Tax season doesn’t care if your server is ready. It arrives on schedule, and your technology either holds up or it doesn’t. The firms that cruise through busy season without IT disasters are the ones that prepared in October, not the ones scrambling in February.
Here are 10 things every CPA firm should do before January to make sure technology helps instead of hurts during the busiest months of the year.
1. Test Your Backups. Actually Test Them.
Don’t just check that a backup ran. Restore a file. Restore a folder. If you can’t pull up last Tuesday’s data in under an hour, your backup isn’t a backup. It’s a hope. We test restores quarterly for our clients so there are no surprises when it matters. Learn about our backup and disaster recovery services.
2. Verify MFA Is On Everything
Microsoft 365, your tax software portal, client document portals, remote access tools. If any system that touches client data doesn’t require a second factor, fix it now. MFA is required under both the FTC Safeguards Rule and IRS Publication 4557. It’s also the single best defense against the “hacked email” scenario we see every tax season.
3. Run All Pending Updates
Windows updates, tax software patches, firmware updates on your firewall and switches. Do them now while you have downtime. During busy season, nobody wants to reboot. Get current now so you’re not running known-vulnerable software when attackers ramp up their tax-season phishing campaigns.
4. Check Your Server Health
How old is your server? When was the last time someone checked the hard drives, RAM usage, and event logs? A server that’s been running fine for three years can fail without warning. A 15-minute health check now can prevent a catastrophic failure on April 10th.
5. Review Who Has Access to What
Did someone leave the firm last year? Are their accounts disabled? Is the seasonal preparer from last year still in your systems? Review Active Directory, your tax software user list, and your client portal access. Remove anyone who shouldn’t be there. The FTC Safeguards Rule requires access controls, and this is the time to clean them up.
6. Test Your Internet Failover
What happens if your internet goes down on April 14th? Do you have a backup connection? A mobile hotspot? Our Virtual Technician keeps monitoring and basic operations running even during internet outages, but your team needs a plan for staying productive if the main connection drops.
7. Schedule Security Awareness Training
October or November is the perfect time. Your team is between busy periods and can actually pay attention. Focus on tax-season-specific threats: fake IRS emails, spoofed e-file rejection notices, W-2 phishing scams targeting payroll staff. One click on a bad link during busy season can expose every client’s SSN in your system.
8. Update Your WISP
When was the last time you reviewed your Written Information Security Plan? If you changed tax software, added staff, started using a new portal, or moved to remote work, your WISP should reflect that. PTIN renewal season is coming and the IRS expects your security plan to be current.
9. Confirm Your Incident Response Plan
If you get breached on March 15th, who do you call? Does everyone on your team know what to do? Review the plan, make sure phone numbers are current, and confirm your IT provider’s emergency response process. Having a plan you’ve never reviewed is the same as not having one.
10. Schedule a Pre-Season IT Review
Sit down with your IT provider (or call us) and walk through your environment before the rush starts. A one-hour review in November costs nothing compared to a server failure during filing season.
The Bottom Line
Every item on this list is easier, cheaper, and less stressful to do now than during tax season. The firms that invest a day of preparation in Q4 save themselves weeks of headaches in Q1.
Asteroid IT works with CPA firms across the Phoenix metro to get systems ready before busy season. If you’re not sure where your firm stands, let’s have a conversation.
Call 480-937-7021 or visit asteroidit.com/contact-us.