An 8-person CPA firm in Ocala received notice of an upcoming IRS compliance review and reached out to their attorney for guidance on technology requirements. The attorney referred them to Simply IT after learning the firm had no formal information security program.

The firm's managing partner had assumed the FTC Safeguards Rule applied only to large financial institutions — a common misconception among small accounting practices. In reality any business that handles client financial information is required to maintain a written information security plan and implement specific technical safeguards.

The firm had 28 days until the IRS review. They had no written security plan, no MFA on any systems, and several staff members who had left the firm still had active email accounts.

Simply IT treated the engagement as an urgent compliance remediation project. The first week focused on deactivating former employee accounts, enabling MFA across all current staff, and inventorying all systems containing client financial data.

In parallel Simply IT drafted the firm's Written Information Security Plan (WISP) — the core document required by the FTC Safeguards Rule — tailored to the firm's specific technology environment. Technical safeguards were implemented systematically — endpoint security, email security, encrypted cloud backup, and network security assessment.

Microsoft 365 was configured with conditional access policies, audit logging, and data loss prevention policies. Simply IT prepared the complete compliance documentation package — the WISP, security risk assessment, vendor management documentation, and employee training records.

The firm achieved FTC Safeguards Rule compliance within 30 days — completing the IRS review with no technology compliance findings. The managing partner described the engagement as transformative — not just for compliance but for the confidence that client financial data was genuinely protected.

The firm's cyber liability insurance carrier subsequently reduced their premium after reviewing the implemented security controls. Simply IT continues to provide managed IT, security monitoring, and annual WISP updates for the firm.