IT support for accounting and tax firms, built for tax season and the IRS

Look for a provider that already understands how a tax and accounting practice runs: tax software like CCH Axcess, UltraTax CS, Lacerte or Drake, client portals, remote access, the crunch of tax season, and the IRS and FTC rules for protecting taxpayer data. Then check four things: how fast a real person starts on your issue, whether security and backup are built into the plan, whether costs are predictable, and whether they can help with your written information security plan. Ask for references from other firms, and ask how they’d onboard you without touching tax season.

See the questions to ask in our guide

A managed IT provider acts as your outsourced IT department for a predictable monthly fee. For an accounting firm, that typically covers support for partners and staff, monitoring and maintenance of servers and computers, tax software and client portal support, cybersecurity, backup, Microsoft 365, and help with the written information security plan and testing the FTC Safeguards Rule requires. It also covers planning, so upgrades happen before tax season instead of during it.

Managed IT services

Usually not, and it isn’t fair to them either. One person can’t be an expert in servers, security, tax software, client portals and compliance at once, and they’re needed most in March and April, exactly when their real job is busiest. When they’re out, nobody covers. If you have someone you trust, co-managed IT gives them a full team behind them instead of replacing them.

Managed IT services

Fairoaks IT supports the software accounting firms run on, including CCH Axcess, CCH ProSystem fx, UltraTax CS, Lacerte, ProConnect, ProSeries, Drake, QuickBooks Desktop and QuickBooks Online, plus client portals like SmartVault, ShareFile, Canopy, Karbon and TaxDome. We keep the servers, hosted environments, computers and integrations behind them running, handle user access and security, and deal directly with the software vendor when an issue crosses into their side.

See the full software list

Fairoaks IT provides managed IT and cybersecurity for CPA, accounting, bookkeeping and tax firms throughout Eastern Massachusetts, Rhode Island and the Charlotte, NC metro area, from offices in Franklin, MA and Belmont, NC. We’ve been independent and owner-led since 1991, accounting firms have been part of our client base from the start, we won the Soteria Award for Most Trusted MSP in North America, and founder and president Tom Crossley leads our accounting work.

Accounting IT in Massachusetts and Rhode IslandAccounting IT in the Charlotte, NC area

How fast does a real person start on an issue during tax season? Do you support our tax software and client portal today? Can you help us write and maintain our written information security plan? How will you support our Qualified Individual? When did you last test-restore a client’s backup? What isn’t included in the monthly fee? How will you onboard us without disrupting tax season? Can I talk to another accounting firm you support?

Get the full list, with what good answers sound like

Start in the fall. Install tax software updates and confirm licenses, replace aging computers before January, test that backups actually restore, review who has access to what, turn on multi-factor authentication everywhere, refresh staff on phishing, set up seasonal staff in advance, and update your written information security plan. Our guide includes a pre-tax-season IT checklist you can work through with your team.

Get the pre-tax-season checklist in our guide

With the right preparation, a bad hour instead of a lost week. That takes backups stored where ransomware can’t reach them and tested regularly, a recovery plan that says how fast your tax software and client files come back, and support that starts fast. Fairoaks IT’s average time to start on a support issue is under 12 minutes. Without that preparation, an outage in April can mean missed deadlines, extensions and clients calling to ask what happened.

How our support works

Give them company-managed laptops or a secure hosted environment instead of personal computers, require multi-factor authentication on every login, keep client files in your portal or file system rather than on home computers, and use secure remote access you can turn off the day the season ends. A short onboarding and offboarding checklist keeps seasonal access from lingering into summer.

Get the seasonal staff checklist in our guide

It depends on your software and how your team works. Cloud products like CCH Axcess and ProConnect run in the vendor’s cloud. Desktop products like UltraTax CS, Lacerte, ProSeries, Drake and QuickBooks Desktop can run on a well-maintained office server, or in a secure hosted environment your team reaches remotely, which makes remote work easier. We lay out the options, costs and security trade-offs side by side.

Cloud computing

Use a client portal, not email. Portals like SmartVault, ShareFile, Canopy, Karbon and TaxDome encrypt files, track who downloaded what, and keep Social Security numbers out of inboxes. Set the portal up with multi-factor authentication, ask clients to use it every time, and make it easy for them. When something must go by email, encrypt it. The FTC Safeguards Rule requires customer information to be encrypted in transit over external networks.

Get the document exchange policy starter in our guide

Fairoaks IT provides live support during business hours, with after-hours support available, and our average time to start on a support issue is under 12 minutes. For firms that work late during the season, we plan ahead: monitoring that catches problems before morning, a clear process for urgent after-hours issues, and making sure the systems you depend on are updated and tested before the season starts.

How our support works

Almost certainly, if you prepare tax returns or provide similar financial services. The FTC treats tax preparation firms as financial institutions under the Gramm-Leach-Bliley Act, so the Safeguards Rule applies whether you’re a sole practitioner or a large firm. It requires a written information security program, a designated Qualified Individual, a risk assessment, specific safeguards like multi-factor authentication and encryption, staff training, vendor oversight, an incident response plan and breach notification to the FTC.

Your written security plan

A written information security plan, or WISP, documents how your firm protects client information: who’s responsible, what risks you face, the safeguards in place, how staff are trained, how vendors are overseen and what you’ll do after a breach. The FTC Safeguards Rule requires one, and the IRS expects every paid preparer to have one. IRS Publication 5708 provides a template to start from, but a plan only helps if it reflects how your firm actually works and is kept current. We help firms write and maintain theirs.

Get the WISP outline checklist in our guide

PTIN renewal opens in mid-October each year, and PTINs expire on December 31. The renewal form, Form W-12, includes a question about the requirement for paid preparers to have a written information security plan. The requirement itself is real, so renewal season is a good time to make sure your plan exists, reflects how your firm works today and has been reviewed recently.

Your written security plan

Since May 13, 2024, the FTC Safeguards Rule has required firms to notify the FTC as soon as possible, and no later than 30 days after discovery, when unencrypted information about 500 or more consumers is acquired without authorization. The count is consumers, not client households, so spouses and dependents count. State breach laws, client notices and IRS reporting can apply too, so your response plan should be written before you need it.

Get the data theft response checklist in our guide

The Qualified Individual is the person the Safeguards Rule requires to oversee, implement and enforce your information security program. The rule allows an outside provider to fill the role, but your firm stays responsible and must designate a senior person of its own to oversee them. At Fairoaks IT, we support the Qualified Individual you designate with the reports, evidence and recommendations they need, rather than taking over the role.

Your written security plan

Some. Firms that maintain information on fewer than 5,000 consumers are exempt from a few requirements, including the written risk assessment, the written incident response plan, annual reporting to leadership and certain testing requirements. They still need a written information security program, a Qualified Individual, multi-factor authentication, encryption, secure disposal, staff training and breach notification. And the IRS still expects a WISP regardless of size.

Schedule a discovery call

Publication 4557, Safeguarding Taxpayer Data, is the IRS guide to protecting client information: security basics, recognizing data theft and what to do after it. Publication 5708 walks tax professionals through creating a written information security plan, with a sample template. Both are free from the IRS and a good place to start, but neither replaces actually putting the safeguards in place.

Your written security plan

Because your files hold exactly what criminals want: Social Security numbers, birth dates, bank account numbers and tax data they can use to file fraudulent returns or open accounts. Firms also handle a huge volume of email and attachments from people they don’t know well, especially in tax season, which makes phishing easier. The defense is layered: multi-factor authentication, email filtering, endpoint protection, encrypted file exchange, tested backups and trained staff.

Managed security services

An email arrives from someone who says they need a return prepared, often mentioning a referral, with a link or attachment that supposedly holds their tax documents. Opening it can install malware that steals passwords or gives criminals remote access to your systems. The IRS and its Security Summit partners warn tax professionals about these scams every year. Verify new clients by phone, use your portal for documents, and never enter a password from an emailed link.

Security questions

Act fast and follow your written plan. Contact your IT provider and your cyber insurance carrier immediately, preserve evidence, and contact your IRS Stakeholder Liaison so the IRS can help protect your clients’ accounts. Notify the states where you file returns and contact law enforcement. If unencrypted information about 500 or more consumers was taken, notify the FTC within 30 days, and check your state’s breach law for client and attorney general notices.

Get the data theft response checklist in our guide

Regular email isn’t a safe place for Social Security numbers and tax records. Messages can be intercepted, forwarded or left sitting in inboxes for years, and a single compromised mailbox can expose everything in it. Use a client portal for documents, encrypt email when something must go that way, require multi-factor authentication on every mailbox, and set retention rules so old attachments don’t pile up.

Secure client file exchange

Not with free or personal AI accounts. Client tax data, Social Security numbers and financial records shouldn’t go into tools that aren’t approved for that data, and doing so can conflict with your written information security plan. Business-grade AI tools, including options within Microsoft 365, can be set up with the right protections. A short AI use policy should name approved tools, list what never goes in and say who to ask first.

Talk to us about AI tools

Most carriers ask about the same core controls: multi-factor authentication on email and remote access, endpoint detection and response, backups that are offline or can’t be altered and are tested, security awareness training, timely patching and how you verify payment or banking changes. Many of these overlap with the FTC Safeguards Rule, so one well-run program can satisfy both. Make sure every yes on the application is true. Your insurance agent has the final word on your policy.

Your written security plan

It depends on how many people and devices you support, whether you run servers or a hosted environment, how many offices and remote staff you have, your compliance needs, and what’s covered in the monthly fee versus billed separately. Most managed IT providers price per user or per device each month, with onboarding and projects quoted separately. Compare what’s included, not just the total, and weigh it against what a lost day in April would cost. Our IT Buyer’s Guide explains the pricing models and the contract terms to watch for.

Get the free IT Buyer’s Guide

A good plan lists both clearly. Monthly plans typically include support for your users, monitoring and maintenance, security tools, backup and Microsoft 365 management. Hardware, software licenses, tax software subscriptions and larger projects, like a server replacement, a move to a hosted environment, or WISP and penetration testing work, are usually quoted separately. Ask every provider for their exclusions in writing. At Fairoaks IT, we explain all costs up front, so there are no hidden fees or surprise invoices.

What you can count on

Many managed IT agreements run for multiple years, which locks in your rate and gives your provider reason to invest in your environment. What matters is what happens if things aren’t working, so ask every provider two questions: what happens if you don’t deliver, and how are price increases handled? Get both answers in writing. At Fairoaks IT, ours are spelled out in our agreement, and we’ll walk you through every page before you sign.

What you can count on

Switch in the off-season. The best window is late spring through early fall, away from your filing deadlines. A good transition documents every system, password, license and vendor, including your tax software, client portal and remote access, then coordinates a handoff from your current provider. Urgent risks like backups and multi-factor authentication get fixed first. Fairoaks IT assigns a point of contact and holds weekly check-ins until onboarding is complete.

How working with us starts

We look at your technology the way you’d look at a client’s books: all of it, with a written report at the end. That includes your servers or hosted environment, tax and accounting software, client portal, Microsoft 365, backups, security tools and where your written information security plan stands. You get a plain-English summary of what’s working, what’s at risk and what to fix first. No scare tactics, just facts. It starts with a discovery call.

Schedule a discovery call

If you have around 10 or more people on computers every day, or your firm can’t afford to lose a day during tax season, managed IT usually makes sense. Smaller firms carry the same IRS and FTC obligations as large ones, and a single breach or outage can hurt a small firm more. A short discovery call is the fastest way to know.

Schedule a discovery call