Accounting firms compress a year of risk into a few months. From late January to April 15, every hour of downtime lands on a deadline, every inbox is full of attachments people must open, and the firm is holding exactly the data — SSNs, financials, bank details — that criminals most want. Firm IT isn’t complicated, but it has to be built around one organizing fact: busy season is coming, every year, on schedule.

The calendar is the architecture

Everything about firm IT should be planned backward from the season. Upgrades, migrations, and anything that could wobble happen May through November — a tax application update that misbehaves in December is an inconvenience; in March it’s a crisis. Capacity gets checked in the fall: workstations that felt fine in July under one monitor and light load reveal themselves in February. And support arrangements should acknowledge the season too — a firm working nights and weekends in March needs support commitments that don’t end at 5 p.m. It’s worth asking your provider directly how February differs from August in their coverage. (It’s a question we’re always glad to get, because the honest answer is a differentiator.)

Recovery targets follow the same logic: how much downtime can the firm absorb on April 12th? That number — not the one for a quiet June week — is the one your backup architecture has to satisfy, tested restores and an immutable copy included. Ransomware crews read calendars too; tax season is when firms are most targeted and most likely to pay.

You’re holding what attackers want most

A firm’s files are identity theft in ready-to-use form. That reality comes with obligations: the FTC Safeguards Rule requires tax preparers to maintain a written information security plan (WISP) — a named responsible person, a risk assessment, and the controls you actually run, on paper. The IRS asks about it on your PTIN renewal. If your firm doesn’t have one, that’s the first project, and most of its contents are things you should be doing anyway:

  • MFA on email, the tax software, remote access — everywhere, no exceptions for partners
  • Encryption on every laptop that leaves the office
  • Client document exchange through a proper portal, not email attachments — returns in plain email are the habit auditors and insurers now flag first
  • Access limited by role, and cut the day someone leaves — seasonal staff especially, since temporary hires with client-file access are a firm-specific exposure worth its own offboarding discipline

Email under busy-season conditions

Phishing defense is hardest exactly where firms live: a season of unfamiliar senders and expected attachments, staff too buried to scrutinize, and criminals who know it. The reliable patterns are new-client bait with malicious “documents,” fake IRS or software-vendor notices, and — costliest — redirect fraud: a “client” changing where their refund or payment should go, or a “partner” urgently approving a transfer. The defense stack: layered email filtering, short recurring training timed to ramp before the season, and the iron rule on money movement — banking-detail changes get verified by phone at a number already on file, no matter how busy the day. (Why these scams work so well.)

What good looks like

A firm running well on managed IT gets: change frozen when the calendar says so and capacity verified before January; a WISP that reflects reality; MFA and encryption everywhere client data lives; document exchange that keeps SSNs out of inboxes; email defenses tuned for seasonal pressure; and recovery measured against the worst possible day, not the average one. The goal is a busy season where the only stressful thing is the work itself — the technology should be the one thing in March that’s exactly as boring as it was in June.