Tax season is the worst possible time for a server failure, a phishing hit, or a help desk that takes two days to call back. By the time returns are due, there’s no slack left in the schedule to fix a problem that could have been caught in the fall. For NJ accounting, tax, and bookkeeping firms, autumn is the window to get IT support for accounting firms lined up and tested before the January rush. Here’s a six-item checklist to work through before your busy season starts.
1. A written information security plan (WISP)
Paid tax preparers are expected to maintain a written information security plan under the FTC Safeguards Rule, and the IRS publishes two reference documents worth knowing about: Publication 4557, Safeguarding Taxpayer Data, and Publication 5708, a WISP template guide for smaller firms. A WISP lays out who’s responsible for data security, what safeguards are in place, and how the firm responds if something goes wrong. This isn’t legal advice — review your specific obligations with your compliance advisor — but from an IT standpoint, having a current WISP on file (and the technical controls to back it up) is something your firm should be able to produce if a client or regulator asks.
2. Multi-factor authentication everywhere
MFA should be turned on for email and Microsoft 365, your tax preparation software, any client portal, and remote access tools — not just the systems that feel sensitive. Seasonal and part-time staff are a common gap: shared logins and skipped MFA setups are exactly what makes a compromised account spread quietly through a firm’s systems during the busiest weeks of the year. Before onboarding seasonal help, confirm every account they’ll use requires its own login and its own second factor.
3. Secure client file exchange
If your firm is still emailing W-2s, 1099s, and completed returns as attachments, tax season is the wrong time to keep doing it that way. A client portal or encrypted file-sharing tool gives clients a safer way to hand off documents and gives your firm an audit trail of who sent what and when. It also helps with a second, very predictable seasonal problem: phishing emails that impersonate the IRS or spoof a client’s name tend to spike every January through April, and email filtering tuned to catch W-2 and tax-document lures (alongside the email filtering and MFA already mentioned above) closes off one of the easiest ways firms get hit during the season.
4. Backups and a test restore before January
Your tax software’s client database, document files, and Microsoft 365 data all need a backup that goes beyond “it’s in the cloud somewhere” — an off-site or immutable copy that can’t be touched by the same ransomware event that hits your primary systems. The step firms skip is testing the restore itself: a backup nobody has ever actually recovered from is a guess, not a safety net. If you haven’t compared your current setup against a real disaster-recovery plan, our backup vs. disaster recovery post walks through the difference and what each one actually gets you back.
5. Hardware and software readiness
Machines that are slow, crash under load, or are simply out of support shouldn’t make it into tax season. Windows 10 support ended in October 2025, so any PC in your office still running it needs an upgrade plan now, not in February. Confirm your tax software is on a current, supported version well ahead of the first returns, and check that scanners and printers have current drivers before the busiest print runs of the year. If you’re bringing on seasonal staff, get their PCs and remote access configured and tested in advance rather than on their first day.
6. Support that matches your deadlines
During a normal week, a same-day response to a support ticket might be fine. During the two weeks before a filing deadline, it isn’t. Know what your IT provider actually commits to in writing — not just what they say over the phone — including response times during crunch weeks. Our post on what your IT support SLA should spell out covers the specifics worth confirming before you need them.
Quick recap
- Do you have a current written information security plan?
- Is MFA required on every account — including seasonal staff?
- Have you stopped emailing tax documents as attachments?
- Has your backup actually been test-restored recently?
- Is every machine supported and every seasonal PC ready to go?
- Do you know your IT provider’s committed response time in writing?
If you’d like help working through any of these before the season starts, contact us or call 732-808-0577 — we’ll walk through where your firm stands today and what’s worth fixing first.
Need hands-on help with this? See our IT Support for Accounting Firms →