Industries · CPA firms
IT and security for Houston CPA firms
CPA firms hold some of their clients' most sensitive data. Tax teams handle returns and Social Security numbers. Audit teams receive full participant files for employee benefit plan audits, with Social Security numbers, salaries, bank details and, for health and welfare plans, medical claims. Advisory and internal audit teams work inside clients' payroll, banking and ERP systems. HTL 365 runs your IT, secures how that data comes in, is stored and leaves, and keeps the evidence that your safeguards are in place.
- MBE certifiedNMSDC
- i-SIGMA memberSecure data destruction
- CSDS-ledCertified Secure Destruction Specialist
- NIST SP 800-88 Rev. 2Aligned media sanitization
What you get
Tax: season-ready
WISP built and maintained, FTC Safeguards and IRS Pub 4557 controls in place, and systems patched and backed up before busy season.
Audit: files treated like evidence
Secure portals instead of email for client requests (PBC lists) and benefit plan census files, encryption, access limited to the engagement team, and cleanup when the engagement closes.
Advisory and internal audit: safe client access
Managed, encrypted laptops and MFA for staff working in client systems and due-diligence data rooms.
Retire devices with proof
Documented data destruction for old workstations, drives and copiers that held client files.
Get the free WISP Readiness Self-Assessment
A free, printable self-check you can work through with your team this week.
Frequently asked questions
Do CPA firms need a WISP?
Tax professionals are expected to have a written information security plan under the FTC Safeguards Rule, and the IRS requires PTIN holders to attest to having one.
What is IRS Publication 4557?
IRS guidance on safeguarding taxpayer data, covering security controls tax professionals should have in place.
How should audit teams receive benefit plan census files?
Through a secure, access-controlled portal, not email attachments. Files should be encrypted, limited to the engagement team, and deleted or archived under your retention policy when the engagement closes.
Can HIPAA apply to a CPA firm?
It can. A firm auditing a health and welfare plan that receives protected health information may be acting as a business associate and asked to sign a business associate agreement, which brings HIPAA security expectations.
Do confidentiality rules go beyond tax?
Yes. The AICPA Code of Professional Conduct bars members from disclosing confidential client information without consent, so reasonable safeguards apply across audit, tax and advisory work.
Related
Find your gaps before an auditor does
A free IT & security assessment: we review your devices, Microsoft 365, backups and policies, then give you a plain-English action list.