Las Vegas headquartered. For firms that already have an IT provider.
Client files, portal credentials, and payment instructions sit in a firm that already has IT support. Mojave assesses the controls around that information, prepares a written plan management can own, and leaves the MSP relationship in place.
An accounting practice holds other people's financial lives: tax returns, payroll, owner documents, and the email threads that move money. The operational questions are concrete. Who can reset a mailbox? Would a fraudulent payment request be stopped? Can the firm restore files if ransomware hits during filing season? Is there a written program with a named owner, or only a verbal assurance from the IT company?
The IRS has told tax and accounting professionals that federal law requires a Written Information Security Plan (WISP), including risk assessment, safeguard testing, and oversight of service providers. The FTC Safeguards Rule is the operational backbone of that expectation: a coordinator, a risk assessment, safeguards that are monitored, and contracts that require providers to protect the information. A specific firm's coverage still depends on the work it performs. Mojave does not issue a legal opinion on that point. The public sources, including the smaller-firm threshold in the Safeguards Rule, are summarized in what a WISP needs to contain.
The person who usually decides is the managing partner, the COO, or the firm administrator. The MSP or internal IT lead should be in the briefing. They do not have to be replaced for the project to be useful.
The closest fit is a multi-partner firm with a real business-client practice, Microsoft 365 or Google Workspace, cloud tax or accounting platforms, and no full-time security leader. A one-person seasonal preparer is usually outside the economics of an $8,500 assessment. The scoping call is where that is said plainly.
An insurer questionnaire. A client due-diligence request. A partner who clicked a payroll-change email. A merger or a new office. A technology change the MSP is already planning. None of these requires you to fire the IT provider. They require someone to show what the safeguards are, in writing, and what should be fixed first.
Purchasing a WISP does not make the firm compliant. The assessment does not certify the practice. Mojave does not promise that insurance will be bound or that a claim will be paid. We do not ask for client returns through the website.
For firm leadership
The IRS has told tax and accounting professionals that federal law requires a written plan, including risk assessment, safeguard testing, and service-provider oversight. A statement from an IT provider is not that plan. Mojave can assess the technical controls and prepare a plan that matches the practice. The plan does not, by itself, prove the controls are working.
No. The engagement looks at how the firm protects client information: identity, email, workspace configuration, endpoints, backups, and the written program. Do not send client returns, payroll files, or portal passwords through the website form.
You can keep that relationship. Mojave is engaged separately to assess important controls, explain the findings to management, and hand your MSP or internal IT team a prioritized plan. Where a specialist gap remains, implementation help is available under its own scope.
The prices shown describe a typical scope. User count is only one factor. Tenants, locations, and system complexity can change the price. After the scoping call you receive a written proposal with the fee, the boundaries, and what we need from you. Work begins when that proposal is accepted. A completion date is set in that proposal, after the delivery scope is known.
The useful outcome of the call is a yes, a no, or a smaller first step. It is not a free security audit.