accounts through social engineering or computer intrusion, then use hijacked mailboxes to send unauthorized transfer instructions.
IRS Publication 5708 and the Safeguards Rule require tax and accounting professionals to maintain a written, accessible WISP, regardless of size. Not legal advice.
CloudCentric sets up the technical controls the plan describes, such as sign-in rules, forwarding alerts, look-alike warnings and staff practice. Firm management writes the plan and designates its own qualified individual.
IRS Publication 5708 advises calling senders to verify, hovering over links, enforcing multi-factor authentication and holding annual training, plus requiring a callback before using any changed bank detail.
Microsoft 365 and Google Workspace both work. Forwarding alerts are listed for Microsoft E1, E3 and E5 type subscriptions. Defender for Office 365 Plan 1 is in Business Premium. Attack simulation training needs Plan 2 or E5.
Support staff disable the account, revoke sign-in sessions, remove unfamiliar multi-factor devices and delete hidden forwarding rules. Message trace shows what was sent. Firm contacts law enforcement or insurers using data CloudCentric supplies.
CloudCentric serves businesses across Charleston and the Lowcountry. Give us a call at (844) 422-7000 to discuss your settings and start the work.
Sources: IRS Publication 5708, Creating a Written Information Security Plan; FTC Safeguards Rule: what your business needs to know; FBI IC3 2025 Internet Crime Report; Microsoft Learn, respond to a compromised email account.
Call (844) 422-7000 to set up the technical controls your WISP describes.