Make client data security part of daily delivery
A practical starting checklist for access, recovery, and vendor ownership.
Libro Lantern editorial · Research checked October 15, 2026
Know what you hold and who can reach it
Inventory systems containing client information. Use named accounts, multifactor authentication, least privilege, and prompt offboarding. Assign an owner for every app and connection. Check that exports and backups can actually be recovered.
Put the plan in writing
For tax practices, review the IRS’s Written Information Security Plan resources with your qualified adviser and adapt them to your actual systems. A checklist on a website is not a completed security program or a finding that your firm meets its obligations.
Source: IRS Publication 5708: Creating a Written Information Security PlanRehearse one bad day
Walk through a compromised mailbox or lost laptop. Who contains it, who contacts providers, who preserves evidence, and who determines notification obligations? Keep incident contacts available outside the affected system. Review vendor permissions and training after the exercise.
Sources & further reading
IRS Publication 5708: Creating a Written Information Security Plan
Sources inform the editorial discussion. Libro Lantern’s checklists and pilot plans are our synthesis, not endorsements or prescribed industry standards.
Turn the idea into a plan.
Discuss your firm’s next move with Libro Lantern.