Donny Shimamoto, Author at CPA Trendlines

Understanding the Full Cost of a Data Breach

Indirect costs often have a much greater impact—especially for smaller firms.

By Donny Shimamoto
Cybersecurity for Accountants

Generally, when there is unauthorized access to Personally Identifiable Information (PII), a data breach is considered to have happened. Originally PII was only defined as:

MORE: How Hacker-Proof Is Your Firm? | Unleashing the Power of Technology: Transforming Accountants into Trusted Advisors | Future Firm Growth Requires a Mindshift | AI, OCR, NLP & CPAs: Oh My! | Accounting Nerds, Unlock Your Super Powers | Early Adopters Gain an Edge in Audit | Dustin Wheeler: For Serious CAS Success, Hire Tech Teams | CSR for CPAs: The Missing Ingredient | Donny Shimamoto Explains How ‘Agile’ Applies to CPA Firms | Staff Retention for Remote Workers | Why the Future is in Risk Advisory | Ready for Non-CPA “CPA” Firms?
Exclusively for PRO Members. Log in here or upgrade to PRO today.

A first name or initial and last name, along with:
- Social Security Number (SSN)
- Driver’s license number
- Credit or debit card number
- Financial account number with access code (e.g., a bank account number and pin)
Personal Health Information (also known as PHI)

However, due to the increasing sensitivity of the public to privacy concerns and resulting legislative actions, the following is also often considered to be part of PII: [i]

ADVISORY & CONSULTING

Adrian Hong: Necessity Can Make You an Expert

Innovation Insights: Trial by fire may not be fun, but it can make you a pro.

Subscribe to CPA Trendlines podcasts anywhere: Apple, Google, Spotify, iHeart, Deezer, Amazon Music and Audible, Player FM, Audacy, Gaana (India), and Boomplay (Africa).

Innovation Insights
With Donny Shimamoto
Center for Accounting Transformation

Adrian Hong’s journey into the realm of environmental, social, and governmental (ESG) reporting has been nothing short of inspiring. As the founder of Hong Consulting, LLC, his dedication to assisting companies with ESG reporting stems from a rich tapestry of experiences, all pointing to one common thread – the desire to help.

MORE: Blake Oliver: Why Tax Work Yearns To Be Free |Private Equity Explodes in U.K. | Brannon Poe: The Status Quo Must Go | Accounting Nerds, Unlock Your Super Powers | Private Equity vs. the CPA Firm Partnership The FinTech Flood: Accounting Will Never Be the Same | Think Small to Think Big with Matt Wilkinson | Your Sales Tax Headaches Are Only Just Beginning | When Financial Statements Go Extinct with Corey Schmidt | Can Geraldine Carter Save Accountants from Themselves? | Re-Inventing Accounting with Tyler Anderson | Turning Client Service into New Revenue

SEE ALSO: Deloitte Develops Audit Technology for Smaller Firms

Exclusively for PRO Members. Log in here or upgrade to PRO today.

After building a formidable reputation in auditing within public accounting and lending his skills to the Financial Accounting Standards Board for refining external taxonomy, life had other plans. Hong returned to his roots in Hawaii to steer the helm of his family’s venture, Island Plastic Bags.

PRO Member Exclusive

IRS and FTC Cybersecurity Expectations of Tax Practitioners

Your tools for a cybersecurity compliance check-up.

By Donny Shimamoto
Cybersecurity for Accountants

In August 2019, the IRS published its list of “Security Six” steps to protect taxpayer information.[i] These described the six “basic protections” that it expects tax prepares to utilize.

MORE: How Hacker-Proof Is Your Firm? | Unleashing the Power of Technology: Transforming Accountants into Trusted Advisors | Future Firm Growth Requires a Mindshift | AI, OCR, NLP & CPAs: Oh My! | Accounting Nerds, Unlock Your Super Powers | Early Adopters Gain an Edge in Audit | Dustin Wheeler: For Serious CAS Success, Hire Tech Teams | CSR for CPAs: The Missing Ingredient | Donny Shimamoto Explains How ‘Agile’ Applies to CPA Firms | Staff Retention for Remote Workers | Why the Future is in Risk Advisory | Ready for Non-CPA “CPA” Firms?
Exclusively for PRO Members. Log in here or upgrade to PRO today.

These include:

CHECKLIST

Cybersecurity Exemptions for Orgs with Less than 5,000 Clients

You may be off the hook, but not out of the woods.

By Donny Shimamoto

Management consulting company AON described an exemption for some of the FTC requirements for firms that handle the personal identifiable information (PII) of less than 5,000 consumers.[i]

The Safeguards Rule provides an exception from certain requirements if the covered financial institution maintains customer information concerning fewer than 5,000 consumers. A consumer is defined in Section 314.2(b)(1) of the Safeguards Rule as “an individual who obtains or has obtained a financial product or service from the financial institution that is used primarily for personal, family, or household purposes, or that individual’s legal representative.”

MORE: How Hacker-Proof Is Your Firm? | Unleashing the Power of Technology: Transforming Accountants into Trusted Advisors | Future Firm Growth Requires a Mindshift | AI, OCR, NLP & CPAs: Oh My! | Accounting Nerds, Unlock Your Super Powers | Early Adopters Gain an Edge in Audit | Dustin Wheeler: For Serious CAS Success, Hire Tech Teams | CSR for CPAs: The Missing Ingredient | Donny Shimamoto Explains How ‘Agile’ Applies to CPA Firms | Staff Retention for Remote Workers | Why the Future is in Risk Advisory | Ready for Non-CPA “CPA” Firms?
Exclusively for PRO Members. Log in here or upgrade to PRO today.

Essentially if you handle less than 5,000 social security numbers, then it would appear that you can take advantage of this exemption. AON went on to report that if you fall under this exemption, then you do not need to address the following requirements:

CLIENT ACCOUNTING SERVICES

Safe Harbor Compliance Reduces Risk of Fines and Penalties

Protect your clients–and your firm–by being proactive.

By Donny Shimamoto, CPA, CITP, CGMA

In the last few years, we’re starting to see state legislatures and attorney generals recognizing that tax practitioners are trying to protect their clients. They are formalizing this recognition with changes to regulations or laws to include “safe harbor” provisions that limit or eliminate the fines and penalties for tax practitioners who take proactive action to manage their cybersecurity risks.

MORE: How Hacker-Proof Is Your Firm? | Unleashing the Power of Technology: Transforming Accountants into Trusted Advisors | Future Firm Growth Requires a Mindshift | AI, OCR, NLP & CPAs: Oh My! | Accounting Nerds, Unlock Your Super Powers | Early Adopters Gain an Edge in Audit | Dustin Wheeler: For Serious CAS Success, Hire Tech Teams | CSR for CPAs: The Missing Ingredient | Donny Shimamoto Explains How ‘Agile’ Applies to CPA Firms | Staff Retention for Remote Workers | Why the Future is in Risk Advisory | Ready for Non-CPA “CPA” Firms?
Exclusively for PRO Members. Log in here or upgrade to PRO today.

As of December 2022, the following states have some type of safe harbor provision in place:

Connecticut[i]
Ohio[ii]
Utah[iii]

In contrast, states like California and Colorado are taking the opposite approach and penalizing organizations that have data breaches.[iv]

Donny Shimamoto

MORE AT STORE.CPATRENDLINES.COM

Donny C. Shimamoto, CPA.CITP, CGMA, is the founder and managing director of IntrapriseTechKnowlogies LLC, a specialized CPA firm dedicated to helping small businesses and middle market organizations leverage strategic technologies, proactively manage their business and technical risks, and enable balanced organizational growth and development. Donny also works with larger organizations as a trusted business advisor, facilitating organizational strategic planning and execution, IT governance and planning, enterprise architecture, information architecture and assurance, business process improvement, and business intelligence initiatives.

Click here for more by Donny Shimamoto

As the founder of The Center for Accounting Transformation, Shimamoto is leading a movement to change the world for the better by empowering and equipping accountants with the leading-edge tools and techniques.

Donny was the first Certified Information Technology Professional (CPA.CITP) in the State of Hawaii and is one of only four in the state. The CITP credential is a specialty designation of the American Institute of Certified Public Accountants (AICPA), that identifies Certified Public Accountants (CPAs) with the unique ability to bridge between business and technology; meeting the strict requirements for a CPA license as well as additional training and experience in technology strategic planning, IT architecture, business process enablement, system development and acquisition, IT audit and control, and IT governance.

The immediate past chairman of the AICPA’s IMTA Executive Committee, Donny has been both influential and critical in several AICPA initiatives including the development of an IT Competency Model for CPAs, and redesign of the CITP Credential. Donny previously co-chaired the AICPA’s Business Intelligence Working Group, researching and creating practice aids in the area of Evidence-based Management, Application & Data Integration, and Information Assurance. Donny has also been involved in the authoring of guidance published by the AICPA on IT Considerations for Risk-Based Auditing and Enterprise Business Intelligence. As a subject matter expert, Donny is often an invited speaker at national and international webinars and a familiar key-note speaker at national-level conferences.

Donny obtained invaluable knowledge and exposure to a wide range of industries and sectors (retail, hospitality, state government, defense, and higher education) while earning his CPA license as a member of PricewaterhouseCoopers LLP's Business Assurance Services, Operational & Systems Risk Management Services, and Management Consulting Services lines of business. With ITK he has expanded his industry expertise to include not-for-profit (social services, foundations, and membership organizations), professional services, small businesses, technology, and mobile professionals.

Here’s what you’re looking for: Donny Shimamoto

Subscribe to CPA Trendlines podcasts anywhere: Apple, Google, Spotify, iHeart, Deezer, Amazon Music and Audible, Player FM, Audacy, Gaana (India), and Boomplay (Africa).