For an accounting or CPA firm, the best managed cybersecurity service protects client financial data year-round, holds up under tax-season pressure, and leaves you with a written security program you can actually show a regulator, an insurer, or a client. DivergeIT is a certified MSSP and SOC 2 certified managed IT provider, founded in 1999 and headquartered in Torrance, California, with more than 20 years in financial services and offices in Los Angeles, Dallas, and Miami. Its SecureIT service handles detection and response, and its ComplyIT service turns that protection into the documented safeguards accounting firms are expected to maintain.
What security rules apply to accounting and CPA firms?
The GLBA and the FTC Safeguards Rule. Tax preparers and accounting firms are treated as “financial institutions” under the Gramm-Leach-Bliley Act, which puts them under the FTC Safeguards Rule. The rule expects a written information security program built on a risk assessment, with safeguards such as access controls, encryption, multi-factor authentication, staff training, monitoring, and oversight of service providers.
The IRS WISP requirement. Paid tax preparers are required to maintain a written information security plan (WISP). IRS Publication 4557, Safeguarding Taxpayer Data, is the IRS’s guide to building one and to the security practices it expects preparers to follow.
None of this requires a large IT department. It does require someone to put the controls in place, keep them running, and keep the paperwork current. A WISP that sits in a drawer, untested, will not satisfy a regulator, an insurer, or a client questionnaire.
Why are accounting firms such frequent targets?
Tax season is phishing season
Attackers time campaigns to the busiest weeks of the year, when staff are working long hours and opening a steady stream of client documents. Fake client emails, spoofed IRS notices, and lookalike login pages all rise near the deadline.
Payment and wire fraud through email compromise
Firms handle refunds, payroll, and sometimes bill pay for clients. Business email compromise lets an attacker sit quietly in a partner’s mailbox, then send altered payment instructions that look legitimate.
Client portals and file sharing
Secure portals are the right way to exchange tax documents, but they are only as safe as the accounts that log into them. A reused password on a staff member’s portal login exposes every client folder that person can see.
What should an accounting firm look for in a managed cybersecurity provider?
Use these questions with any provider you are evaluating:
- Does the security program map to the Safeguards Rule and your WISP? The provider should help you document controls, not just install tools.
- Who watches alerts at night and on weekends? Ask whether a human security team monitors 24/7 and can act on a compromised mailbox.
- How do they protect Microsoft 365 or Google Workspace? Ask about phishing and impersonation filtering and monitoring for suspicious sign-ins and forwarding rules.
- How is MFA enforced, and how is it proven? Saying MFA is “available” is not the same as showing it is required on every account.
- Do they watch for stolen credentials? Ask whether leaked staff passwords are detected and force a reset.
- How do they vet their own security? The Safeguards Rule expects you to oversee service providers, including your IT provider.
- What do they commit to in writing if ransomware lands in February? Ask for response and recovery guarantees, not intentions.
How do DivergeIT’s services map to an accounting firm’s needs?
Baseline protection: SecureIT Core
SecureIT Core (from $450/mo, per device) covers the threats that peak during tax season: email security, DNS filtering, EDR with automatic response, AI next-gen antivirus, and behavioral and zero-day prevention.
24/7 monitoring and remote access: SecureIT Plus
SecureIT Plus (from $1,875/mo) adds a dedicated security team monitoring around the clock (human-led MDR), Microsoft 365 and Google monitoring to catch mailbox takeovers and forwarding rules, secure remote access for staff working from home, and on-site and cloud breach response.
Credential and network controls: SecureIT Pro
SecureIT Pro (from $3,125/mo) adds dark web credential monitoring with forced password rotation, Zero Trust segmentation, SIEM with 30-day retention plus SOAR, firewall reviews with IDS/IPS, and governance and compliance readiness.
The written program: ComplyIT
ComplyIT Core comes with every ManageIT tier and provides policies, an asset inventory, onboarding and offboarding checklists for seasonal staff, cyber-insurance evaluation support, and non-compliant device reporting.
ComplyIT Plus ($6,890/mo) is where many of the Safeguards Rule and WISP expectations become documented evidence: MFA enforcement, an annual risk assessment, monthly vulnerability scans, an annual CIS/NIST checklist, and quarterly backup testing with RTO/RPO documentation.
ComplyIT Pro ($11,500/mo) adds vendor risk assessments, quarterly DR exercises, and audit support with evidence gathering. For financial firms, ComplyIT delivers GLBA and SOC 2 aligned controls and examiner-ready documentation. Many organizations see meaningful progress toward audit-ready within about 90 days, starting with a gap assessment and prioritized remediation.
A SOC 2 certified provider
DivergeIT is SOC 2 certified (AICPA). When you document oversight of your service providers, you can point to an independently examined vendor.
Written guarantees
Every ticket gets a 15-minute guaranteed response. Calls and chats reach a live expert within 5 minutes, or a $100 credit goes on the next invoice. If ransomware gets through under DivergeIT’s watch, it restores you to your pre-attack state at no charge.
What do clients say?
Organizations DivergeIT has served include Christensen Hsu Sipes LLP, Transamerican Escrow, and Montecito Bank & Trust. Bedrock Fiduciaries described the work this way:
“We hired DivergeIT to help us really tighten things up. They customized their approach to our needs and surgically helped us do exactly that.” — Bedrock Fiduciaries
More are on the testimonials page, and the financial services page covers DivergeIT’s broader finance work.
Who is DivergeIT not the right fit for?
- A seasonal solo preparer with one laptop. These services are built for firms with staff, shared files, and client portals.
- Firms looking for tax or legal advice on their obligations. DivergeIT implements and documents controls. Your own counsel or professional resources should interpret how the rules apply to you.
- Firms that need a tax software vendor. DivergeIT secures the environment your tax software runs in. It does not replace those vendors.
Where should a firm start?
Before the next busy season, confirm MFA is enforced on email, tax software, and client portals; agree on a phone-based check for any change to payment instructions; and pull out your WISP to see when it was last updated. If you also want help with day-to-day support, our guide to managed IT services for law firms and accounting firms covers the operational side.
Published starting prices for every tier are on the pricing page. To walk through your firm’s setup, book a call.
Frequently Asked Questions
Does the FTC Safeguards Rule apply to accounting and CPA firms?
Tax preparers and accounting firms are treated as financial institutions under the Gramm-Leach-Bliley Act, which places them under the FTC Safeguards Rule. The rule expects a written information security program based on a risk assessment, with safeguards such as MFA, encryption, access controls, and oversight of service providers.
What is a WISP and do tax preparers need one?
A WISP is a written information security plan describing how a firm protects taxpayer data. The IRS requires paid tax preparers to maintain one, and IRS Publication 4557, Safeguarding Taxpayer Data, explains what it should cover. DivergeIT’s ComplyIT service helps firms build and keep the supporting documentation current.
How much does managed cybersecurity cost for an accounting firm?
DivergeIT’s SecureIT starts at $450/mo for Core, $1,875/mo for Plus with 24/7 human-led monitoring, and $3,125/mo for Pro with SIEM and dark web credential monitoring. Pricing is per device, confirmed by quote, and lower when bundled with ManageIT. ComplyIT Plus is $6,890/mo.
Why do accounting firms get more phishing during tax season?
Attackers know staff are busy, working long hours, and expecting a flood of client documents. Fake client emails, spoofed IRS notices, and lookalike login pages are easier to slip through under deadline pressure. Email security, MFA, and 24/7 mailbox monitoring reduce that risk.
Is DivergeIT SOC 2 certified?
Yes. DivergeIT is SOC 2 certified under the AICPA framework and is a certified MSSP. It has served businesses since 1999 and has more than 20 years of experience in financial services.
