Cybersecurity checklist for CPA firms

CPA firms, accounting firms, and tax professionals hold client returns, payroll, portal credentials, and the email that moves money. This checklist is a practical starting point for managing partners and firm administrators who want to know which controls to ask about before insurer questionnaires, client due diligence, or a Written Information Security Plan. It is not a certification and it does not replace an assessment.

For how Mojave scopes this work, see cybersecurity for CPA and accounting firms.

Identity and access

• Multifactor authentication is required for email, remote access, and admin accounts.
• Privileged accounts are limited and reviewed when people join, leave, or change roles.
• Shared mailboxes and generic logins are known and justified, or removed.

Email and payment fraud

• Staff know how payroll, wire, and vendor-change requests are verified before money moves.
• Mail filtering and spoofing protections are in place for the firm’s domains.
• Partners and admins can say who can reset a mailbox and under what process.

Client portals and tax platforms

• Access to tax and accounting platforms is tied to named users, not a shared firm password.
• Departed staff lose portal access in a defined timeframe.
• Client documents are not routinely emailed in the clear when a portal is available.

Endpoints and backups

• Firm devices are managed, patched, and protected with current endpoint controls.
• Backups cover the systems that hold client files, and restore has been tested.
• Personal devices that touch firm email or portals follow a written rule, or are disallowed.

MSP and service-provider oversight

• The firm can name its MSP or internal IT lead and what they are responsible for.
• Contracts or statements of work cover how client information is protected.
• Admin rights held by the provider are understood by firm leadership.

Written plan and incident readiness

• There is a Written Information Security Plan with a named owner, not only a verbal assurance from IT.
• Someone can describe the first actions if ransomware, a compromised mailbox, or a payment fraud attempt hits during filing season.
• IRS WISP requirements and the FTC Safeguards Rule have been reviewed against how this practice actually operates. See WISP requirements for accounting and tax firms.

What to do with the gaps

Unchecked items are the brief for a Security Baseline & Resilience Assessment. When the firm also needs a written program, add WISP & Incident Readiness. Buying a document or running a scan alone does not make the firm compliant.