By the DKBinnovative Crew | Reviewed by Peter Bertran, Chief Client Officer, DKBinnovative

Quick answer: Microsoft 365 Copilot respects your existing permissions: it can only use files, emails and chats a user already has access to. That makes it exactly as safe as your permissions are. At most professional firms, years of loose sharing mean Copilot can surface client files to people who should never see them. Fix permissions first, write a short AI policy, then pilot.

What Copilot can actually see

Copilot works across Outlook, Teams, Word, Excel and SharePoint. When a user asks it a question, it searches everything that user is allowed to open. It does not break permissions. It makes them visible.

That is the problem. A folder shared with “Everyone” in 2019 was hard to find before. With Copilot, a staff member can ask to see salary information or summarize a client estate file and get an answer if the permissions allow it.

Fix oversharing first

Before you buy a single license:

• Find “Everyone” and “anyone with the link” shares in SharePoint and OneDrive, and remove them from client folders.
• Lock down HR, partner and finance folders to the people who need them.
• Check Teams and old project sites that no one owns anymore.
• Apply sensitivity labels to client and confidential files where you can.

This cleanup is worth doing even if you never turn Copilot on. It closes the same gaps an attacker would use.

Client confidentiality and regulator expectations

Lawyers have a duty to protect client confidences and to understand the technology they use. The ABA and the State Bar of Texas have both issued guidance on generative AI that stresses confidentiality, supervision and verifying output. RIAs must protect client records under Regulation S-P, and CPA firms must safeguard taxpayer data under the FTC Safeguards Rule. None of these rules ban AI. All of them expect you to control who sees client information and to check the AI output. Our glossary covers ABA Formal Opinion 477R.

Write a one-page AI use policy

Keep it short enough that people read it:

1. Which AI tools are approved inside your tenant, and which are not — free public chatbots are never approved for client data.
2. What never goes into an unapproved tool: client names, SSNs, account numbers, privileged material.
3. A person reviews every AI draft before it goes to a client or a court.
4. Who to ask when unsure.

Pilot with five users

Pick a small group across roles: a partner, an associate or senior, and admin staff. Run the pilot for 30 days, collect the questions they ask, and watch for anything surfaced that should not be. Fix those permissions before rolling out wider.

Where a managed AI platform fits instead

Copilot is not the only way to give a firm useful AI, and for some practices it is not the best one. The question a managing partner is actually asking is narrower than “should we buy Copilot”: it is whether staff can use AI on client matters without creating a confidentiality or retention problem.

That is the gap a managed AI environment closes. DKBinnovative deploys secure AI for professional firms on Hatz.AI, a managed platform where the firm controls which models staff can reach, what is retained, and who has access — with the governance and acceptable-use policy attached rather than assumed. Prompts and documents stay inside an environment the firm owns, so the answer to “where did that client file go” is documented instead of hopeful.

In practice we see three patterns at law, CPA and RIA firms:

• Microsoft 365 already in place and permissions already clean. Copilot is a reasonable add-on, and the work is policy and training.
• Staff already pasting client data into public chatbots. The urgent fix is a sanctioned, governed alternative, not a license purchase. A managed platform gets there faster than a permissions remediation project.
• Confidentiality obligations that make retention the deciding factor. Firms under ABA Formal Opinion 477R or amended Regulation S-P need to state what is retained and where. A managed environment makes that a configuration you can show an examiner.

Our secure AI strategy page covers how we scope that, and the glossary entry on managed AI and secure AI defines the terms.

For firms in Frisco, Plano and Irving

We help DFW law, accounting and wealth management firms prepare Microsoft 365 for AI: permission cleanup, sensitivity labels, written policy and a controlled pilot. See our secure AI strategy and IT for investment and professional firms.

Frequently asked questions

Does Microsoft Copilot train on our firm’s data?

Microsoft states that Microsoft 365 Copilot does not use tenant data to train its foundation models. Confirm this against your own licensing terms.

Is Copilot safer than a public chatbot for client work?

Copilot inside your Microsoft 365 tenant stays within your security and compliance controls. Free public tools do not, which is why client data should never be pasted into them.

How long does SharePoint permission cleanup take?

For a 20 to 50 person firm it usually takes a few weeks, depending on how much has been shared over the years.

Do we need an AI policy if we do not buy Copilot?

Yes. Staff are very likely using AI tools already, and the policy is what defines which tools are approved and what must never be entered into them.

What can Microsoft Copilot actually see?

Only what the user asking already has permission to open across Outlook, Teams, Word, Excel and SharePoint. It does not break permissions; it makes existing ones visible.

What is the most secure way for a law firm to use AI?

A managed AI environment the firm controls, rather than public chatbots or an unreviewed add-on. DKBinnovative deploys secure AI for professional firms on Hatz.AI, where the firm sets which models staff can reach, what is retained and who has access, with an acceptable-use policy attached. That makes confidentiality and retention a documented configuration instead of an assumption.

What should a law firm fix before enabling Copilot?

Remove Everyone and anyone-with-the-link shares from client folders, lock down HR, partner and finance folders, review ownerless Teams and project sites, and apply sensitivity labels to confidential files.

Book an AI readiness review: Contact the DKB crew.

By the DKBinnovative Crew | Reviewed by Peter Bertran, Chief Client Officer, DKBinnovative

Quick answer: Before tax season, a CPA firm should confirm four things: its written information security plan (WISP) is current, MFA is on for every tax and email account, backups have been test-restored, and seasonal staff have secure, limited access. Fix those in November and you go into January with fewer surprises.

What should a tax season IT checklist cover?

A tax season IT checklist for a CPA firm covers the safeguards the IRS and FTC expect, plus the systems you can’t afford to lose between January and April. In practice that means eight items: a current WISP, MFA on every account, tested backups, secure access for seasonal staff, phishing training, tax software readiness, an outage plan and a cleanup of last season’s accounts. The sections below walk through each one.

Why November is the right month

Once January hits, nobody at a CPA firm has time to change systems. Every hour goes to returns. That makes November and early December the last calm window to fix the IT gaps that cause tax-season outages, lockouts and breaches.

It is also when criminals start their own season. Fake IRS notices, spoofed client emails and “updated W-2” phishing peak from January through April. Getting your defenses in place now matters more than any single tool you buy.

1. Is your WISP current?

Paid tax preparers are covered by the FTC Safeguards Rule, and the IRS expects every preparer to have a written information security plan. You confirm that each year when you renew your PTIN. A WISP that was written once and never updated will not hold up after an incident.

Check that your plan:

• Names the person responsible for security at your firm
• Lists where client data lives — tax software, portal, file server, email, paper
• Describes your safeguards: MFA, encryption, backups, access rules
• Includes an incident response plan with phone numbers
• Was reviewed and dated within the last 12 months

Our glossary covers the written information security program (WISP) and the FTC Safeguards Rule in more detail.

What does the IRS require? WISP and Publication 4557

IRS Publication 4557, Safeguarding Taxpayer Data, is the IRS guide to the security practices it expects from tax professionals, and the WISP is where you write those practices down. The IRS also publishes a short list it calls the “Security Six”:

• Antivirus software on every device
• A firewall
• Multi-factor authentication
• Backups
• Drive encryption
• A VPN for remote connections

If your WISP describes all six and your firm can show they’re in place, you’re covering the baseline the IRS checks for. For how these rules apply to AI tools, see Can DFW accounting firms use AI? IRS 4557 and the FTC Safeguards Rule.

To write or update the plan itself, IRS Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice, includes a sample WISP template you can adapt to your firm.

2. MFA on every tax app, portal and mailbox

Stolen passwords are still the most common way into a firm. Turn on multi-factor authentication for:

• Your tax software and e-file accounts
• Your client portal
• Microsoft 365 or Google Workspace email
• Remote access tools and VPN

No exceptions for partners. The accounts with the most access are the ones attackers want most.

3. Test-restore your backups

A backup you have never restored is a guess. Pick one client folder and one tax software database, restore them to a test location, and time how long it takes. If the answer is “we are not sure” or “more than a day,” fix it now. During tax season, a day of downtime means missed deadlines.

4. Secure access for seasonal and remote staff

Most CPA firms add seasonal preparers or let staff work from home through April. Before they start:

• Give each person their own login, with no shared accounts
• Grant access only to the clients and folders they need
• Require MFA and a firm-managed or secured device
• Set an end date to remove access on April 16

5. Get ready for phishing season

Run a short refresher before January: how to spot a fake IRS notice, why you never change bank details from an email, and who to call when something looks wrong. Add a rule that any request to change a client’s refund or payment information gets a phone call to a number you already have.

6. Is your tax software ready for 2027?

Install and test this season’s version of your tax software before the first return comes in, not on the day you need it. Check that every workstation meets the vendor’s requirements, that hosted or cloud tax software requires MFA, and that e-file access works for everyone who needs it. Find out now if any machine still runs Windows 10: tax software vendors drop support for old systems, usually with little warning.

7. Have a plan for an outage during filing week

Decide in advance what happens if the internet, a server or a laptop fails in March:

• A backup internet connection, or at least a hotspot that is tested and charged
• A spare laptop that is already set up and ready to hand out
• A written list of who to call, kept somewhere other than the system that’s down
• A known restore time for your tax software and client files

8. Clean up last season’s accounts

Before adding this year’s seasonal staff, remove anyone left over from last year. Check tax software users, Microsoft 365 accounts, portal logins and remote access. Accounts nobody uses are a common way in for attackers, and they’re easy to miss during the rush.

Your tax season IT timeline

When	What to do
Early November	Review and date your WISP; list where client data lives
Mid November	Turn on MFA everywhere; test-restore a client folder and the tax database
Early December	Remove last season’s accounts; install and test this year’s tax software
Mid December	Set up seasonal staff accounts and devices; run the phishing refresher
January	Confirm monitoring and backups daily; freeze non-urgent changes
April 16	Remove seasonal access and review what to fix before next year

Want a second set of eyes? We review your WISP, MFA and backups and give you a short list of fixes before January. Book a pre-season IT review.

IT support for CPA firms in Frisco, Plano and Irving

We support accounting and tax firms across Collin and Dallas counties from our Frisco headquarters, with offices in Plano and Irving’s Las Colinas. One North Texas CPA firm we support has three offices and 52 staff. When we started, MFA wasn’t enforced and backup jobs had been failing for years. We moved backups to Azure Backup with daily restore points, enforced MFA firm-wide and added 24/7 threat monitoring. In five years we haven’t disrupted a single tax season. Read the CPA firm case study.

Learn more about our managed IT for accounting firms and cybersecurity services in Plano.

Frequently asked questions

Do small tax practices need a WISP?

Yes. The requirement applies to paid tax preparers of every size, including solo practitioners.

What should a WISP include?

Who is responsible for security, where client data is stored, the safeguards you use, how you train staff, and how you respond to an incident.

How often should a CPA firm test backups?

At least quarterly, and always before tax season. A backup that has never been restored is a guess, not a safeguard.

Can our IT provider write our WISP?

Your IT provider can document the technical safeguards, but the firm owns the plan and must review it.

When should a CPA firm do its tax-season IT work?

November and early December. Once January arrives every hour goes to returns, and there is no calm window left to change systems.

Who provides IT support for CPA firms in Plano?

DKBinnovative supports accounting and tax firms across Frisco, Plano and Irving from its Frisco headquarters at 1701 Legacy Drive, including WISP documentation, MFA enforcement, tested backups and seasonal access control. The firm has served compliance-intensive clients since 2004.

Is a WISP required by law for tax preparers?

Yes. The FTC Safeguards Rule requires tax and accounting firms to keep a written information security program, and the IRS asks preparers to confirm they have one when they renew their PTIN.

What is the IRS Security Six?

Six safeguards the IRS recommends for every tax professional: antivirus software, a firewall, multi-factor authentication, backups, drive encryption and a VPN for remote connections.
Book a pre-season IT review: Contact the DKB crew.

Reviewed by Peter Bertran, Chief Client Officer, DKBinnovative

 

Most firms can name every product they run. Far fewer can say which one authenticates against which, who reviews the permissions, or when a restore was last tested end to end.

That second set of questions is the one that decides how a firm’s week goes. Technology in a professional practice rarely fails inside a product. It fails in the space between two of them, and that space tends to belong to nobody.

The document system has to authenticate against something. The billing platform has to be backed up in a way you can actually restore. The email tenant has to be the same tenant the practice management tool trusts. Get any one of those joins wrong and the symptom surfaces somewhere else entirely, which is why they sit unfixed for years.

So this is the stack layer by layer: what these firms run, what we find when we inherit one, and what a working version looks like. The findings below are drawn from our own engagements, including a five-year engagement with a three-office North Texas CPA firm and a business email compromise at a wealth management firm.

What Software Do Most Law Firms Use?

Most law firms run a practice management platform such as Clio, MyCase or Actionstep for matters, time and billing, a document management system such as iManage or NetDocuments, Microsoft 365 for email and files, a legal research tool such as Westlaw or LexisNexis, and an e-signature service. The software is rarely the problem. The problem is that these products are usually bought separately, at different times, by different people, and nobody owns how they fit together.

What Software Do Most Accounting and RIA Firms Use?

Accounting firms typically run tax preparation software such as UltraTax, Lacerte or ProSystem fx, QuickBooks for client bookkeeping, a document portal for client exchange, and Microsoft 365. RIAs run a portfolio accounting or performance reporting platform, a CRM such as Redtail or Wealthbox, a custodian portal, and Microsoft 365. In both cases the line-of-business application is the one nobody can lose access to, and it is usually the one with the weakest integration story.

The Seven Layers, and What We Find in Each

The order below is deliberate. It runs from the layer everything else depends on to the layer most firms buy first.

1. Identity

What it is: Microsoft Entra ID or on-premises Active Directory, usually both, deciding who is allowed into everything above it.

What we find: At the CPA firm, multifactor authentication was not enforced, legacy authentication was still enabled, and stale Active Directory accounts were still live. In a separate post-acquisition engagement, a compromised Microsoft 365 account had been in use by an attacker for more than a year, quietly provisioning Azure virtual machines to run phishing campaigns and generating over $10,000 in fraudulent cloud charges before anyone noticed.

What good looks like: MFA enforced with no exceptions, legacy authentication disabled outright, and quarterly account hygiene that actually removes departed staff. At the CPA firm we run that review every quarter and reset privileged passwords as part of it.

2. Email

What it is: Microsoft 365 in nearly every DFW professional firm we see, and the single most attacked surface in the stack.

What we find: The CPA firm had logged 150+ Microsoft 365 and Outlook disruptions consuming over 200 hours of support time before we arrived. Separately, a wealth management firm suffered a business email compromise that redirected a client payment to a fraudulent account. Email is where the money actually leaves, and the FBI IC3 annual reports put business email compromise among the costliest categories of cybercrime year after year.

What good looks like: DMARC and DKIM deployed across every domain the firm owns, not just the primary one, plus alerting on mailbox forwarding rules and delegate changes. Those two rules catch most BEC in hours rather than months.

3. Document management

What it is: iManage, NetDocuments, SharePoint, or a file server somebody has been meaning to retire since 2019.

What we find: Permissions that grew by accretion. A folder opened up for one project in 2021 and never closed. For litigation practices the more serious finding is a legal hold that cannot be applied reliably because the same matter exists in two systems.

What good looks like: One authoritative repository, permissions reviewed on a schedule rather than on request, and preservation that a custodian cannot override.

4. The line-of-business application

What it is: Practice management, tax software, portfolio accounting. The thing the firm cannot work without.

What we find: This is the layer most IT providers quietly decline to support. The application gets treated as the software vendor’s territory, so tickets are forwarded rather than resolved, and the firm ends up managing that relationship itself during the weeks it can least afford to.

What good looks like: Your provider holds genuine competence in the specific platform you run, and owns the problem rather than routing it onward. Faults get diagnosed and fixed in-house, paired with proactive update management so the same issue stops recurring.

5. Backup and recovery

What it is: The layer everyone assumes is fine.

What we find: The most alarming finding in five years of that CPA engagement: server backup jobs had been failing repeatedly across multiple years, with client financial data exposed the entire time and no durable fix. The jobs reported. Nobody read the reports.

What good looks like: Azure Backup with daily restore points, continuous monitoring of the jobs themselves, and a restore you have actually performed. A green backup status is a claim. A completed restore is evidence.

6. Endpoint and network

What it is: Laptops, the office network, and whatever is filtering traffic.

What we find: At the CPA firm we detected live active threats already present on endpoints during onboarding. Not historical indicators. Active. At the wealth management firm, containing the compromised account took ten minutes, but auditing all 20 endpoints to confirm the blast radius took five hours, and that only worked because there was tooling to audit with.

What good looks like: EDR with 24/7 monitoring behind it, DNS-layer filtering, and network segmentation. We run SentinelOne and Cisco Umbrella, on Meraki infrastructure with VLAN segmentation where the firm has its own network. CISA Cyber Essentials is a reasonable baseline to measure yours against.

7. Monitoring and advisory

What it is: Whether anyone is watching, and whether anyone is planning.

What we find: A fully reactive break-fix model with no patch management schedule, no tax-season planning and no technology roadmap. Decisions made at the moment of failure, by whoever was in the room.

What good looks like: Continuous monitoring, a patch calendar that knows what month it is, and quarterly vCIO reviews. For the CPA firm that meant pausing non-critical updates during peak filing periods, which is a scheduling decision rather than a technical one, and it is the sort of thing only a provider who understands the practice will think to do.

The Pattern Underneath All of It

Read those findings together and one thing connects them. Not a single item on the list is exotic. There is no zero-day, no sophisticated adversary, no failure of technology.

Backups failing for years. MFA not turned on. Legacy authentication left enabled. Accounts belonging to people who left. A forwarding rule nobody alerted on. Every one of these is a known problem with a known fix, sitting unaddressed because the stack had no owner.

That is the actual finding after five years and 1,256 tickets at one firm: professional firms do not usually fail because they bought the wrong software. They fail because seven layers were assembled by different people over a decade and nobody was responsible for the whole.

What a Working Stack Looks Like

The same CPA firm, after the work: backups modernized onto Azure with daily restore points and monitored continuously. MFA enforced firm-wide, legacy authentication eliminated, active endpoint threats contained through EDR. Quarterly Active Directory hygiene across all three offices. DMARC and DKIM across every domain. A patch schedule that pauses during tax season. Quarterly vCIO reviews replacing decisions made in a panic.

The numbers underneath that: 1,256 tickets resolved over five years, 2,164+ hours of support for 52 staff across three offices, more than 65% resolved same-day or next-day, and average resolution under one day. Through five tax seasons, without disrupting one of them.

That is the whole argument. Not better software. The same software, owned properly.

How to Audit Your Own Stack This Week

You do not need us to do the first pass. Seven questions, one per layer, and you can ask them all in an afternoon.

1. Identity. Is MFA enforced on every account with no exceptions, and is legacy authentication disabled? Ask for it in writing.
2. Email. Does anything alert when a mailbox forwarding rule is created?
3. Documents. Who reviewed folder permissions last, and when?
4. Line-of-business app. When your tax or practice management software breaks, does your IT provider fix it or forward it?
5. Backup. What is the date of the last completed restore test, and what broke during it?
6. Endpoint. Is there EDR, and is a human watching it outside business hours?
7. Advisory. When did someone last show you a technology roadmap you had not asked for?

Any question you cannot answer is a layer without an owner. That is the finding, and you just produced it yourself. If you want a framework to hang the answers on, the NIST Cybersecurity Framework maps cleanly onto these seven layers.

Frisco, Plano and Irving

Plano firms tend to have the deepest layers and the oldest ones. Established practices carry file servers, legacy authentication and permission structures that predate anyone currently working there. The CPA engagement above is the North Texas pattern exactly. Our Managed IT Plano team does most of these untanglings, and our Managed IT Plano security practice handles what the audit turns up.

Frisco firms are typically newer and cloud-native, which moves the problem rather than removing it. The stack is cleaner but governance is thinner: fewer legacy servers, more unmanaged SaaS bought by whoever needed it. DKBinnovative is headquartered in Frisco, and our Managed IT Frisco team sees this pattern constantly, while our Managed IT Frisco practice for financial and professional firms covers the compliance layer that sits on top of it.

Irving and Las Colinas firms get audited by their own clients. The corridor’s corporate tenant base runs vendor due diligence that asks about exactly these seven layers, which means a Las Colinas firm often discovers its gaps through someone else’s security questionnaire. Our Managed IT Irving practice works from 7301 State Hwy 161, and our Managed IT Irving team handles the evidence side.

Frequently Asked Questions

What software do most law firms use?

Most law firms run a practice management platform such as Clio, MyCase or Actionstep, a document management system such as iManage or NetDocuments, Microsoft 365 for email and files, a legal research tool such as Westlaw or LexisNexis, and an e-signature service. The software is rarely the problem. The problem is that these products are bought separately, at different times, and nobody owns how they fit together.

What software do accounting and RIA firms use?

Accounting firms typically run tax software such as UltraTax, Lacerte or ProSystem fx, QuickBooks, a client document portal and Microsoft 365. RIAs run portfolio accounting or performance reporting, a CRM such as Redtail or Wealthbox, a custodian portal and Microsoft 365. The line-of-business application is the one nobody can lose access to and usually the one with the weakest integration story.

What is the most common IT problem you find at professional firms?

Backups that have been failing without anyone noticing. In one five-year CPA engagement, server backup jobs had failed repeatedly across multiple years with client financial data exposed the whole time. The jobs reported their failures. Nobody was reading the reports.

Should our IT provider support our practice management or tax software?

Yes, and many will not. Generalist providers treat line-of-business applications as the vendor’s responsibility, which is technically correct and useless during filing season. Ask a prospective provider directly whether they hold application-level competence in the specific platform you run.

How long does a stack assessment take?

A few weeks to assess all seven layers and produce findings. If remediation is needed, full onboarding for a professional firm typically runs 45 to 90 days depending on how much legacy infrastructure is involved.

Do we need to replace our software to fix these problems?

Almost never. Nearly every finding in this article was resolved on the software the firm already owned. The fix is ownership of the whole stack, not replacement of the parts.

Working With DKBinnovative

We have supported professional firms across Dallas-Fort Worth since 2004, which is 22 years, currently spanning 2,632+ end users across 55+ companies with a 78% first-call resolution rate and 98.14% client satisfaction. We standardize on Microsoft Azure and Microsoft 365, and deploy Hatz.AI where firms need governed AI that keeps client material inside their own tenant.

Call (888) 352-4832 or book an assessment.

Related reading: Case study: multi-office CPA firm · Case study: financial services crisis in 24 hours · Investment & Professional Firms · Managed IT for Law Firms · Managed IT for Accounting & CPA Firms

External references: Microsoft Entra MFA, Exchange Online basic authentication deprecation, FBI IC3 annual reports, CISA Cyber Essentials, NIST Cybersecurity Framework.

Reviewed by Peter Bertran, Chief Client Officer, DKBinnovative

 

Multi-office IT for professional firms rarely fails at the moment of the merger. It fails about four months later, when nobody can say which office owns the client file.

An RIA in Frisco absorbs a two-adviser practice in Southlake and inherits a file server nobody has patched since 2022. A Plano CPA firm opens a second office and discovers its document management license does not cover a second site. A law firm with offices in Irving and Fort Worth finds that the same matter exists in two places, with two different version histories, and no way to tell which one a court would consider authoritative.

Multi-office IT for professional firms is now a standing condition across Dallas-Fort Worth, not an edge case. Firms here are consolidating. RIA roll-ups, CPA succession mergers and law firm lateral moves all produce the same technical problem: two working environments that each made sense alone and make no sense together.

This guide covers multi-office IT for professional firms from the inside: what actually breaks when a firm goes from one office to several, the order to fix it in, and how to tell whether your provider can handle the transition before you are mid-deal.

Best Managed IT Services for Multi-Location Businesses

The best managed IT services for multi-location businesses share one trait: they centralize identity, data and policy while leaving each office’s local workflow alone. That means a single sign-on directory, one document repository with per-office permissions, uniform security baselines, and a support desk that knows which office a caller is in. Firms that instead replicate one office’s setup onto the next end up with parallel systems that drift.

The word doing the work in that answer is “identity.” Most multi-office problems trace back to two directories that were never merged, because merging them felt risky and postponing it felt free.

How to Centralize IT for Growing Multi-Site Companies

Centralization follows a fixed order, and firms that take it out of order pay for it twice.

1. Identity first. One directory, one set of credentials, conditional access applied uniformly. Until this is done, every other consolidation step has to be redone later.
2. Data second. One repository with a defensible structure, migrated with permissions intact and with a record of what moved.
3. Policy third. Retention, legal hold, device standards and acceptable use, written once and applied to both offices rather than negotiated per site.
4. Applications fourth. Practice management, time and billing, portfolio accounting. These are the loudest problem and the one people want to solve first, which is why so many firms end up with a consolidated application sitting on two unconsolidated identity systems.
5. Network last. Connectivity between offices matters, but it is the easiest piece to change and the least likely to cause a compliance problem.

The reason identity comes first is not technical elegance. It is that every obligation discussed below, from Reg S-P service provider oversight to ABA supervision duties, depends on being able to say who had access to what, and when. Two directories means two answers to that question.

What Actually Breaks When the Second Office Opens

The same document exists twice

This is the most common and the most dangerous. Two offices, two repositories, one matter. For a law firm this collides directly with preservation duties, because a legal hold applied in one system does not reach the copy in the other. For a CPA firm it means a return exists in two states during the one month you cannot afford ambiguity.

Permissions carried over from the acquired firm

Acquired environments almost always arrive with over-broad access. The departing owner’s account still has domain admin. A former contractor still has a mailbox. A shared folder is open to everyone because that was easier in a six-person office. None of it is malicious and all of it is now yours.

Nobody owns the seam

Each office has an idea of who handles IT. Neither idea covers the space between them. Tickets about cross-office issues sit because they are nobody’s obviously.

Compliance evidence fragments

If your firm is subject to Regulation S-P, you owe an incident response program covering customer information wherever it sits, including in the office you acquired last quarter. If you are a CPA firm, your Written Information Security Plan now has to describe an environment it was not written for. A WISP that describes one office while the firm operates three is not a WISP.

Our IT Can’t Keep Up With How Fast We’re Growing. What Are Our Options?

Three, and the right one depends on where the constraint actually sits.

For most DFW professional firms between roughly 10 and 150 people, the co-managed route is the one that survives contact with a merger. It keeps the person who knows why the Plano office does things differently, and adds the capacity that a second office demands.

The Pre-Close Checklist

Run this before the deal closes, not after. Every item is cheaper to resolve while there is still negotiating leverage.

• Inventory both environments. Every system holding client data, with an owner. See our IT due diligence definition for scope.
• Get the acquired firm’s incident history. Ask directly whether they have had a breach, and what was disclosed. Inheriting an undisclosed incident is inheriting its notification obligation.
• Check licensing transferability. Practice management and document management licences frequently do not survive a change of control without renegotiation.
• Identify the data owner of record. For client files, who is the custodian after close, and does the engagement letter say so.
• Confirm the acquired firm’s vendor list. Their service providers become your service providers, and under Reg S-P you owe oversight of them.
• Set the identity cutover date before close. If it is not scheduled, it will not happen.

We published a worked example of this in our case study on modernizing IT for a multi-office CPA firm, which covers the sequencing in practice.

Frisco, Plano and Irving: Where the Consolidation Is Happening

Frisco sees the most greenfield second offices. Firms that started here are opening additional locations rather than acquiring them, which is the easier version of this problem: one culture, one set of standards, and a chance to do identity correctly from the start. DKBinnovative is headquartered in Frisco, and our Managed IT Frisco team handles a steady flow of these expansions. For firms in the finance vertical specifically, our Managed IT Frisco practice covers the compliance overlay.

Plano is where most of the genuine mergers happen, because it holds the region’s concentration of established firms with founders approaching succession. These are the hardest integrations: two mature environments, two sets of habits, twenty years of accumulated data on each side. Our Managed IT Plano engagements with professional firms frequently start the month after a close, and our Managed IT Plano security team handles the permissions cleanup that always follows.

Irving and Las Colinas tends to produce the satellite office rather than the merger. Firms headquartered elsewhere in the metroplex open a Las Colinas presence to sit closer to corporate clients, which means a small office with full compliance obligations and no local IT. Our Managed IT Irving practice works from an office at 7301 State Hwy 161, and our Managed IT Irving team covers exactly this pattern.

Frequently Asked Questions

What are the best managed IT services for multi-location businesses?

The best managed IT services for multi-location businesses centralize identity, data and policy while leaving each office’s local workflow alone: a single sign-on directory, one document repository with per-office permissions, uniform security baselines, and a support desk that knows which office a caller is in. Replicating one office’s setup onto the next produces parallel systems that drift.

How do you centralize IT for a growing multi-site company?

In this order: identity, then data, then policy, then applications, then network. Identity comes first because every compliance obligation depends on being able to say who had access to what and when, and two directories produce two answers. Firms that start with applications usually have to redo the work.

When should we integrate IT during a merger?

Assessment before close, execution after. The inventory, incident history, licensing check and vendor review all need to happen while you still have negotiating leverage. The cutover itself should be scheduled before close even if it runs afterwards.

Does our WISP or incident response plan need updating after we acquire a firm?

Yes. A Written Information Security Plan or Reg S-P incident response program describes a specific environment. Once the firm operates an additional office, a plan that describes only the original one no longer reflects reality, which is the first thing an examiner notices.

Can we keep our existing IT person through a merger?

Usually you should. A co-managed arrangement keeps the person who understands why each office works the way it does, while adding after-hours coverage, security operations and the integration capacity that one person cannot supply alongside daily support.

How long does multi-office IT integration take?

For a professional firm, expect 45 to 90 days from engagement to a stable consolidated environment, with identity work in the first few weeks. Complex integrations involving legacy on-premises systems on both sides run longer.

Working With DKBinnovative

We have supported professional firms across Dallas-Fort Worth since 2004, which is 22 years, and today covers 2,632+ end users across 55+ companies with a 78% first-call resolution rate and 98.14% client satisfaction. Our infrastructure standardizes on Microsoft Azure and Microsoft 365, and we deploy Hatz.AI where firms need governed AI that keeps client material inside their own tenant.

If you are looking at a second office or a merger, the most useful thing we can do is look at both environments before you close and tell you plainly what has to be resolved first.

Call (888) 352-4832 or book a pre-integration review.

Related reading: Investment & Professional Firms · Managed IT for Accounting & CPA Firms · Managed IT for Law Firms · Managed IT for RIA Firms · Can Your MSP Scale With You? · Case study: One Secure IT Environment Across Three Offices

External references: 17 CFR Part 248 (Regulation S-P), IRS Publication 4557, NIST Cybersecurity Framework.

Reviewed by Peter Bertran, Chief Client Officer, DKBinnovative

 

 

For two years, amended Regulation S-P was a deadline. Firms tracked it on a compliance calendar, assigned it to someone, and worked toward a date.

Both dates have now passed. Larger entities came into scope on December 3, 2025. Smaller entities, which includes SEC-registered investment advisers with less than $1.5 billion in assets under management, came into scope on June 3, 2026.

That changes the nature of the question. Reg S-P is no longer a project with a due date. It is a standing condition your firm is either meeting or not, and the way it now surfaces is through an examination request or a client’s vendor questionnaire. The operative word has shifted from “prepare” to “evidence.”

This piece covers what a firm in Frisco, Plano or Irving must be able to show today, and specifically which parts of it are IT problems rather than compliance-department problems.

How Can IT Services Help Meet SEC Cybersecurity Guidance?

IT services meet SEC cybersecurity guidance by producing evidence, not just protection. Reg S-P requires a written incident response program, the ability to detect unauthorized access to customer information, customer notification within 30 days of becoming aware of an incident, and documented oversight of service providers. Each of those obligations depends on logging, alerting, retention and access records that only the technology environment can supply.

The distinction matters because firms routinely buy security tooling and still fail an examination. A firm can run good endpoint protection and still be unable to answer the question an examiner actually asks, which is some version of: show me how you would know, show me when you knew, and show me what you did.

What the Amended Rule Actually Requires

The amendments adopted May 16, 2024 updated a rule that had been largely unchanged since 2000. Four elements carry the operational weight.

1. A written incident response program

Covered institutions must maintain written policies and procedures for an incident response program reasonably designed to detect, respond to and recover from unauthorized access to or use of customer information. All three verbs matter. Detection is the one most firms underinvest in, because it is the least visible until it is needed.

2. The 30-day notification clock

When sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization, the firm must notify affected individuals as soon as practicable and no later than 30 days after becoming aware that the incident occurred or is reasonably likely to have occurred.

Read that trigger carefully. The clock starts at awareness of a reasonably likely incident, not at confirmation of a confirmed breach. Firms that wait for certainty before starting the count are misreading the standard. The notice itself must describe the incident, the information involved, and what affected individuals can do to protect themselves.

3. Broader scope of covered information

The safeguarding and disposal requirements now apply to all customer information, defined as any record containing nonpublic personal information about a customer of a financial institution that is in the firm’s possession, or that is handled or maintained by the firm or on its behalf.

The phrase “or on its behalf” is the one that expands the perimeter. Data sitting with your custodian, your CRM vendor, your portfolio accounting platform or your outsourced IT provider is inside your obligation.

4. Service provider oversight

Firms must take reasonable steps to require service providers to protect customer information and to notify the firm of a breach. In practice this has produced a wave of questionnaires flowing downstream, which is why professional firms serving advisory clients are now fielding security reviews they never used to see.

One additional change is easy to miss: transfer agents registered with the Commission or another appropriate regulatory agency must now comply with both the safeguarding and the disposal requirements, where previously they faced only the disposal rules and only in some cases.

Who Counts as a “Smaller Entity”

The distinction only ever governed the compliance date, and both dates are now behind us. It remains useful for understanding where your peers are in their maturity curve.

Entity type	Larger entity threshold (complied by Dec 3, 2025)
SEC-registered investment adviser	$1.5 billion or more in assets under management
Investment company	Net assets of $1 billion or more at the most recent fiscal year end
Broker-dealer	Any that is not a small entity under the Exchange Act
Transfer agent	Any that is not a small entity under the Exchange Act

Most independent RIAs across Dallas-Fort Worth fell into the smaller-entity group and reached their date in June 2026. If your firm treated that as a documentation exercise and has not revisited it since, the gap between the written plan and the operating environment is probably where your risk now sits.

The Six Gaps We Find Most Often

These come from readiness work with advisory firms across the metroplex. They are ordered by how frequently they appear, not by severity.

1. The plan names a role that no longer exists

Incident response plans written in 2024 and 2025 routinely name an individual who has since left, or a vendor the firm no longer uses. An examiner reading a plan that names a departed employee learns something about the firm beyond that one error.

2. Logs that do not reach back 30 days in a usable form

If you become aware of a possible incident on day one and need to determine scope, you need history. Default retention on many platforms is shorter than firms assume, and the retention that exists is often not searchable by the people who would need to search it at 9pm on a Friday.

3. No alerting on the events that signal unauthorized access

Detection is a rule requirement, not a best practice. At minimum a firm should alert on impossible-travel sign-ins, new mailbox forwarding rules, mass file downloads from document storage, and changes to privileged group membership. Each of these is a common first observable in an actual compromise.

4. A vendor inventory that is out of date or does not exist

Service provider oversight requires knowing who your service providers are. Firms often have an inventory built during the original compliance push and never maintained. Every system that touches customer information needs an entry, an owner and a review date.

5. Notification mechanics never tested

The 30-day clock assumes you can identify affected individuals and reach them. Many firms have never tested whether they can produce an accurate affected-party list from their systems under time pressure. That is a tabletop exercise, and it takes an afternoon.

6. Secure AI with no governance

Staff at advisory firms are pasting client information into public AI tools. This is now one of the more direct routes to an unauthorized-use problem, and it is invisible without a governed alternative. We deploy Hatz.AI so advisory firms get a private environment where client data stays inside the tenant and administrators retain visibility. Our deeper treatment is in secure AI for investment firms.

What to Look for in a Managed IT Provider Experienced With SEC Reg S-P Compliance

A provider experienced with Reg S-P should be able to do four specific things, and you can test each in a first conversation.

1. Map each rule requirement to a control and an artifact. Not “we do security,” but: detection maps to these alert rules, and the artifact is this report. If they cannot draw that line, they have not done this work.
2. Produce a completed vendor security questionnaire on request. Advisory clients push oversight downstream. Your IT provider is one of your service providers, and should already be answering for itself.
3. Run a notification tabletop. Ask them to walk through hour one through day thirty of a suspected incident at your firm, naming who decides what.
4. Retain evidence on a defined schedule. Ask what they keep, for how long, and how you get it if you leave.

The FINRA cybersecurity advisory on the amendments is a useful cross-check, as is the rule text itself at 17 CFR Part 248. For control design, the NIST Cybersecurity Framework gives you a structure examiners recognize.

Frisco, Plano and Irving: Three Different Advisory Markets

Frisco has attracted a concentration of newer independent RIAs, many founded by advisers who broke away from wirehouses in the last decade. These firms are typically cloud-native and technically current, but they crossed into Reg S-P scope while still operating with startup-era informality about documentation. Our Managed IT Frisco work with these firms is usually less about new tooling and more about turning existing capability into evidence. DKBinnovative is headquartered in Frisco, and our broader Managed IT Frisco practice supports firms across the corridor.

Plano holds many of the region’s established advisory practices and multi-family offices, firms with longer histories, more legacy systems and more accumulated data. Scope questions are harder here, because customer information has had 20 years to spread into file shares and archives nobody has catalogued. Our Managed IT Plano engagements with advisory firms often begin with discovery of where customer information actually lives, and our Managed IT Plano security team handles the remediation that follows.

Irving and Las Colinas carries a different profile again. The corridor’s institutional and corporate presence means advisory firms there interact with counterparties who run serious vendor due diligence, so the questionnaire pressure arrives earlier and lands harder. Our Managed IT Irving practice works from an office at 7301 State Hwy 161 in Las Colinas, and our Managed IT Irving team spends a disproportionate share of its time on evidence packages for exactly these reviews.

Frequently Asked Questions

Has the Reg S-P compliance deadline passed?

Yes, both of them. Larger entities had to comply from December 3, 2025, and smaller entities from June 3, 2026. There is no remaining runway. A firm that is not currently meeting the requirements is out of compliance rather than behind schedule.

What is a managed IT provider experienced with SEC Reg S-P compliance responsible for?

The provider is responsible for the technical capability behind each requirement: detection and alerting on unauthorized access, log retention sufficient to determine scope, the access and configuration records that evidence safeguarding, and its own conduct as one of your service providers. The firm retains responsibility for the written program, the notification decision and the regulatory relationship.

Does Reg S-P apply to our firm if we are a small RIA?

If you are registered with the SEC, yes. Assets under management determined only which compliance date applied to you, not whether the rule reaches you. Firms under $1.5 billion in AUM were in the smaller-entity group with a June 3, 2026 date.

When does the 30-day notification clock start?

It starts when the firm becomes aware that an incident involving unauthorized access to sensitive customer information has occurred, or is reasonably likely to have occurred. That is an awareness-of-likelihood standard, not a confirmation standard, so the clock can start before an investigation concludes.

Do we have to oversee our IT provider under Reg S-P?

Yes. Covered institutions must take reasonable steps to require service providers to protect customer information and to notify the firm of a breach. An IT provider that cannot complete your security questionnaire creates a compliance problem for you, not only an inconvenience.

How long does a Reg S-P readiness engagement take?

A readiness review takes a few weeks. If it surfaces material gaps, remediation and full onboarding typically run 45 to 90 days depending on how much discovery the environment requires.

Working With DKBinnovative

We have supported investment and professional firms across Dallas-Fort Worth since 2004. That is 22 years, currently spanning 2,632+ end users across 55+ companies, with a 78% first-call resolution rate and 98.14% client satisfaction. We standardize on Microsoft Azure and Microsoft 365 for infrastructure, and deploy Hatz.AI where firms need governed AI that keeps client information inside their own tenant.

If your firm reached its Reg S-P date and has not revisited the program since, the useful next step is a short readiness review that tests the written plan against what your systems can actually produce. We will tell you plainly which of the four requirements you can evidence today and which you cannot.

Call (888) 352-4832 or book a readiness review.

Related reading: Managed IT for RIAs & Wealth Management Firms · Investment & Professional Firms · Financial Services IT · IT Support for Law & Accounting Firms