Resource
CPA & accounting security checklist
A practical starting list for accounting firms handling client financial data. Not legal advice.
Use this checklist before tax season surges and when onboarding new vendors. Salvus Cyber can help close gaps through assessment and scoping.
Core controls
- MFA enforced on all tax software and M365/Google accounts
- Separate devices or profiles for seasonal contractors
- Client PII access logs reviewed quarterly
- IRS Publication 4557 controls documented
- Backup tested and restore verified before tax season
- Endpoint encryption on all laptops that touch client files
- Vendor list reviewed for data handling agreements
- Phishing simulation run at least once per year
© Salvus Cyber · Houston, Texas · For informational use only