Updated on October 25, 2026 by Whole Technology
Most accounting firms don’t have an IT problem they can see. They have blind spots — and the same ones show up again and again when we run our free 27-point IT & security assessment at firms across the Philadelphia area.
The assessment checks six areas: cybersecurity, Microsoft 365 and email, backup and disaster recovery, compliance, hardware and infrastructure, and IT strategy. Here’s what it typically finds.
1. Cybersecurity: protected on paper, exposed in practice
The most common findings:
- Firewall firmware that’s years out of date, with open ports and remote-access exposure nobody remembers setting up.
- Endpoint protection that isn’t on every workstation — the partner’s laptop got missed, or the seasonal tax-season machine was never enrolled.
- Patch gaps on the server or a handful of PCs, quietly accumulating known vulnerabilities.
- Guest and internal Wi-Fi on the same network, so a client’s phone sits one hop from your tax data.
- Phishing exposure: no filtering tuned for the impersonation emails that target CPA firms every filing season. (We wrote about how those attacks work in our post on tax-season phishing.)
None of these are exotic. They’re the everyday gaps attackers actually use.
2. Microsoft 365: MFA that’s “on” but not enforced
Almost every firm tells us MFA is turned on. The assessment often finds:
- MFA enabled but not enforced for every user — a legacy account, a shared mailbox login, or the admin account itself is exempt.
- Too many global admins, including people who left the firm or never needed that level of access.
- No DMARC record, which means anyone can spoof your firm’s email domain to your clients.
- Licenses you’re paying for but not using — departed staff, duplicate subscriptions, premium tiers nobody uses.
- No backup of mailboxes and SharePoint. Microsoft keeps your data available; it doesn’t protect you from deletion or ransomware the way most firms assume.
3. Backups that have never been tested
This is the finding that worries us most. Firms almost always have backups. What they usually don’t have:
- A successful restore test — ever. A backup that has never been restored is a hope, not a plan.
- An offsite or cloud copy separated from the network, so ransomware can’t reach it too.
- A documented recovery plan with a recovery-time objective. If your server died on March 20, how many days until you’re filing again? Most firms can’t answer that. (Our 3-2-1 backups guide for accounting firms covers what good looks like.)
4. Compliance: the IRS expects a written plan
The FTC Safeguards Rule requires firms handling taxpayer data to maintain a Written Information Security Plan (WISP). Typical findings:
- No WISP at all, or a template that was never filled in.
- Unencrypted laptops that travel home with staff.
- Offboarding gaps: former employees whose accounts were never disabled.
- No audit logging, so there’s no record of who accessed what.
5. Hardware: fine — until tax season
- Servers past warranty, workstations that were “fine” until UltraTax updates and peak-season load hit them at once.
- No battery backup (UPS) on key equipment, so a two-second power flicker corrupts work in progress.
- Network gear nobody has touched or documented in years.
6. IT strategy: one person holds all the keys
The quietest risk: your firm’s entire IT knowledge lives with one person — an employee, a break-fix tech, a partner’s nephew. If they’re unavailable in February, so is your firm. The assessment flags single points of failure, undocumented systems, and support arrangements that only react when something breaks.
What you get
Every finding comes back in a plain-English report, ranked by risk to your firm, with a recommended fix plan and real pricing — plus the cost of doing nothing, spelled out. We walk through it on a 30-minute call. The assessment is free, there’s no obligation, and if we’re not the right fit, the report is yours to keep and use with whoever you like.
If your firm is heading into tax season on hope, start here: request your free 27-point IT & security assessment. The request takes about 60 seconds, most checks run remotely, and you’ll have your report within a week. Preparing for filing season? Pair this with our year-end IT checklist for accounting firms.
It checks six areas: cybersecurity, Microsoft 365 and email, backup and disaster recovery, compliance, hardware and infrastructure, and IT strategy.
Outdated firewall firmware, endpoint protection missing on some workstations, patch gaps, guest and internal Wi-Fi on the same network, and phishing filters not tuned for CPA firms.
Firms almost always have backups but almost never a successful restore test. Most also lack an offsite copy and a documented recovery plan.
The FTC Safeguards Rule requires a Written Information Security Plan, but many firms have none. The assessment also flags unencrypted laptops, offboarding gaps, and missing audit logging.
