Your Tax Software Vendor Will Not Grant Access Until Your Firm Proves Endpoint Protection
It comes up during the move to hosted software, or at renewal. The vendor’s onboarding checklist asks your tax practice or CPA firm to confirm that every computer connecting to their platform runs endpoint protection, and to show it — a screenshot of the console, an export of the device list, a letter from your IT provider.
It is not a regulator asking. It is a vendor deciding whether your firm’s machines are safe to let onto its platform, because a compromised computer at your firm is a way into the vendor’s system and every other firm on it. That makes it a business problem before it is a compliance problem, and it has a date attached: the day you were supposed to be working in the new system.
Why the vendor is asking
Hosted tax and accounting platforms hold return information for every firm that uses them. The vendor’s own obligations, insurers and auditors ask what it did to check the firms it lets in. A firm whose computers are unprotected is a risk the vendor carries on behalf of all of its customers, so it asks in writing before granting access.
Two things follow from that.
The request is a contract condition, not a rule. The vendor can set whatever bar it likes, and it can decline to provision your firm if the bar is not met.
And “we have antivirus” is not an answer to it. The vendor is asking whether protection is deployed on every machine that will touch its platform, whether it is current, and whether someone would know if it stopped working. The form asks for evidence, not a product name.
What the vendor is really asking for
Strip away the checklist wording and the questions come down to a few.
Every machine, not most of them. The laptop the partner takes home. The workstation in the back office that nobody logs into except during the season. The temporary staffer’s computer. Endpoint protection that covers the machines someone remembered is not what the vendor is asking about.
Something that would notice. Modern endpoint protection reports to a console and raises an alert when it sees something. The vendor is asking whether anyone at your firm, or working for it, would see that alert.
Something that stays on. Protection a user can switch off, or that expired with a subscription nobody renewed, does not count on the day it matters.
Evidence. A console view showing every device and its status, dated. The vendor is asking for documentation, not intentions.
The duties sitting behind the request
The vendor’s checklist is not a standard the vendor invented. It is a subset of what already reaches a Texas tax practice or CPA firm.
Federal. A tax preparer is a financial institution under the Gramm-Leach-Bliley Act, and the FTC Safeguards Rule requires a written information security plan describing the firm’s program to protect customer information. IRS Publication 4557 restates the elements the Rule requires: a qualified individual responsible for the program; a risk assessment; a safeguards program that is regularly monitored and tested; multi-factor authentication for anyone accessing customer information, using at least two factors; service providers selected for their safeguards, contractually bound to maintain them, and overseen; security awareness training with regular refreshers; and a program that is evaluated and adjusted as the firm changes. Endpoint protection is part of the safeguards program; the monitoring and testing is what the vendor’s “would you notice” question is really about.
Separately, Internal Revenue Code §7216 governs the disclosure and use of tax return information, and the regulations under it reach auxiliary service providers, including software developers. Your hosted software vendor sits inside that structure. Where, for a given arrangement, is a question for your counsel.
For a CPA firm, the Texas State Board of Public Accountancy’s rules apply as well. Under §501.75, a licensee may not voluntarily disclose confidential client information to a third party without the client’s written permission, and the rule expressly reaches contractors and subcontractors inside or outside the United States. Whether a hosted software vendor is such a third party for a given engagement is a question for your counsel. Under §501.77, the conduct of a non-CPA owner or employee in the business of a licensed firm is the firm’s conduct — so the unprotected machine in the back office is the firm’s exposure, not the staffer’s.
Texas. SB 2610 offers a Texas firm a safe harbor from certain damages after a breach, but only for a firm that has implemented and documented a written cybersecurity program aligned to a named framework. The control standard Briggs builds to under that safe harbor covers endpoint protection as a matter of course; a firm that has done the SB 2610 work has already answered the vendor’s question.
Texas breach notification law reaches any person who conducts business in Texas and owns or licenses computerized data containing sensitive personal information. There is no registration test and no size test in that statute.
One thing we do not do. We do not tell you whether a given vendor arrangement satisfies §7216 or the Board’s rules. That judgment belongs to your own counsel. What we can do is establish what your firm actually has on every machine, and produce the evidence the vendor is asking for.
Answering it when the go-live will not wait
The date is fixed, and the firm has to sign the vendor’s form.
Count the machines first. Every computer that will connect to the platform, including the ones that only come out during the season. The vendor’s question cannot be answered for a fleet nobody has listed.
Answer what is true. A no that is accurate is workable, and it comes with a date for closing it. A yes the console does not support is a representation to a vendor who is about to give your firm access on the strength of it.
Get the evidence from the console, not from memory. A dated export of every device and its status is what the vendor wants, and it is also what your own written plan expects you to be able to produce.
Close the machines that are missing, in the same pass. Endpoint protection is a deployment, not a project. The hard part is knowing which machines need it, and you have just done that.
Then close the rest of the program properly, so the next vendor’s checklist is a retrieval exercise — and so the written plan you attest to at PTIN renewal describes what is actually running.
See the eleven obligations that reach Texas legal and financial firms →
How Briggs IT Services helps
We start with a Compliance Readiness Review. We gather what your firm actually has — every machine, what protects it, who would see an alert — then review it against what the vendor asks for and what federal and Texas law state as duties for your firm.
You get a written report: what you can show the vendor truthfully today, where the gaps are, and what closing each one takes.
From there we create the plan. If you have IT, internal or outside, we guide them through the changes and they do the hands-on work. Your IT keeps doing their job. If you have no IT, we do the hands-on work ourselves, inside a scoped remediation phase with a defined end.
Then we build the documentation — the device inventory, the endpoint standard, the written plan — and keep it current, so the next checklist is answered from a file rather than from memory.
Common questions
Do we have to prove endpoint protection to a software vendor?
Not as a matter of law. It is a contract condition. The vendor is deciding whether to let your firm’s machines onto its platform, and it can set its own bar. Declining is usually the same as declining the software.
Is the antivirus that came with Windows enough?
That is the vendor’s call, and it will say so on its checklist. The questions worth answering regardless of product are whether it is on every machine, whether it is current, and whether anyone would see an alert.
Our IT company says everything is covered.
Then the evidence exists and they can produce it: a dated console view of every device and its status. Ask for that rather than for the assurance. The vendor will ask for the same thing, and so does your own written information security plan.
Does this change what we attest to at PTIN renewal?
The written information security plan you attest to should describe what your firm actually runs. If the vendor’s checklist shows a gap between the plan and the machines, close the gap before the next renewal, in whichever direction is true.
Does Texas breach notification law apply to a small firm?
The statute reaches any person who conducts business in Texas and owns or licenses computerized data containing sensitive personal information. It contains no size test. Whether a particular incident triggers notice is a question for your counsel.