Question 1

What IT compliance requirements apply to accounting firms in Pennsylvania?

Accepted Answer

Accounting firms in Pennsylvania that handle client financial data are subject to the Gramm-Leach-Bliley Act (GLBA), which requires a written information security program, administrative and technical safeguards, and a designated security coordinator. The IRS also requires tax preparers to maintain a Written Information Security Plan (WISP) that documents how client data is protected. Pennsylvania's Breach of Personal Information Notification Act adds state-level obligations for breach disclosure.

Question 2

What is a WISP and does my CPA firm need one?

Accepted Answer

A Written Information Security Plan (WISP) is a documented security policy that the IRS requires of all professional tax preparers. It must describe how your firm protects client data, how devices and access are managed, how employees are trained, and what steps you take when a security incident occurs. The IRS issued updated WISP requirements in 2022 and audits preparers for compliance. Your IT provider should help you create and maintain your WISP.

Question 3

How do accounting firms protect client financial data from ransomware?

Accepted Answer

The most effective protection combines: endpoint detection and response (EDR) on all workstations and servers, advanced email filtering to block phishing attacks (which are the most common ransomware entry point), multi-factor authentication on all systems and cloud services, verified offsite backups that can be restored quickly if files are encrypted, and regular security awareness training so staff recognize social engineering attempts.

Question 4

What cybersecurity controls does the IRS recommend for accounting firms?

Accepted Answer

The IRS Security Summit recommends a minimum set of controls for tax professionals: multi-factor authentication on all tax software and email, drive encryption on all laptops and desktops, backup software with offsite storage, a security suite including antivirus and email filtering, and a signed confidentiality agreement with any vendor who handles client data. These are minimum baselines — most firms benefit from more comprehensive protections.

Accounting & Financial Services

IT risks that accounting and financial firms in Eastern PA can't afford to ignore

How Keystone supports accounting firms in Berks and Lehigh counties

IT compliance for accounting firms in Pennsylvania — frequently asked questions

Services we use for accounting and financial firms

Not sure where your biggest IT risk is?