Managed IT for CPA Firms: What Your MSP Must Cover

Managed IT services for accounting firms means outsourcing the technical controls that the FTC Safeguards Rule and IRS Publication 4557 require you to have in writing, tested and documented. Most CPA and bookkeeping practices have neither the time nor the specialist knowledge to build this in-house. If you handle client tax returns, bank details or financial statements, you are already covered by these rules whether you have read them or not.

What does managed IT support for a CPA firm actually need to cover?

It is not just "fix my printer and back up my files." A proper managed IT setup for an accounting practice covers eight distinct areas: a designated qualified individual, a documented risk assessment, access controls, encryption, multi-factor authentication, continuous monitoring, an incident response plan and ongoing oversight of every software vendor you use. Miss any one of these and your written information security plan (WISP) is incomplete. That matters the moment the FTC or a client's insurer asks to see it.

Most solo practitioners and small firms do not have a full-time IT person, let alone a security specialist. That is why this work gets handed to a managed service provider (MSP). The trick is knowing exactly what to ask that provider to own, in writing, rather than assuming "we do IT support" covers it.

Do the FTC Safeguards Rule and IRS Pub 4557 actually apply to your practice?

Yes, almost certainly. The FTC Safeguards Rule applies to any business that is a "financial institution" under the Gramm-Leach-Bliley Act, and tax preparation counts. The IRS Publication 4557 restates the same obligation specifically for tax professionals and is the document IRS examiners reference. Both require a written plan, not a verbal understanding that "we're careful with data."

I have seen firms assume they are exempt because they are small. Firm size affects how the risk assessment scales, not whether the rule applies. A two-person bookkeeping shop handling client bank feeds still needs a WISP.

Who is the designated qualified individual, and can an MSP hold that role?

The Safeguards Rule requires you to name one person accountable for the information security programme. It does not have to be an employee. An MSP can be contracted to serve as, or directly support, that designated qualified individual, but accountability still sits with the firm's owner or partner. Get this named explicitly in your MSP contract, with a person's name attached, not just "our team."

This is the single most common gap I see when firms bring their MSP contract to us for review. The scope of work describes helpdesk tickets and patching, but nobody is named as owning the security programme itself. That is a compliance gap waiting to be found during an audit.

What should the risk assessment and access controls actually include?

The risk assessment needs to identify where client financial data lives, who can reach it and what could go wrong. In practice that means mapping every system: your tax prep software, practice management tool, email, file storage, client portal and any remote access tools. Your MSP should produce this as a document you can hand to an examiner, updated at least annually and after any material change such as a new software vendor or office move.

Access controls follow directly from that map. Ask your MSP to enforce role-based access so a part-time bookkeeper cannot see every client's return, and to remove access automatically when staff leave. Departing employee accounts left active for months is one of the most common findings when we audit a practice's setup.

How should encryption and multi-factor authentication be handled?

Encryption needs to apply to data at rest and in transit: client files on your server, email attachments, anything synced to cloud storage. Multi-factor authentication (MFA) should be mandatory on email, remote access and any client portal or e-filing system, with no exceptions for "the partner who doesn't like the extra step." Both of these are specific, testable controls. A competent MSP should be able to show you configuration screenshots, not just tell you they're "handled."

For a broader view of what strong technical controls look like across encryption, monitoring and backups, our security resource covers the baseline every regulated small business should demand from a provider, accounting firm or otherwise.

What monitoring and incident response should be written into the contract?

Monitoring means someone is actually watching for unusual login attempts, malware and failed access, not just running antivirus and hoping. Incident response means a documented plan: who gets called, what gets isolated, when clients and regulators get notified, and how the firm keeps operating during the fix. Ask your MSP for a written incident response document with named contacts and response time commitments, and ask to see it tested, not just filed away.

This is also where firms discover the gap between "we'll get to it" support and a genuine security-first MSP. If your provider cannot describe their incident response process without checking a manual, that is a warning sign worth acting on before an incident, not after.

Who is responsible for vendor oversight of your tax and practice management software?

Your WISP needs to account for every third-party vendor touching client data, from your tax preparation software to your document portal and even your outsourced payroll processor. That means reviewing each vendor's own security practices and keeping records of that review. Most firms have never done this because nobody told them it was required.

An MSP with real accounting sector experience will already have a process for this, since it overlaps heavily with what other regulated industries face. Healthcare is a useful comparison: providers using our MRI and medical imaging MSP shortlist face nearly identical vendor oversight demands under HIPAA, which is why the questions to ask a provider look so similar across regulated sectors.

Can your MSP actually handle tax season capacity and after-hours support?

This is where generalist IT providers fall apart. A firm running smoothly in June can grind to a halt in March when call volume triples, and a server issue at 9pm the night before a filing deadline is not a "we'll look at it tomorrow" problem. Ask any MSP you're evaluating how their staffing and response times change during tax season specifically, not just what their standard SLA says on paper.

Location matters here too, particularly for firms wanting an MSP that understands local business hours and can be on-site if needed. If you're evaluating providers in specific markets, our regional shortlists for Texas and Chicago filter for providers with genuine accounting sector experience rather than generic small business IT.

How do you shortlist and vet an MSP for a CPA or bookkeeping practice?

Start with providers who can name specific accounting or finance clients they support, not just "we've worked with small businesses." Ask to see a sample WISP they have produced for another client, redacted, and ask who on their team owns FTC and IRS compliance specifically. Our MSP directory is built around exactly this kind of shortlisting, filtering providers by industry experience rather than just price.

For the full checklist covering contract terms, response time guarantees and how to compare quotes properly, our guide on how to choose a managed service provider walks through the buyer process in more depth than we can cover here. And if you're also weighing hosting for your client portal or practice website, our web hosting features comparison checklist is worth reading before you sign anything.

Frequently asked questions

Do sole practitioners need a written WISP?

Yes. The FTC Safeguards Rule and IRS Pub 4557 do not carve out an exemption for one-person practices, though the scale of your risk assessment and controls can reasonably reflect the size of your operation. A sole practitioner still needs a designated qualified individual, even if that person is working with an outsourced MSP.

What happens if we're audited and don't have a WISP in place?

Outcomes vary by regulator and circumstance, but the practical risk is real: findings can range from required remediation plans to reputational damage with clients and referral sources if a breach occurs without documented controls in place. Having a written plan, even an imperfect one that is actively being improved, puts you in a far better position than having nothing.

Should managed IT services cost more for a CPA firm than for a typical small business?

Expect a premium over generic small business IT support, since compliance documentation, vendor oversight and tax season capacity all add real work beyond basic helpdesk services. Providers who quote accounting firms the same flat rate as a retail shop are usually skipping the compliance-specific work entirely, which is worth clarifying before you sign.

Can a small firm build this in-house instead of hiring an MSP?

It's possible if you have a genuinely security-literate person on staff with time to dedicate to it, but most small practices find the ongoing monitoring, vendor reviews and incident response testing consume more hours than expected. Outsourcing to an MSP with named accountability tends to be more reliable, and considerably cheaper than hiring a dedicated in-house security specialist.