ADVISORY & CONSULTING

Six Steps to Battle Cybersecurity Risks

What cost or time investment would you pay to protect your firm and your clients?

By Donny Shimamoto
Cybersecurity for Accountants

When it comes to cybersecurity, one risk aspect to consider is whether or not the steps you’ve taken to protect clients’ PII will stand up in court in the event of litigation related to a data breach or damages to a client because of a cybersecurity issue caused by your firm. During litigation, opposing counsel will often bring in cybersecurity experts to describe cybersecurity best practices—which are often a higher level of controls than just compliance.

MORE: Understanding the Full Cost of a Data Breach | The 7 Categories of of Cybersecurity Solutions Firms Need | Future Firm Growth Requires a Mindshift | Donny Shimamoto Explains How ‘Agile’ Applies to CPA Firms | AI, OCR, NLP & CPAs: Oh My!   |  Accounting Nerds, Unlock Your Super Powers  | Early Adopters Gain an Edge in Audit | Dustin Wheeler: For Serious CAS Success, Hire Tech Teams | CSR for CPAs: The Missing Ingredient | Donny Shimamoto Explains How ‘Agile’ Applies to CPA Firms |  Staff Retention for Remote Workers | Why the Future is in Risk Advisory |  Ready for Non-CPA “CPA” Firms?
GoProCPA.com Exclusively for PRO Members. Log in here or upgrade to PRO today.

Be sure to consult with both your cybersecurity advisor and legal counsel to determine which controls you may still want to implement even if you qualify for some of the exemptions. Many controls, like the ones identified in the FTC exception, do not cost much to implement and can demonstrate that you still fulfilled your professional obligation to protect clients’ data—reducing your litigation risk.

Your responsibilities and obligations as a tax practitioner can be overwhelming because of all the complexities and jargon, as well as the risks and technologies in the cybersecurity space. However, hopefully these guidelines will help you feel a little more comfortable discussing cybersecurity with your IT service provider or cybersecurity advisor.

Ensure that you understand your cybersecurity risk posture and that you’ve met the compliance requirements. You can do this by following this action plan:

  1. Determine if you have an IT security policy
    • If you have a policy, check whether it addresses both the IRS and FTC requirements
    • If you don’t have a policy, obtain a template and personalize it for your firm.
      • If you’re an AICPA Tax section member, the AICPA provides a free Gramm-Leach-Bliley Act Information Security Plan.
      • The Center for Accounting Transformation also has a low-cost plan template available for purchase that is mapped to the cybersecurity solutions described in the previous section. Learn more about this template here: https://link.improvetheworld.net/CyberForTaxPlanTemplate.
  1. Conduct or update your cybersecurity risk assessment
  1. Determine your compliance gap
    • Once you have an understanding of your policy and technical controls, determine if you meet the minimum requirements described by the IRS and FTC. Identify areas where you may need to implement additional policies, procedures, or solutions to become compliant.
  1. Determine your risk tolerance gap.
    • Keep in mind that the IRS and FTC requirements are minimum requirements. You may want to be more proactive to prevent a malware attack and the potential disruption that it would cause. Work with your cybersecurity advisory to identify areas where a more proactive approach may be cost-effective.
  1. Implement/change solutions.
    • Implement new solutions or change/upgrade solution configurations to fill the gaps that you’ve identified above.
  1. Monitor solution effectiveness.
    • Just as keeping vigilance when you’re in a physically unsafe part of town is an ongoing activity, cybersecurity vigilance isn’t a one-time activity. You (or someone you trust) must monitor notifications and respond appropriately when needed.

The above should be done at least annually, with the exception of monitoring solution effectiveness, which is done on an on-going basis. The first time you go through this process can be a bit of a bear and it may require some upfront investment, but maintaining your policy, undergoing risk assessment, and fixing gaps are usually much easier and less costly in subsequent years.

Just as you can’t do anything to help clients minimize tax liabilities if they don’t proactively let you know before they enter into transactions, you should be proactive in managing your cybersecurity risks before an incident occurs. This minimizes the disruption that it can cause to your practice and can enable you to sleep better at night knowing that your clients’ PII and your firm’s operations are protected.

 

Leave a Reply