Your clients hand you their tax returns, financial statements, Social Security numbers, and bank account details. Every year, without hesitation, because they trust your firm. The question is whether your IT infrastructure deserves that same level of trust.
Most CPA firms know their IT needs improvement. The gap is knowing what “improvement” actually means in a profession that now faces IRS Publication 4557 requirements, FTC Safeguards Rule compliance, and a threat landscape where accounting firms are specifically targeted by cybercriminals who want the data you hold.
This guide walks you through the types of IT providers available to CPA firms, what each model looks like in practice, what to prioritize when choosing, and what a quality provider should cost.
Why CPA Firms Cannot Treat IT Like a Back-Office Expense
Before comparing provider types, it is worth understanding why IT for accounting firms is fundamentally different from IT for a retail store or a marketing agency.
You are a high-value target. Accounting firms hold concentrated financial data: tax returns, SSNs, EINs, bank routing numbers, financial statements. The 2024 Verizon Data Breach Investigations Report found that the financial services and professional services sectors remain among the most targeted by threat actors. Your firm’s data is not just valuable to your clients — it is valuable to criminals.
You face specific regulatory obligations. The FTC Safeguards Rule, updated in 2023, requires non-banking financial institutions (which includes tax preparers and accounting firms) to implement a comprehensive information security program. IRS Publication 4557 outlines data security requirements for tax professionals. Your state board of accountancy may impose additional requirements. These are not suggestions — they are enforceable mandates.
Tax season is an operational stress test. January through April, your firm runs at peak capacity. Every system must work, every file must be accessible, every deadline must be met. An IT failure during tax season does not just cost money — it damages client relationships and threatens filing deadlines that carry legal consequences.
Comparing IT Provider Types for CPA Firms
National Managed Service Providers
Large national MSPs serve thousands of clients across every industry. They bring scale, broad toolsets, and 24/7 help desk coverage.
What works for CPA firms:
- Enterprise-grade security tools that meet baseline compliance requirements
- Round-the-clock support for after-hours work during tax season
- Standardized onboarding and documentation
What does not work for CPA firms:
- Support staff who do not know the difference between a 1040 and a 1099 — or why that matters for data classification
- Generic compliance frameworks that check boxes but do not map to IRS or FTC requirements
- No understanding of accounting-specific software (CCH Axcess, Lacerte, UltraTax, Drake, ProSeries, QuickBooks Enterprise, Sage)
- Cookie-cutter security policies that do not account for the seasonal nature of your workload or the sensitivity of tax data
Break-Fix IT Support
Break-fix means you call someone when something stops working. They fix it, send an invoice, and leave until the next problem.
What works for CPA firms:
- Low cost when everything is functioning
- No monthly commitment
What does not work for CPA firms:
- No proactive monitoring means problems surface during tax season when the stakes are highest
- No compliance documentation. When the FTC or IRS asks for evidence of your security program, you have nothing to show.
- No patch management. Unpatched systems are the most common entry point for ransomware, and accounting firms are prime ransomware targets.
- No cybersecurity baseline. Break-fix providers do not manage your firewall, your endpoint detection, your email security, or your backups on an ongoing basis.
- The financial exposure is real: the IBM Cost of a Data Breach Report found that the average breach cost reached $4.88 million in 2024. Even a fraction of that number is existential for a 20-person CPA firm.
Accounting-Specific or Professional Services MSPs
These providers specialize in serving CPA firms, law firms, and other professional services organizations. They understand your software, your compliance obligations, and your operational rhythm.
What works for CPA firms:
- Tax season preparedness: proactive system checks, load testing, and extended support hours before January
- Hands-on experience with tax and accounting software (CCH, Lacerte, Drake, Thomson Reuters, Sage, QuickBooks)
- FTC Safeguards Rule and IRS 4557 compliance expertise built into the service, not bolted on as an add-on
- Understanding of accounting workflows: secure client portals, e-filing infrastructure, multi-monitor setups, remote access for seasonal staff
- Compliance documentation that maps directly to the Safeguards Rule’s nine elements
What does not work for CPA firms:
- Smaller teams may have limited availability for true 24/7 support
- May not be available in every geographic market
- Potentially higher per-user cost than a generalist provider
In-House IT Hire
Hiring a dedicated IT person gives your firm on-site, full-time attention. They learn your environment deeply and respond immediately.
What works for CPA firms:
- Deep familiarity with your specific environment
- Immediate on-site response for hardware issues
- Understands your team’s workflows and preferences
What does not work for CPA firms:
- A qualified IT professional in the Bay Area commands $120,000 to $180,000 in salary, plus benefits, training, and tool costs
- One person cannot be an expert in networking, cybersecurity, compliance, cloud, accounting software, and backup/disaster recovery
- No coverage during vacations, sick days, or turnover
- Compliance documentation and security auditing still require outside expertise
- Cybersecurity is a specialized discipline. Asking your in-house IT person to also be your security team is like asking a tax preparer to also handle your firm’s litigation.
What Your IT Provider Must Understand About CPA Firms
FTC Safeguards Rule Compliance
The FTC Safeguards Rule requires accounting firms and tax preparers to develop, implement, and maintain a comprehensive information security program. As of the 2023 amendments, this includes specific technical requirements: risk assessments, access controls, encryption, multi-factor authentication, and incident response planning. Your IT provider should be able to articulate exactly how their services map to each of the Safeguards Rule’s nine elements. If they have never heard of the Safeguards Rule, they are not qualified to serve your firm. One82 offers a free FTC Safeguards Guide for firms that want to understand their obligations.
IRS Publication 4557 Requirements
IRS Publication 4557 provides the IRS’s data security plan for tax professionals. It covers creating a security plan, protecting taxpayer data, recognizing phishing and data theft, and reporting breaches to the IRS. Your IT provider must know this document and be able to help you implement its recommendations, not just tell you it exists.
Tax Season Readiness
A qualified IT provider for CPA firms conducts pre-season system checks every November or December. This includes: verifying server capacity, updating all software and security patches, testing remote access for seasonal employees, validating backup and disaster recovery, load-testing e-filing connections, and confirming that all client portal access works correctly. If your provider does not have a tax season readiness checklist, they do not understand your business.
Accounting Software Expertise
Your IT provider should have proven experience supporting the specific platforms your firm uses. The most common include:
- Tax preparation: CCH Axcess, Lacerte, UltraTax CS, Drake Tax, ProSeries
- Practice management: CCH Practice Management, Thomson Reuters Practice CS, Canopy
- Accounting: QuickBooks (Desktop and Online/Enterprise), Sage, Xero
- Document management: SmartVault, ShareFile, eFileCabinet, GoFileRoom
- Client portals: Liscio, Canopy, SafeSend, ShareFile
If your IT provider cannot troubleshoot and optimize these platforms without research, you are paying them to learn on your time.
Cybersecurity Appropriate for Accounting Firms
Beyond baseline security (antivirus, firewall, email filtering), an accounting firm’s cybersecurity program should include:
- Multi-factor authentication on all systems containing client data
- Endpoint detection and response (EDR) on every device
- Security awareness training, especially around tax-season phishing
- Dark web monitoring for compromised firm credentials
- Encrypted file sharing for client documents (not plain email attachments)
- Documented incident response plan specific to taxpayer data breaches
What Quality IT Support Costs for CPA Firms
Pricing for managed IT services varies based on firm size, service level, and compliance requirements. Here is what to expect in the Bay Area market:
| Service Level | Per User/Month | What Is Included |
|---|---|---|
| Basic managed IT | $150 - $200 | Help desk, monitoring, patch management, basic backup |
| Standard managed IT + security | $200 - $250 | Above plus EDR, email security, MFA management, quarterly reviews |
| Comprehensive (IT + security + compliance) | $250 - $300 | Above plus FTC Safeguards documentation, incident response planning, annual risk assessments, tax season readiness |
For a 20-person CPA firm, expect to invest $3,000 to $6,000 per month for quality managed IT. That covers your entire technology stack: infrastructure, security, compliance, and support.
Compare that to an in-house IT hire at $10,000 to $15,000 per month (salary plus benefits) who still cannot cover every specialty your firm needs.
How One82 Serves CPA Firms
One82 has provided managed IT, cybersecurity, and compliance services to professional services firms across the Bay Area since 1999. We serve CPA firms in San Jose, Campbell, Palo Alto, Los Gatos, and throughout Silicon Valley.
Our approach starts with the understanding that your firm’s technology exists to serve two purposes: protect client data and keep partners focused on billable work. Everything we do maps to those outcomes.
We maintain deep expertise in the accounting software ecosystem, conduct pre-tax-season readiness checks, provide FTC Safeguards Rule compliance documentation, and deliver cybersecurity services calibrated to the specific threats that accounting firms face.
We are not the only option. A firm that needs coast-to-coast coverage or a firm that wants to build an internal IT department may find better fits elsewhere. But for Bay Area CPA firms that want a provider who has lived alongside their profession for over two decades — one who understands that a server failure on April 14th is not just an IT problem, it is a crisis — One82’s managed IT services are designed for that reality.
If you are evaluating your firm’s IT support, schedule a 15-minute discovery call to discuss where your firm stands and what to consider.
FAQ
What IT compliance requirements apply to CPA firms?
CPA firms and tax preparers must comply with the FTC Safeguards Rule (which requires a written information security program with specific technical controls), IRS Publication 4557 (which outlines data security requirements for tax professionals), and applicable state regulations. California firms must also comply with the CCPA regarding personal information they hold. Many firms additionally face compliance requirements from their professional liability insurance and cyber insurance carriers. A qualified IT provider should be able to map their services directly to each of these requirements and produce compliance documentation on demand.
How should a CPA firm prepare its IT for tax season?
Tax season IT preparation should begin no later than November. A comprehensive readiness program includes: verifying server and cloud capacity to handle peak workloads, updating all tax software to current versions, testing remote access for seasonal and part-time staff, validating backup and disaster recovery procedures, load-testing e-filing connections, confirming client portal functionality, reviewing cybersecurity controls (especially phishing defenses, since tax-season phishing attacks spike dramatically), and ensuring all endpoints are patched and protected. Your IT provider should have a documented tax season readiness checklist and complete all preparations before January 1.
What is the FTC Safeguards Rule, and does it apply to my accounting firm?
The FTC Safeguards Rule applies to “financial institutions” as defined by the FTC, which includes tax return preparers, accountants, and other financial service providers. The rule requires these firms to develop, implement, and maintain a comprehensive information security program. The 2023 amendments added specific technical requirements including risk assessments, access controls, data encryption, multi-factor authentication, continuous monitoring, incident response planning, periodic testing of security controls, and oversight of service providers. Non-compliance can result in FTC enforcement actions and penalties. One82 offers a free FTC Safeguards Guide that explains each requirement in detail.
How much does IT support cost for a small CPA firm?
For a Bay Area CPA firm with 10 to 30 employees, quality managed IT services typically cost $150 to $300 per user per month. A 20-person firm should expect to invest $3,000 to $6,000 per month for comprehensive coverage including help desk support, proactive monitoring, cybersecurity tools, backup and disaster recovery, and compliance documentation. The exact cost depends on the firm’s compliance requirements, the complexity of its software stack, and the level of cybersecurity protection needed. This investment is significantly less than hiring a full-time IT professional in the Bay Area ($120,000 to $180,000 per year in salary alone) and provides broader expertise.
What accounting software should my IT provider know how to support?
Your IT provider should have hands-on experience with the platforms your firm relies on daily. For tax preparation, this includes CCH Axcess, Lacerte, UltraTax CS, Drake Tax, and ProSeries. For practice management: CCH Practice Management, Thomson Reuters Practice CS, and Canopy. For document management and client portals: SmartVault, ShareFile, GoFileRoom, Liscio, and SafeSend. They should also be proficient with QuickBooks (Desktop, Online, and Enterprise), Sage, and Xero. A provider who has to learn your software during billable support calls is costing you twice — once for the support fee and again for the lost productivity.
Do CPA firms need cybersecurity beyond basic antivirus?
Yes. Basic antivirus is no longer sufficient for any firm that handles sensitive financial data. CPA firms should have multi-factor authentication on all systems, endpoint detection and response (EDR) on every device, email security with advanced phishing protection, encrypted file sharing for client documents, security awareness training for all staff, dark web monitoring for compromised credentials, and a documented incident response plan. The 2024 Verizon DBIR confirms that professional services firms remain heavily targeted, and the IRS has specifically warned tax professionals about increasing cyberattacks. Your IT provider should deliver all of these capabilities as part of their standard service, not as expensive add-ons.
What questions should I ask an IT provider before hiring them for my CPA firm?
Ask these questions to evaluate a provider’s fitness for your firm: (1) What is IRS Publication 4557, and how do your services address it? (2) Can you walk me through how you support FTC Safeguards Rule compliance? (3) What tax and accounting software do you have direct experience supporting? (4) What does your tax season readiness process look like? (5) How do you handle after-hours support during January through April? (6) Can you produce a sample compliance report for a cyber insurance application? (7) What is your average response time for critical issues? If a provider hesitates on any of these questions, they do not specialize in accounting firms — regardless of what their website says.
