Security-plan upkeep checklists and access reviews
From the firm's own written security plan, SI builds a calendar of recurring tasks and a log of what was done.
Admin and operations help for small CPA, tax and bookkeeping firms. SI chases, organizes and drafts; professionals review, sign and decide. No tax advice, no filings, and client data stays protected under your firm's security plan.
Worth knowing: Administrative support only: SI does not give tax or accounting advice, prepare or sign returns or reports, file anything, or calculate legal deadlines. A qualified professional reviews, signs and approves all work product and every date SI tracks. Client information is used only in tools the firm has vetted, under its written security plan and with any client consent or agreements the rules require. SI never describes the plan as meeting any rule, never approves a vendor or tool, and never certifies that the firm meets the FTC Safeguards Rule or any other requirement; it only helps the firm track its own tasks. Tax return information has special disclosure and use rules for preparers; check with your professional advisor before using any outside tool.
The problem
Firms write a security plan once and then rarely revisit it, and it is hard to show that training, access reviews and vendor checks actually happened.
What SI does
From the firm's own plan (for example one built from the IRS's Publication 5708 template), SI builds a calendar and checklist of recurring tasks (staff training, access and multi-factor authentication reviews, device inventory, vendor reviews, backups, data disposal), reminds the responsible person, and keeps a log of what was done and when.
Examples
The same job looks different in different businesses. These are illustrations, not client results.
- Two-partner accounting firm
Recurring tasks from the firm's own plan sit on a calendar. The security lead documents each review.
- Solo CPA
A log lists what was done and when. SI does not approve a vendor or tool as meeting any rule.
- Small tax-preparation office
Access and multi-factor authentication reviews are reminded. The firm owns the plan.
What it takes to set up
GemmiSI sets this up on your own equipment and accounts; your data stays with you. Before connecting anything that holds client information, the firm checks the tool against its written information security plan, confirms the agreements and any client consent required for tax return information, sets access controls and multi-factor authentication, and limits SI to the minimum necessary. Start with sample or made-up information. Use the firm's own written plan. SI tracks the firm's tasks; it does not describe the plan as meeting any rule. Setup is often a few days.
What a human still checks
- The CPA, EA or preparer reviews and approves before anything goes to a client, agency or third party.
- SI never sends, files, e-signs or posts on its own.
- Unusual items go to a "needs professional review" queue.
- The firm decides what client data SI may see, and testing starts with sample or made-up information.
- The firm's designated security lead owns the plan, performs and documents each review, and decides what the plan must contain.
- Counsel or a security professional advises where needed.
Try it yourself
Paste this into your SI tool of choice and swap the [bracketed] parts for your own details. It asks SI to stop and show you before it does anything.
From this firm's own written security plan [paste], build a calendar and checklist of recurring tasks (staff training, access and multi-factor authentication reviews, device inventory, vendor reviews, backups, data disposal). Remind the responsible person and keep a log of what was done and when. Do not describe the plan as meeting any rule, approve a vendor or tool, or certify that the firm meets the FTC Safeguards Rule or any other requirement. Track the firm's own tasks only. Tax return information has special disclosure and use rules for preparers; check with your professional advisor before using any outside tool. Pause and show me before sending, filing, posting or changing anything. Use only the sample or made-up information I provide; do not include real client names, SSNs, account numbers or tax details.
Next step
Want this built? Book a free 30-minute consult
Bring one real example, such as an export, an inbox, or a spreadsheet. We will map the steps and decide what SI drafts and what you approve.