Map the way client information moves
Identify where staff receive, process, store and share client information: email, portals, Microsoft 365, accounting applications, local files and outside providers. Include remote staff and seasonal workers. A review of office computers alone can miss important parts of the workflow.
For each location, record the business owner, access method and provider responsible for support. Keep this inventory internal and avoid placing client records into public checklists or AI tools.
Review access before the next busy period
Check who can access client workspaces, who holds administrator privileges and how MFA is enforced. Ask how temporary staff receive access, how permissions are reviewed and what happens when an engagement or employment ends.
Review external sharing and email processes with the people who use them. A secure portal is less useful if staff routinely work around it. Test the approved workflow and make clear how staff verify unusual requests involving sensitive information or payment changes.
Reference: CISA: require multifactor authentication
Connect written plans with operational evidence
The IRS states that tax professionals must maintain a written information security plan and provides a template to help smaller practices get started. Whether particular rules apply to your organization and how to satisfy them should be reviewed with appropriate advisers. A generic document alone does not demonstrate that controls are operating.
Ask your IT team to show how the plan connects to account management, device protection, backup tests, incident contacts and staff responsibilities. Record gaps and assign owners. ProviScore can help organize technology findings and priorities; it does not provide a compliance rating or replace a formal determination.
Reference: IRS guidance on written security plans · IRS WISP template
Plan for the disruption you cannot afford
Choose a few realistic scenarios: an unavailable workstation, compromised email account, lost file set or an outage affecting a critical application. Decide who staff call, what information they need and which recovery steps are authorized.
Schedule configuration reviews and recovery exercises around operational demands. Record emergency escalation arrangements separately from ordinary support hours. Your MSP agreement should explain covered systems, response arrangements, provider responsibilities and separately scoped work.
Use MSP support and ProviScore together
Provicore brings responsive IT support, email and Microsoft 365 administration, licensing management, endpoint and network support, cybersecurity, and backup and recovery planning into a coordinated relationship. Services and availability are defined in the agreement.
ProviScore adds a business-specific review of overall IT posture so firm leaders can understand reported strengths, evidence gaps and priority improvements. Start with our free self-check, then discuss which systems and requirements a formal assessment should cover.