The CPA Firm’s 90-Day Technology and Cybersecurity Checklist Before Tax Season

Tax season has a habit of exposing every weakness in a CPA firm’s technology—usually at 4:57 p.m., while someone is trying to finish an urgent return.

The good news is that most busy-season technology problems provide warning signs long before deadlines begin piling up. A structured 90-day review gives your firm time to address slow applications, unreliable backups, security gaps, and aging equipment before everyone becomes too busy to deal with them.

Here is a practical technology and cybersecurity checklist for CPAs and accountants that your firm can begin using now.

90 Days Before Tax Season: Assess the Environment

Three months before busy season is the right time to evaluate the overall health of your technology—not merely confirm that everyone’s computer turns on.

Review Your Servers and Cloud Environment

Evaluate the systems supporting your tax, accounting, document-management, and workflow applications.

Ask:

• Are servers operating within comfortable processor, memory, and storage limits?
• Is sufficient capacity available for busy-season workloads?
• Are any applications noticeably slower than last year?
• Are employees experiencing frequent freezes, disconnects, or login delays?
• Can your internet connection support the entire firm during peak periods?
• Does your cloud environment scale as demand increases?

A system that is “mostly fine” today may become considerably less fine when every employee signs into Lacerte, CCH, Drake, UltraTax, QuickBooks, and Microsoft 365 at the same time.

Technology also has an unusual ability to sense deadlines. It waits patiently all year and then becomes deeply interested in personal growth on April 14.

Review Every Critical CPA Application

Create a complete inventory of the applications your firm depends on, including:

• CCH ProSystem fx and CCH Axcess
• CCH Engagement, Document, and Scan
• Lacerte and ProSeries
• Drake Tax and UltraTax
• QuickBooks Desktop
• 1099 preparation and filing applications
• Payroll and document-management systems
• Client portals and electronic-signature platforms

Confirm that each application is supported, properly licensed, compatible with your operating environment, and included in your backup and recovery planning. This is also the time to identify applications requiring server upgrades, database maintenance, integration testing, or vendor assistance.

60 Days Before Tax Season: Strengthen Security and Reliability

With approximately two months remaining, shift your attention toward protecting the firm and eliminating avoidable points of failure.

Test Your Backups

Seeing a green checkmark next to the word “backup” is comforting. It is not the same as proving your data can actually be restored.

Your firm should verify:

• Servers and important workstations are being backed up
• Microsoft 365 email, OneDrive, and SharePoint data are protected
• Backups are encrypted
• Multiple recovery points are available
• A copy is protected from ransomware and unauthorized deletion
• Restoration procedures have been tested
• Someone receives and reviews alerts when a backup fails

A backup strategy should answer a simple question: If a server, employee account, or entire office becomes unavailable today, how quickly can the firm resume working?

If the answer begins with “We think…,” another test may be appropriate.

Review Multifactor Authentication and User Access

Multifactor authentication should be enabled for every employee, especially for Microsoft 365, remote access, cloud-hosted desktops, financial applications, administrative accounts, and password-management systems.

Review former employees, temporary staff, outside contractors, and accounts that have not been used recently. Remove access that is no longer required and confirm that administrative privileges are limited to the people who genuinely need them.

Attackers do not care whether an account belongs to the managing partner or the intern who worked at the firm two summers ago. An open door is an open door.

Evaluate Cybersecurity for CPAs and Accountants

CPA firms maintain highly sensitive financial, tax, identity, and banking information. Antivirus alone is no longer a complete cybersecurity strategy.

A modern security program should consider:

• Endpoint detection and response
• Security monitoring and identity-threat detection
• Email protection and DNS filtering
• Multifactor authentication and Conditional Access
• Password management
• Security-awareness training
• Vulnerability assessments
• Microsoft 365 monitoring
• Incident-response planning
• Backup and disaster recovery

Your safeguards should also support the firm’s responsibilities under the FTC Safeguards Rule and its Written Information Security Plan. Our guide to the FTC Safeguards Rule for CPA firms explains these responsibilities in more detail.

30 Days Before Tax Season: Test the Real Workflow

One month before the season begins, stop evaluating technology in theory and test how people actually work.

Conduct a Busy-Season Test Day

Ask employees to complete the same tasks they will perform during peak season:

• Sign into the hosted environment
• Open tax and accounting applications
• Access client files
• Scan and upload documents
• Print locally and remotely
• Create PDFs and send encrypted email
• Access shared folders
• Connect from home
• Use multiple applications simultaneously

This type of testing frequently uncovers printing problems, missing permissions, outdated shortcuts, unavailable scanners, licensing issues, and slow application performance.

Those problems are much easier to solve during a scheduled test than during a deadline-day conference call involving six employees and one printer that has apparently chosen early retirement.

Confirm the Support and Escalation Plan

Every employee should know how to contact IT support, what information to include when reporting a problem, how urgent issues are prioritized, who to contact if the normal process is unavailable, and how the firm will communicate during a larger outage.

Your IT provider should also understand which applications, employees, and workflows are most critical during busy season.

At InnerPC, our goal is to answer support requests within five minutes and resolve 80% of issues within 15 minutes. Fast support matters throughout the year, but during tax season it can directly affect deadlines, revenue, and client confidence.

One Week Before Tax Season: Freeze Unnecessary Changes

During the final week, avoid nonessential technology changes.

Unless a change addresses an urgent security or reliability issue, this is generally not the moment to replace a firewall, migrate every employee, experiment with an unfamiliar application, or let someone’s nephew “clean up the server.”

Instead:

• Complete essential application updates
• Confirm all employees can sign in
• Recheck backups and remote access
• Confirm printers and scanners
• Review storage capacity
• Verify support contacts
• Communicate the escalation process
• Document any postponed projects

Stability is the priority.

Your Firm Should Not Enter Tax Season Hoping for the Best

Busy-season technology readiness is not one software update or one successful backup. It is the combined result of reliable infrastructure, secure identities, protected data, tested applications, trained employees, and a responsive support team.

The earlier your firm begins preparing, the more time you have to resolve issues carefully instead of fixing them under deadline pressure.

InnerPC helps CPA firms prepare for busy season with Microsoft Azure cloud hosting for CPAs, cybersecurity, Microsoft 365, backup and disaster recovery, CPA application support, and fully managed IT services.

Because tax season is already stressful enough. Your technology does not need to submit an extension too.