Tax season doesn’t forgive downtime.
Your firm holds the most sensitive data your clients own — tax returns, financials, Social Security numbers, banking details. The IRS and the FTC both expect you to protect it like it matters, in writing. And from January through April, your systems simply cannot go down. We keep firms secure, documented, and running through tax season and the rest of the year.
Six bottlenecks we walk into, over and over
The WISP that describes a firm that doesn’t exist
Most firms have a written information security plan — a template, downloaded once, with another firm’s name still in the footer. The FTC Safeguards Rule doesn’t ask whether a plan exists. It asks whether the plan describes what you actually do: a named person in charge, a real risk assessment, controls that are in place. A plan that describes a fictional firm is worse than none — it’s evidence you knew.
Seasonal logins that outlive the season
Tax season means seasonal hires, interns, and remote preparers — each needing the right access on day one and no access the day they leave. In most firms we visit, last season’s preparers can still log in. That is exactly the gap Publication 4557’s access rules are written against, and exactly where small firms get exposed.
Client documents arriving by ordinary email
W-2s, bank statements, full Social Security numbers — sitting in inbox attachments, retained forever, searchable by whoever compromises one mailbox. Your client portal exists for a reason; the firms that get hurt are the ones whose clients were never actually moved onto it.
The March workstation failure
A failed workstation in October is an annoyance. In March, with e-file deadlines stacked behind it, it’s a deadline problem with a client’s return inside. Nobody load-tests a small firm’s systems in the quiet months — which is why the failures all arrive in the loud ones.
The email that looks like it came from a partner
The most common attack on accounting firms isn’t exotic. It’s a convincing email — a spoofed message that looks like it came from a partner, asking a client or a bookkeeper to send records or redirect a payment. The FBI’s IC3 counted $2.77 billion in business-email-compromise losses in 2024 alone. Firms are targeted because they sit between money and data.
The backup nobody test-restored before the season
It says “successful” every night. Nobody restored from it in January to prove it works in April. A backup that has never been tested is a hope, and ransomware doesn’t negotiate with hope.
The Security Six, actually in place — and provable
IRS Publication 4557 tells tax professionals to safeguard taxpayer data, and the FTC Safeguards Rule (16 CFR Part 314) requires a written information security program behind it: a designated Qualified Individual, a written risk assessment, access controls, encryption, MFA, staff training, vendor oversight, and a written incident-response plan.
We implement the technical controls those documents call for — MFA on every account with no partner exemptions, encryption on every laptop, tested backups, secure remote access — and we document them, so your WISP describes reality instead of aspirations. Then we verify restores before the season starts, not during it.
One documented program answers both rulebooks
The federal layer is the FTC Safeguards Rule plus IRS Publications 4557 and 5708: a written, firm-specific security program with the Security Six controls in place, reviewed at least annually and whenever the firm changes how it works.
Texas SB 2610 (Business & Commerce Code Chapter 542, in force since September 1, 2025) gives Texas businesses under 250 employees a safe harbor: demonstrate a cybersecurity program conforming to a recognized framework — the same documentation discipline your WISP already requires — and exemplary damages are off the table after a breach.
The same evidence also answers your cyber-insurance renewal, which is asking these exact questions now.
What your WISP should be able to prove
- A named Qualified Individual owns the security program
- A written risk assessment dated within the last 12 months
- MFA enforced on every account — partners included
- Encryption on every device that holds taxpayer data
- Seasonal and departed-staff accounts closed the day they leave
- Backups tested with a real restore — date on file
- A written incident-response plan the firm has actually read
That’s the standard our managed plans are built to — and the checklist below shows you where your firm stands against it.
Grade your own firm against Pub. 4557 in about ten minutes.
A working checklist, not a brochure — keyed line by line to the IRS Security Six and the FTC Safeguards Rule’s written-program duties. If your WISP can’t prove an item today, that item is your finding list, in order.
- Security Six self-checks, in Publication 4557’s own terms
- WISP completeness checks — Qualified Individual, risk assessment, incident response
- Tax-season readiness: seasonal access and a pre-season restore test, dated
The $495 Network & Risk Assessment
We don’t guess about a network we haven’t looked at, and we don’t do free audits that are really sales calls. For a fixed $495, we examine your network, email security, backups, and who has access to what — and deliver a written findings report: what’s solid, what’s exposed, and what to fix first.
The report is yours either way — hand it to whoever you choose. If you sign a managed agreement within 30 days, the full $495 is credited toward your onboarding, so the assessment costs you nothing.
What the report covers
- Email security — SPF, DKIM, DMARC, and MFA coverage
- Endpoint protection status on every computer
- Backup coverage — and when a restore was last tested
- Access review — including accounts of people who’ve left
- A prioritized fix list in plain business language
Sales line: (361) 315-0017, Mon–Fri 8am–5pm CT.
Signs your firm has outgrown “call a guy when it breaks”
- Your written information security plan exists — but nobody’s checked whether the firm actually does what it says
- MFA is on some accounts, not all — or partners are exempted
- Seasonal staff share logins, and old accounts never quite get closed
- Client documents arrive by ordinary email attachments
- Your cyber-insurance application asked questions you had to guess at
- One person in the office is the accidental IT department, on top of their real job
Pricing for CPA and professional firms
$150–$300 per seat, per month — security included in the plan, not sold as an add-on. Your exact price is confirmed in writing before you commit to anything. See what managed IT actually costs for a 20-person company, including the all-in math.
Rated 5.0 out of 5 from 9 Google reviews
“Valhalla Tech provides prompt, reliable service with an extremely knowledgeable staff. From start to finish, my experience was very positive. They are always willing to help at any time and take the time to explain things clearly, which really sets them apart. You can tell they care about their customers and stand behind their work. I highly recommend Valhalla Tech to anyone looking for great service and expertise.”
“Great organization to have customize solutions to fit your organization needs. The Valhalla team delivers exceptional service and products that go above and beyond market standards. The latest project included a complete IT server system install and integration with our ordering management system. Highly recommend!”
“Awesome company and values! They are very responsive and open to answering any questions I have in an easy to understand way. I work with a nonprofit and no other tech company was as helpful as Valhalla, we use them for all of our computer parts ordering. Thank you so much for your continued help! I highly recommend Valhalla Technology to anyone looking for an IT Managed Services company for their business. It will be the best decision you ever make!”
“Called Valhalla Technology because we were having computer issues. They came out same day and were very professional. Told me what was wrong and fixed it. Ever since then if I have any issues, they always answer. Wouldn't think about using anybody else. We now use them for our phones as well! Just good product and service”
Other industries we serve
Dental Practices
Veterinary Clinics
Law Firms
Oil, Gas & Industrial
Construction & Contractors
Start with the $495 Network & Risk Assessment.
A fixed-fee, fixed-scope review of your network, email security, backups, and access controls — delivered as a written findings report with a prioritized fix list. The report is yours either way. Sign a managed agreement within 30 days and the full $495 is credited toward your onboarding.
Frequently asked questions
We’re a small firm — do the IRS and FTC rules really apply to us?
Yes. The FTC Safeguards Rule applies to tax preparation firms regardless of size, and IRS Publication 4557 is written for firms exactly like yours. The good news: for a firm of 10–25 people, the controls are very achievable — MFA, encryption, access control, tested backups, and a written plan that matches what you actually do.
Can you help with our written information security plan?
We implement and document the technical safeguards your plan has to describe, and the $495 assessment report is a written, evidence-based starting point. We’re your IT provider, not your compliance attorney — we’ll flag where you need one.
What happens if something breaks during tax season?
Most issues are caught by monitoring before they break, and most of the rest are fixed remotely the same day. Before the season, we verify your backups with a real restore test — so the worst week of the year is covered.
Do you work with our tax software?
We support the environment it runs in — workstations, network, backups, and access — and coordinate with your software vendor when an issue is inside their application.
What does the $495 Network & Risk Assessment involve?
We review your network, email security, backups, and account access — including departed-staff accounts — and deliver a written findings report with a prioritized fix list, yours to keep either way. Sign a managed agreement within 30 days and the full $495 is credited toward onboarding. Call (361) 315-0017 to schedule.
What exactly is a WISP — and is ours enough?
A WISP is your Written Information Security Program: the document the FTC Safeguards Rule (16 CFR Part 314) requires, and that IRS Publication 4557 points every tax professional to. It names who owns your security program, records a written risk assessment, and documents your safeguards, training, vendor oversight, and incident-response plan. It is enough when it describes what your firm actually does — controls in place, tested, and dated. A downloaded template with the blanks filled in is the most common gap we find, and the checklist on this page walks the same items.
How do we get started?
Call the sales line, (361) 315-0017, or send us a message. We serve CPA and professional firms across the Coastal Bend — Portland, Corpus Christi, Sinton, Rockport, Ingleside, Aransas Pass, and Gregory.