Who this is for
Solo CPAs through mid-sized firms, typically 1 to 50 staff, based in Louisiana. You prepare individual and business returns. You hold an EFIN. You touch payroll, bookkeeping, attest, or advisory work. You need IT and security that meet your regulatory load and stay up between January and April 15 without drama.
Pain points specific to Louisiana CPA firms
- The FTC Safeguards Rule applies to you. Tax preparers have been "financial institutions" under GLBA since 2003, and the 2023 Safeguards Rule expansion raised the bar. A documented Written Information Security Program (WISP) is mandatory, not optional.
- IRS Publication 4557 is the floor, not the ceiling. Encryption, MFA, role-based access, retention, breach notification, auditors expect to see them implemented, not just listed in a policy.
- EFIN suspension is a business-ending risk. Lose control of your IRS e-Services credentials or fail a security review and your filing capability stops. Recovery takes months.
- Tax season is unforgiving. Lacerte, ProSeries, UltraTax, Drake, ATX, every minute of downtime between mid-March and April 15 is real revenue and real client trust on the line.
- Client tax data is moving over email constantly. Unencrypted email of W-2s, 1099s, and K-1s is a routine breach waiting to happen, and it is exactly what the FTC penalizes.
- Workpaper retention is 7+ years and growing. Storage, encryption, and recoverability of historical work is a long-term obligation, not a one-time setup.
- Hurricanes do not delay tax deadlines. A flooded office in late August still owes a clean September 15 partnership return. DR is part of the practice, not an afterthought.
What we deliver
- Written Information Security Program (WISP) drafting that satisfies FTC Safeguards Rule ยง314.4 and Pub 4557, mapped to controls actually implemented in your environment.
- Encrypted email for client tax data: Microsoft Purview Message Encryption, S/MIME, or a vetted secure-portal alternative, configured and enforced for all PII-bearing outbound.
- Multi-factor authentication on every system that touches taxpayer data, including Lacerte / ProSeries / Drake admin consoles and your IRS e-Services account.
- Endpoint detection and response (EDR) on every preparer workstation, so a single phishing click does not unlock your client database.
- Managed detection and response (MDR) with 24x7 SOC coverage through our Huntress partnership.
- Microsoft 365 hardening with conditional access, audit logging, safe-link policies, and tenant-level DLP for tax data, instead of the defaults Microsoft ships.
- Tax-season redundancy plan: failover internet, documented manual-filing fallback, and a runbook for "what we do if Lacerte is down on April 14."
- Backup and disaster recovery with immutable, encrypted, off-site copies, restorable in hours, not days, including the option to spin up your environment in our Mandeville facility on short notice.
- Strategic IT advisory (virtual CTO) so platform and software decisions tie back to your firm's profitability, not a vendor's quota.
- Incident response runbook drafted before tax season, so the day a client tax-data envelope leaks you are following a plan, notifying counsel, and meeting the IRS 6-business-day reporting window, not improvising.
How we work
We start with a clear assessment of your firm against IRS Pub 4557 and the FTC Safeguards Rule. From there, we scope an engagement that fits your size, your software stack, and your risk tolerance. You get one point of contact who knows your environment.
- Scoped engagement based on what your firm actually needs, not a tier menu.
- Flat monthly rate after the initial assessment, with no surprise after-hours billing.
- Full client environment isolation. Your data is never on shared infrastructure with another firm.
Why us, in plain terms
We are solo-led but never single-threaded. Huntress provides our 24x7 security operations layer. Our day-to-day operations run on our own internal AI platform, which means less manual toil and more time on your environment. We are based in Mandeville, we know the Louisiana market, and we work with CPA firms by choice, not by accident.
Free 30-minute assessment
If your current setup leaves you guessing whether you would pass an IRS security review or an FTC inquiry, we will tell you in 30 minutes. No pressure, no proposal pushed across the table at the end of the call. Just an honest read on what you have, what is working, and what we would do differently. Schedule a free assessment with Brandon Casey when you have a window.