Email security checklist for CPA and accounting firms

A CPA firm's inbox may contain client bank details, payroll files, tax documents, and payment instructions. A compromised mailbox can expose the firm and affected clients to fraud or data loss.

Accounting and tax firms should determine their current FTC, IRS, state, contractual, and professional obligations from the governing sources and qualified counsel. InboxGuards reports are not a compliance determination or security audit.

Use the provider and license controls available to your firm, and assign an owner for each item:

• ■Enable and enforce multi-factor authentication for supported accounts, including administrators, using controls appropriate to the provider and license.
• ■Turn off legacy authentication protocols (IMAP/POP basic auth) that bypass MFA.
• ■Review who has admin rights and remove access that is no longer authorized or required.
• ■Check every mailbox for external forwarding rules right now. If you find one nobody remembers creating, treat it as an active incident.
• ■Define a process to review supported audit records for sign-ins, forwarding changes, inbox rules, and permission changes, whether manually or with authorized automation.
• ■Write down your incident response steps: who resets passwords, who notifies affected clients, who calls your insurer. One page is enough.
• ■Verify any client request to change bank or payment details by phone, using a number you already have — never the one in the email.
• ■Confirm your cyber insurance covers business email compromise, and keep monitoring evidence ready for the renewal questionnaire.

Monitoring is an ongoing process. InboxGuards connects read-only with customer-admin authorization and checks supported Microsoft 365 or Google Workspace audit records at roughly 5-minute intervals for configured account-takeover indicators, subject to provider and API limits.

Alerts are timestamped and stored with remediation tracking, and you can download activity reports and a monitoring certificate from the dashboard — useful as supporting documentation for your WISP, your insurer, and client due-diligence questionnaires alike (each of those parties decides what meets their own requirements). For a 10-person firm, it's $480 a year — or $400 billed annually (2 months free).

Clients who approve payments from email should use independent payment-verification procedures and evaluate whether authorized monitoring fits their own risks. InboxGuards does not guarantee early warning or protect a professional relationship; it provides alerts and records for configured supported events.