Identity, devices and departures: putting a tax firm's security in writing and in practice

What a tax practice holds

A tax practice holds the most sensitive thing a client owns after their health record: their finances, their identity numbers, their payroll. This firm had built a loyal bilingual client base in South Florida and a team to match. Its technology had grown the way it does in a busy practice: a website, a Microsoft tenant, Google Drive, a password shared here and there, laptops bought as people joined, and an IT relationship that answered the phone but didn't own the picture.

The three questions nobody could answer in a day

Nobody could say, in a day, which devices held client data, which accounts were still active for people who had left, or which security settings were actually applied rather than intended. For a business that files other people's returns, that isn't an IT gap. It's the gap an insurer, a regulator, or an attacker asks about first.

The brief was not “sell us security”

The firm's question was not “sell us security”. It was: what do we actually have, what should be true, and how do we prove it?

The inventory everyone skips

We began with an inventory: every user, every device, every application that touches client data, and the two office locations and their networks, drawn as diagrams the people running the firm can read. The inventory is the deliverable most clients skip and the one everything else depends on.

Then we decided what should be true, and wrote it down as policies that apply themselves. Devices would join a single identity and a management platform, so a policy is something the laptop enforces, not something a memo requests.

• One identity per person across Microsoft 365, with licences assigned by role and multi-factor authentication where client records move.
• A catalogue of twenty device policies across security, user experience, network and updates, of which seven were selected.
• Arrivals and departures as one procedure: create or block the identity, assign or wipe the device, remove access to shared drives and chat, keep the account for retention before deletion.

The seven policies were tested on a virtual machine, piloted on a small group and then applied to the whole fleet. Each one is documented with its purpose and configuration.

Endpoint protection and mail signatures moved to central management, so the everyday tools stop being the weakest link.

The website work that had started the relationship years earlier continued alongside, in the same staging-and-production discipline: content in two languages published without anyone touching the live server by hand.

The firm can now produce, on request, what it couldn't before: the list of devices and who holds them, the accounts and their status, the policies in force and the evidence that they are applied. A departure follows one procedure instead of a hunt through five tools.

The next change follows the same path: test, pilot, roll out. The remaining thirteen policies in the catalogue are decisions the firm can make with the trade-offs in front of it, not defaults we imposed.

This is the pattern our professional-services pages describe: an environment the firm can account for, item by item. The firm didn't buy a product to get there. It bought a picture of its own environment and a way of keeping it true.