Managed IT for Financial Services

The IRS requires tax preparers to maintain a Written Information Security Plan (WISP) under the FTC Safeguards Rule — this isn't optional guidance, it's an active requirement. Depending on how you're licensed, your state CPA board, FINRA (for broker-dealers), or the SEC and state securities regulators (for registered investment advisers) layer on additional requirements. Regardless of which applies to you, the baseline is the same: MFA everywhere, encrypted storage and communications, access controls, a documented incident response plan, and annual staff training — and that's exactly where I start, then I adjust for whatever your specific license adds on top.

A client portal — either built into your practice management software or a properly configured SharePoint setup inside Microsoft 365 with access logging — is the right approach. It avoids unencrypted email attachments sitting in an inbox indefinitely, where a tax return or brokerage statement can sit forwarded and forgotten for years, and it gives you an audit trail of exactly what was shared and when, which matters if a client or regulator ever asks. I set this up once and train your staff to default to it instead of falling back to email out of habit during a busy season.

Isolate the device immediately — disconnect it from Wi-Fi or unplug it — change the passwords on any accounts that were open in that session, and call your IT provider right away. Speed is everything here: the exposure grows every minute the account sits compromised, and business email compromise attacks targeting finance staff often move fast, sometimes attempting a fraudulent wire request the same day. Firms with an incident response plan written down before it happens act in minutes; firms without one spend the first hour just figuring out who's in charge of the decision.

Yes. I help financial firms build the documentation regulators actually look for — security policies, risk assessments, access control records, incident response plans, and training logs — organized so you can hand it over during an exam or a client request instead of assembling it under deadline pressure from scattered emails and half-remembered decisions.

You work directly with me — the person who actually understands your compliance obligations, not a rotating technician starting from zero every visit. I've spent over 40 years in IT, running Ask Erik Computer Services since 2006 and serving Lane County firms since bringing the business to Eugene in 2017. I'm a Microsoft Partner, AI-certified, and a BNI Hall of Fame member here in Eugene. I document every security control and access change — the kind of record that matters when a regulator or a client asks what you have in place. I explain things in plain English, return calls, and plan ahead instead of reacting to fires. When something breaks, I tell you why and what we're changing, not just that it's "resolved."