Cybersecurity for bookkeepers
You hold the keys to your clients’ bank accounts, payroll and financial records. Your clients, and the regulators behind them, expect you to protect them. I set up the protection with you, write your security plan, train your staff, and serve as your Security Officer, so you can keep the books.
The rules you face
FTC Safeguards Rule: if you prepare tax returns or give financial advice, the rule applies to you directly. If your clients are CPAs, tax preparers or other financial businesses, the rule requires them to check that you protect their data.
HIPAA: if you keep books or do billing for medical or mental health practices, you’re a Business Associate. You need a signed BAA and HIPAA safeguards.
State breach laws: every state requires you to notify people when their personal information is exposed. Payroll data, with SSNs and bank details, is exactly what those laws cover.
Client contracts: more firms now ask their bookkeepers for proof of security before they sign or renew.
Learn more: FTC Safeguards Rule (GLBA) · HIPAA · Which rules apply to you?
What you get
A written security plan: built from your inventory, and ready to hand to a client or regulator who asks.
A named Security Officer: I take that role by contract, track what's due, and keep the paperwork current. You keep every decision.
Monitored protection: 24/7 protection on your devices and email, set up with you.
Staff training: everyone who touches client data completes it, with records kept.
An incident response plan: who to call, and how to notify clients and the state if something happens.
A yearly review: we update your plan, devices, vendors and access together.
Want to see the full process? See How It Works.
What clients say
-
“Todd Mitchell is the kind of cybersecurity expert you didn't know you needed, until you talk to him for five minutes and realize you absolutely do. What sets Todd apart isn't just his impressive background, it's how effortlessly he translates that expertise into language that makes sense for a solopreneur. He dives into the back end of your actual business, finds where the real vulnerabilities are, and builds something that fits how you work. He's also just genuinely easy to talk to. The kind of person who makes a networking call feel like a conversation with a trusted colleague. If you're not sure whether your cybersecurity is where it needs to be, Todd is your person. I wouldn't hesitate to refer him to anyone in my network.”
Mirit Volis, Numbers First Bookkeeping
-
“I was very impressed with Todd Mitchell from CyberSecurity4biz, LLC. He is incredibly knowledgeable about security and staying compliant with the constantly evolving web policies and laws. Todd explains complex topics in a way that’s easy to understand and makes you feel confident about protecting your business systems. He’s professional, approachable, and truly cares about helping clients stay safe. I highly recommend his services — call or message him today!”
Tammy Gulaskey, Gulaskey Bookkeeping Solutions LLC
Common questions
My clients are the ones regulated. Why do I need this?
Because they're required to check that you protect their data. A written plan and training records give them the proof.
I only use QuickBooks Online. Isn't Intuit handling security?
Intuit secures its servers. Your devices, passwords, email and the people who can log in are on you.
Do I need a BAA for medical clients?
Yes. If you handle their patient or billing data, you're a Business Associate, and the BAA plus HIPAA safeguards come with that.