Reviewed by Peter Bertran, Chief Client Officer, DKBinnovative

We asked our security team what they would tell an investment or professional firm to fix first. 

None of it requires new software, a budget cycle or an outside consultant. Every recommendation below is finishable in an afternoon by whoever already administers your systems, and each one comes from what we find repeatedly when we take over environments at law, CPA and investment firms across Dallas-Fort Worth.

October is Cybersecurity Awareness Month, which makes it a convenient time to work through them. The recommendations hold the rest of the year too.

What Do Security Experts Recommend for an Investment or Professional Firm?

An investment or professional firm should use Cybersecurity Awareness Month to fix the small number of things that actually cause breaches at firms like theirs: unenforced multifactor authentication, accounts belonging to people who left, mailbox forwarding rules nobody is alerted on, and backups that have never been restored. Awareness training is worth running, but it does not change the environment. These four recommendations do.

Cybersecurity Awareness Month is run each October by the Cybersecurity and Infrastructure Security Agency. Its baseline for individuals covers phishing, strong passwords, multifactor authentication, and updates. For organizations, it adds logging, backups, encryption, and incident response planning. Everything below maps to one of those.

Recommendation One: Fix Identity Before Anything Else

Identity is the layer everything else sits on. If it is wrong, nothing above it holds.

• Enforce multifactor authentication with no exceptions. The exceptions are usually partners, and partners are the accounts attackers want. “Almost everyone” is not enforced.
• Switch off legacy authentication. It is the quiet way around MFA. If it is still enabled anywhere in your tenant, your MFA is optional.
• Find the accounts belonging to people who left. Pull a report of every account with no sign-in in ninety days. In almost every environment we inherit, at least one still has elevated access.
• Separate privileged accounts from daily-use ones. Nobody should be reading email from an account that can change tenant settings.

Recommendation Two: Make Email Compromise Visible

Email is where the money actually leaves. Business email compromise remains among the costliest categories of cybercrime in the FBI IC3 annual reports, year after year.

• Turn on alerting for mailbox forwarding rules. Compromise almost always announces itself through a quietly created forward. Alert on rule creation, external forwarding and new delegate permissions. This is the single highest-value hour on the whole list: it turns a months-long compromise into a same-day one.
• Audit delegate access on partner and executive mailboxes. Delegates accumulate over years and are almost never removed.
• Check DMARC and DKIM on every domain you own, not just the primary one. Firms routinely protect the main domain and leave the old one wide open for spoofing.
• Agree one rule for sensitive material. Matters involving personal financial data, health information or sealed filings go through a portal, not an attachment. Then make the secure path the easy one, because controls people route around are not controls.

Recommendation Three: Prove You Can Recover

This is the recommendation that produces the most uncomfortable answer, which is why it is worth acting on.

• Run an actual restore. Not a backup check. A restore. Write down the date and what broke, because something always does.
• Know your recovery order. If everything went down tonight, which system comes back first? For most firms it is the document system and time and billing, not email, and most firms have never said so out loud.
• Test that you can reach people. If your email is the thing that is down, how does the firm coordinate? A phone tree written on paper is not old-fashioned, it is a control.

A backup job reporting success is a claim. A completed restore is evidence. The difference matters the week you need it, and it matters every time a client asks.

Recommendation Four: Be Able to Show Your Work

The first three change the environment. This one lets you prove it, which is increasingly what clients want.

• Write the incident response plan down. One page naming who decides, who calls the client and within how many days beats a sophisticated plan that does not exist.
• Build the evidence pack once. A current inventory of systems holding client data, your last restore date, your access review records, a subcontractor list, training completion records. Assemble it once and every future request becomes a mapping exercise.
• Ask your IT provider for their own security documentation. You are expected to oversee them. If they cannot produce it for you, they will not produce it when a client asks either.

Four Things Worth Telling Your Team

Everything above is administrator work. This part is for everyone else, and it is short enough to paste into a firm-wide email.

• Length beats complexity on passwords. A long passphrase you can remember is stronger than a short one with symbols bolted on, and far stronger than the same password reused on twelve sites. The one that matters most is the password on your email, because that is the account that resets all the others. We wrote more on this in password security for DFW investment and professional firms.
• Use a password manager, and stop trying to remember them. Reuse is the actual risk. When a breach elsewhere exposes a password you also use at work, attackers try it against your firm within hours. Credential stuffing at that scale is routine, as the 16 billion credential leak made obvious.
• Approve nothing you did not start. If a multifactor prompt appears and you were not signing in, that means someone already has your password. Deny it and report it the same hour. Attackers rely on people approving a prompt to make it stop.
• Urgency plus a change of payment details is the tell. Almost every successful attack on a professional firm involves a message that is urgent, plausible, and asks for money to move or credentials to be entered. Slow down, and confirm it on a number you already had, never the one in the message.

None of that is new advice. It is on this list because it still works, and because the firms we onboard are rarely breached by anything cleverer.

The Best Self-Test We Know

If you want a harder version of all of the above, borrow the instrument your clients already use: a client security questionnaire.

Take a blank one and answer it honestly as a firm. Better still, hand it to someone who did not build the environment and ask them to answer from evidence alone. Whatever they cannot find is what a client will not be able to verify either.

We covered how these work, what reviewers are really testing, and the answers that quietly lose engagements in our guide to client security questionnaires.

What We Actually Find

None of this is theoretical. Across onboarding engagements with investment and professional firms, the same findings come up:

Multifactor authentication not enforced, legacy authentication still enabled, and stale directory accounts still live. A three-office CPA firm whose server backup jobs had been failing repeatedly across multiple years, with client financial data exposed the entire time, because the jobs reported and nobody read the reports. A wealth management firm where a business email compromise redirected a client payment to a fraudulent account.

Not one of those is exotic. No zero-day, no sophisticated adversary. Every item is a known problem with a known fix, sitting unaddressed because nobody owned it. That is what a month of focused attention is actually for.

Who Owns This After October?

The honest limitation of any checklist is that it is a moment in time. Working through these four fixes what is broken today and does nothing about what changes in March, when someone joins, a vendor is swapped, or a client sends a questionnaire with a question nobody has considered.

Security at a professional firm is a standing function, not a project. Most firms between ten and a hundred and fifty people cannot justify a full-time chief information security officer, and hiring one is rarely the right answer anyway. What they need is the function: someone accountable for the risk register, the policies, the evidence pack, the vendor reviews and the board-level reporting, on a schedule rather than in a panic.

That is what a vCISO is. Senior security direction without the hire, sized to a firm rather than an enterprise. For firms in the Legacy and Preston corridors, our vCISO practice in Plano covers exactly this, and for family offices and investment firms, we run a dedicated version with the regulatory overlay built in.

If October leaves you with a list of things nobody owns, that is the gap a vCISO closes.

Frisco, Plano and Irving

Frisco firms are typically newer and cloud-native, so the identity work is usually quick and the evidence work is the hard one: good controls, thin documentation. DKBinnovative is headquartered in Frisco, and our Managed IT Frisco team runs this work locally, while our Managed IT Frisco practice for financial and professional firms handles the compliance layer on top.

Plano holds the region’s most established practices, which means the identity work takes longer: legacy authentication, file servers and permission structures that predate anyone currently working there. Our Managed IT Plano team does most of these untanglings, and our Managed IT Plano security practice handles what the audit turns up.

Irving and Las Colinas firms are usually already being asked. The corridor’s corporate tenant base runs real vendor due diligence, so the evidence work tends to arrive uninvited. Our Managed IT Irving practice works from 7301 State Hwy 161, and our Managed IT Irving team handles the evidence side.

Frequently Asked Questions

What should an investment or professional firm do for Cybersecurity Awareness Month?

Fix the small number of things that actually cause breaches at firms like yours: unenforced multifactor authentication, accounts belonging to people who left, mailbox forwarding rules nobody is alerted on, and backups that have never been restored. Awareness training is worth running, but it does not change the environment.

When is Cybersecurity Awareness Month?

Every October, run by the Cybersecurity and Infrastructure Security Agency. Its baseline covers phishing, strong passwords, multifactor authentication and updates, with logging, backups, encryption and incident response added for organizations.

What is the single highest-value security fix for a small firm?

Alerting on mailbox forwarding rules. Business email compromise almost always announces itself through a quietly created forward, and alerting on rule creation turns a months-long compromise into a same-day one. It takes about an hour to configure.

How do we know whether our backups actually work?

Run a restore. A backup job reporting success is a claim; a completed restore is evidence. Note the date and what broke during it, because clients increasingly ask for exactly that.

Do we need a CISO, or is a vCISO enough?

For most investment and professional firms between ten and a hundred and fifty people, a vCISO is the right size. You get the function that matters, meaning the risk register, policies, evidence pack, vendor reviews and board reporting on a schedule, without carrying a full-time executive salary. A full-time CISO starts making sense at a scale most DFW investment and professional firms have not reached.

What if we already have an IT provider?

Then most of this is their job, and the useful move is to ask. Send them the four recommendations and ask which are already in place, which are not, and why. A good provider answers with specifics and dates. A provider who treats the questions as an inconvenience has told you something worth knowing.

Working With DKBinnovative

We have supported investment and professional firms across Dallas-Fort Worth since 2004, which is 22 years, currently spanning 2,632+ end users across 55+ companies with a 78% first-call resolution rate and 98.14% client satisfaction. We standardize on Microsoft Azure and Microsoft 365, and deploy Hatz.AI where firms need governed AI that keeps client material inside their own tenant.

If October is the month you finally get security attention at your firm, spend it on the four recommendations above. If you would rather we ran them for you, that is a security assessment.

Call (888) 352-4832 or book an assessment.

Related reading: The Professional Firm Tech Stack · IT Support for Law & Accounting Firms · Reg S-P Is Now in Force · Investment & Professional Firms

External references: CISA Cybersecurity Awareness Month, FBI IC3 annual reports, NIST Cybersecurity Framework.

Reviewed by Peter Bertran, Chief Client Officer, DKBinnovative

A client security questionnaire is now a routine part of winning professional services work in Dallas-Fort Worth, and the firms that lose on it usually lose for answering badly rather than for being insecure.

It arrives as a spreadsheet attached to an otherwise friendly email. Forty questions, sometimes three hundred. Your client’s procurement or compliance team needs it back in two weeks. Nobody at your firm has seen most of these terms before, and the engagement is worth more than anything else in the pipeline.

This is the newest pressure on professional firms, and it is not going away. It is a direct consequence of regulation flowing downhill: covered institutions are required to oversee their service providers, so they oversee you.

This guide covers what these questionnaires are actually testing, which answers quietly disqualify a firm, and how to get to a position where the next one takes an afternoon instead of a fortnight.

What Is a Client Security Questionnaire and Why Are Firms Receiving Them?

A client security questionnaire is a structured assessment a client sends to verify that your firm protects their data adequately before or during an engagement. Professional firms receive them because regulations like SEC Regulation S-P and the GLBA Safeguards Rule require covered institutions to oversee their service providers, and your firm is a service provider. The questionnaire is how that obligation gets discharged on paper.

Understanding that origin changes how you read the document. It is not your client doubting you. It is your client creating a record that they performed diligence, because someone will eventually ask them to produce it.

Why the Volume Jumped This Year

Three rules push these downstream, and you do not need to know them in detail. You just need to know that your client is being asked, so they are asking you.

• SEC Regulation S-P. Both compliance dates passed this year, which is why the volume jumped. Covered firms must oversee their service providers, and you are one. More in what Reg S-P now requires firms to evidence.
• The GLBA Safeguards Rule. Accounting and tax practices count as financial institutions under it, with IRS Publication 4557 as the yardstick.
• ABA Model Rules 5.1 and 5.3. Law firms must supervise their storage vendors, so corporate clients ask outside counsel to prove it.

The practical effect is a chain. Your client is asked by their regulator. They ask you. You should be asking your IT provider. Firms that cannot complete the third link tend to discover it at the worst moment.

What the Questionnaire Is Really Testing

Most questionnaires draw on a small number of standard instruments: the Standardized Information Gathering (SIG) questionnaire, the Cloud Security Alliance’s Consensus Assessments Initiative Questionnaire, or a bespoke form built from the NIST Cybersecurity Framework or the CIS Critical Security Controls.

Whatever the format, they cluster into six things:

1. Access control. Who can reach client data, how they authenticate, and how access is removed when someone leaves.
2. Encryption. Data at rest and in transit, and whether you can say which systems are covered.
3. Incident response. Whether a written plan exists, who owns it, and how fast you would notify them.
4. Backup and recovery. Not whether you back up. Whether you have restored, and when.
5. Subcontractors. Who else touches their data, including your IT provider and any offshore support.
6. Training and governance. Whether staff are trained, and whether anyone reviews any of this on a schedule.

Turn a Thin Answer Into an October Project

If a questionnaire has landed and you already know which rows are weak, give the gaps a deadline. October is Cybersecurity Awareness Month, which makes it an easy window to get the work scheduled.

We have written the four-week version we run at professional firms: identity, email, recovery, then evidence, with every item finishable in an afternoon. See Prep for a Secure Firm.

The Answers That Quietly Lose Engagements

Reviewers are rarely looking for perfection. They are looking for signals that a firm has thought about this before today. These are the responses that read badly.

The single most common disqualifier is inconsistency. A firm claims annual access reviews in one row and cannot name who performs them in another. Reviewers notice, because catching that is the job.

How to Answer Well

Build the evidence pack once

Nearly every questionnaire asks for the same underlying facts. Assemble them once and maintain them: a current network and data inventory, your written incident response plan or WISP, the date of your last restore test, your access review records, a subcontractor list, and your training completion records. After that, each new questionnaire is a mapping exercise.

Never overstate

A questionnaire response is a representation to a client, and in a regulated relationship it can end up in front of an examiner. If a control is partial, say it is partial and give the remediation date. Reviewers accept gaps with plans far more readily than they accept claims that collapse under a follow-up question.

Answer the subcontractor questions honestly

Your IT provider is a subcontractor with access to client data. Naming them is expected. What reviewers want to see is that you oversee them, which means you should be able to produce their security documentation on request. If your provider cannot supply it, that is worth knowing before a client asks.

Put one person in charge

Questionnaires that get routed to whoever is least busy produce inconsistent answers. One owner, with your IT provider supplying the technical rows, produces a document that holds together. For firms without an obvious owner, a vCISO arrangement covers the role without a full-time hire.

Frisco, Plano and Irving: Who Is Getting Asked

Irving and Las Colinas firms face this earliest and hardest. The corridor’s corporate and institutional tenant base runs mature vendor due diligence, so a Las Colinas firm often fields an enterprise-grade questionnaire while still small enough that nobody owns security. Our Managed IT Irving practice works from an office at 7301 State Hwy 161, and our Managed IT Irving team spends a disproportionate share of its time on exactly these responses.

Plano firms tend to receive them from long-standing clients whose own compliance posture has tightened, which makes the request feel like a change in a relationship rather than a new one. Our Managed IT Plano team handles these for advisory and accounting practices, and our Managed IT Plano security practice supplies the technical evidence.

Frisco firms are newer and more often growing into their first questionnaires as they move upmarket. The good news is that cloud-native firms usually have better underlying controls than they realize and simply lack the documentation. DKBinnovative is headquartered in Frisco; our Managed IT Frisco and Managed IT Frisco teams cover this work.

Frequently Asked Questions

What is a client security questionnaire?

A client security questionnaire is a structured assessment a client sends to verify that your firm protects their data adequately before or during an engagement. Professional firms receive them because regulations like SEC Regulation S-P and the GLBA Safeguards Rule require covered institutions to oversee their service providers, and your firm is a service provider.

Why are we suddenly getting so many?

Because both Reg S-P compliance dates have now passed, in December 2025 for larger entities and June 2026 for smaller ones. Covered institutions that were preparing are now executing, and service provider oversight is one of the obligations they execute by sending questionnaires downstream.

Do we have to answer them?

Not legally, in most cases. Commercially, declining to answer usually ends the engagement, because your client cannot discharge their own oversight obligation without your response.

What if we cannot answer yes to everything?

Almost nobody can. Say the control is partial, describe what exists, and give a remediation date. Reviewers routinely accept gaps with credible plans. What they do not accept is a claim that fails on a follow-up question, because that damages the whole submission.

Should our IT provider complete it for us?

They should complete the technical sections and supply their own security documentation, but the firm should own the submission. The questionnaire is a representation your firm makes to a client, and answers you have not read are answers you cannot stand behind.

How can we use Cybersecurity Awareness Month at a professional firm?

Treat a client security questionnaire as the exercise. Answer a real or blank questionnaire honestly as a firm during October, and you finish the month with a ranked gap list, a reusable evidence pack, and a named owner for security. CISA’s baseline steps for the month each map to a row on a client questionnaire.

How long does a questionnaire take to complete?

The first one commonly takes two to three weeks of intermittent work. Once the underlying evidence pack exists, subsequent questionnaires typically take a day or two, because most of the work is mapping existing answers to a new format.

Working With DKBinnovative

We have supported professional firms across Dallas-Fort Worth since 2004, which is 22 years, and we complete client security questionnaires as a standard deliverable rather than a favour. Today that spans 2,632+ end users across 55+ companies, with a 78% first-call resolution rate and 98.14% client satisfaction. Our infrastructure standardizes on Microsoft Azure and Microsoft 365, and we deploy Hatz.AI where firms need governed AI that keeps client material inside their own tenant.

If a questionnaire is sitting on your desk, send it to us. We will tell you which rows you can already answer, which need work, and how long that work takes.

Call (888) 352-4832 or send us the questionnaire.

Related reading: Investment & Professional Firms · IT Support for Law & Accounting Firms · Reg S-P Is Now in Force · IT Due Diligence · Financial Services IT

External references: 17 CFR Part 248, IRS Publication 4557, Shared Assessments SIG, CSA Cloud Controls Matrix, NIST CSF, CIS Controls, CISA Cybersecurity Awareness Month.

Reviewed by Peter Bertran, Chief Client Officer, DKBinnovative

IT support for law and accounting firms is a different discipline from general business IT, and firms in Frisco, Plano and Irving usually find that out the hard way.

A litigation boutique off Legacy Drive in Plano loses access to its document management system on the Thursday before a Monday filing deadline. A four-partner CPA practice in Frisco discovers in late February that a staff mailbox has been forwarding client returns to an outside address since December. A corporate firm in Las Colinas gets a client security questionnaire that asks, in writing, whether its IT vendor carries cyber liability coverage and who reviews its access logs.

None of these are hypothetical. They are the three ways professional firms in Dallas-Fort Worth discover that IT support for law and accounting firms is a different discipline from general business IT: a deadline, a breach, and a client asking a question the firm cannot answer.

This guide covers what law and accounting firms in Frisco, Plano and Irving need from an IT partner in 2026, which obligations are genuinely binding, and how to tell a specialist from a generalist with a legal page on their website.

Who Specializes in IT Support for Law and Accounting Firms?

Firms that specialize in IT support for law and accounting practices build their service around three things a general MSP does not handle: professional-responsibility duties like the ABA’s confidentiality and breach-notification opinions, federal safeguards rules that treat accountants as financial institutions, and evidentiary requirements such as legal hold and defensible retention. The technical stack matters less than whether the provider can produce evidence when a regulator or a client asks.

That last sentence is the whole distinction. Most MSPs can deploy endpoint protection and patch a server. Far fewer can hand a managing partner a dated access review, a retention policy mapped to a records rule, and an incident response plan that names who calls the client and within how many days.

The Three Rulebooks That Actually Bind Your Firm

Professional firms are frequently sold compliance in the abstract. It is more useful to know precisely which rules apply to you, because they differ sharply between a law practice and an accounting practice.

For law firms: ethics opinions, not statutes

Lawyers are not regulated by a federal cybersecurity agency. They are bound by professional conduct rules, and three ABA formal opinions carry most of the weight:

• Formal Opinion 477R (2017) addresses securing communication of protected client information, and makes clear that unencrypted email is not automatically sufficient when the sensitivity of the matter is high.
• Formal Opinion 483 (2018) sets out what a lawyer owes clients after a breach. It defines the triggering event narrowly, as an episode where material client confidential information is misappropriated, destroyed or compromised, or where the lawyer’s ability to perform the work is significantly impaired. When that threshold is met, Model Rule 1.4 requires the firm to keep current clients reasonably informed.
• Formal Opinion 498 (2021) covers virtual practice, which for most DFW firms now describes ordinary Tuesday operations rather than an exception.

Two supporting rules do quiet work underneath these. Model Rule 1.1 and its technology comment require lawyers to keep up with the benefits and risks of relevant technology. Model Rules 5.1 and 5.3 require supervision of others, and that explicitly reaches third-party electronic information storage vendors. Your IT provider is not outside your ethical perimeter. Supervising them is part of the duty.

For accounting firms: you are a financial institution

CPA firms and tax preparers are covered by the Gramm-Leach-Bliley Safeguards Rule. That surprises a lot of partners, but it is settled: preparing returns for compensation makes a practice a financial institution for these purposes.

The practical consequence is the Written Information Security Plan. Federal law requires tax and accounting professionals to create and maintain a WISP, and the IRS has published two documents that function as the working standard: Publication 4557, Safeguarding Taxpayer Data, and Publication 5708, which walks a practice through building the plan itself. The IRS and its Security Summit partners reissued that reminder in August 2026.

A WISP is not a document you buy once. It names a responsible individual, records a risk assessment, and gets reviewed and updated. If your current provider has never asked to see yours, that is a signal.

For firms serving investment clients: Reg S-P reaches your vendors

If your firm works with registered investment advisers, be aware that amended Regulation S-P took full effect for smaller entities on June 3, 2026, after applying to larger entities from December 3, 2025. It obliges covered institutions to oversee their service providers. Advisory clients are now passing that obligation down the chain in the form of questionnaires. We cover the detail in our companion piece on managed IT for RIA and wealth management firms.

Is a Specialized IT Partner Right for Your Firm?

Not every practice needs one. A solo practitioner running a cloud practice management suite on two laptops is usually fine with good habits and a consumer backup service.

The economics change at a predictable point. In our experience across 55+ client companies and 2,632+ supported end users, firms benefit from a specialized partner when they hit roughly these conditions:

• Somewhere between 10 and 150 people, which is large enough that informal coordination fails and small enough that a full internal IT department is hard to justify
• More than one office, or a genuine hybrid pattern where staff move between home and a Frisco or Las Colinas location
• Client security questionnaires arriving at least a few times a year
• An existing WISP or incident response plan that nobody has revisited in over a year
• Any practice area where a deadline is court-imposed rather than self-imposed

Firms with an internal IT manager often get more value from a co-managed arrangement than from replacing that person. The internal manager keeps relationships and institutional knowledge; the partner supplies after-hours coverage, security tooling and the compliance evidence work.

Seven Things a Legal or Accounting IT Provider Must Cover

Use this as a checklist when you evaluate anyone, including us.

1. Identity, not just antivirus

Most firm breaches now start with a credential, not malware. Phishing-resistant multifactor authentication on every account, conditional access that restricts sign-ins by location and device health, and privileged accounts held separately from daily-use accounts. On Microsoft 365, which is where the overwhelming majority of DFW professional firms live, this is configuration work rather than new spend.

2. Mailbox forwarding and delegation monitoring

The February CPA scenario at the top of this article is one of the most common incidents we see in tax season. Business email compromise usually announces itself through a quietly created forwarding rule. Alerting on rule creation, external forwarding and unusual delegate permissions catches it in hours instead of months.

3. Legal hold and defensible retention

For litigation practices this is not optional. You need the ability to preserve a custodian’s mail and files without the custodian being able to delete, and a record showing when the hold was applied. Retention settings that silently purge items after a fixed window will eventually collide with a preservation duty.

4. Encryption with a client-communication policy attached

Opinion 477R does not require encrypting everything. It requires judgment about sensitivity. That means your provider should help you build a usable rule, for example that matters involving personal financial data, health information or sealed filings go through a secure portal rather than attachments, and then make the secure path the easy one. Security controls that staff route around are not controls.

5. Backup that has actually been restored

Ask when your last restore test ran and what it produced. A backup job showing green is a claim; a completed restore is evidence. For firms with a filing calendar, we recommend documented recovery objectives per system, with the document management platform and time and billing treated as tier one.

6. Vendor and subcontractor oversight

Model Rules 5.1 and 5.3 put supervision of storage vendors on the firm. Reg S-P puts service provider oversight on your advisory clients, who then push it to you. Practically, this means keeping a current inventory of every system holding client data, with an owner and a review date against each entry.

7. Secure AI, governed before it spreads

Staff at professional firms are already using AI tools, with or without a policy. The risk for a law or accounting practice is not AI itself, it is client-confidential text leaving the firm’s control and entering a public model. We deploy Hatz.AI for this reason: it gives a firm a private, governed environment where matter content stays inside the tenant and administrators can see what was used. Getting a governed option in place early is far easier than clawing back shadow usage later.

What This Looks Like in Frisco, Plano and Irving

The three markets behave differently, and a provider who cannot describe the difference probably does not serve them.

Frisco has grown a dense population of newer, fast-scaling practices, many of them spun out of larger Dallas firms and built cloud-first from day one. The typical engagement here is less about migrating legacy servers and more about imposing governance on an environment that grew quickly without it. DKBinnovative is headquartered in Frisco, which means our Managed IT Frisco engagements get on-site response measured in minutes rather than hours. For firms wanting the broader service view, our Managed IT Frisco page covers the full scope.

Plano holds the region’s heaviest concentration of established mid-sized professional firms, including a lot of practices with 20 to 40 years of history and the accumulated systems that implies. Work here often starts with untangling an on-premises file server that three generations of IT vendors have touched. Our Managed IT Plano team handles a high share of these consolidations, and our Managed IT Plano security practice covers the financial-firm side specifically.

Irving and Las Colinas is the market most often overlooked, and in our view the most interesting for professional firms. The Las Colinas corridor carries a corporate tenant base that produces a steady stream of outside counsel and audit relationships, which means firms there face enterprise-grade vendor security reviews earlier in their growth than firms elsewhere in the metroplex. Our Managed IT Irving practice operates from an office at 7301 State Hwy 161 in Las Colinas, and our Managed IT Irving security work leans heavily toward questionnaire readiness for exactly this reason.

IT Outsourcing for Professional and Financial Services Firms

IT outsourcing for professional and financial services firms differs from general business outsourcing in one respect: the provider inherits part of your regulatory obligation. Because ABA Model Rules 5.1 and 5.3 require supervision of storage vendors, and Reg S-P requires oversight of service providers, an outsourcing arrangement in these sectors is a compliance relationship, not just a support contract.

That reframes how you scope the engagement. The contract needs to say who retains data, who notifies whom on an incident, how quickly, and what evidence the provider will produce when your client or regulator asks. Firms that outsource on price alone tend to discover these gaps during the one week they cannot afford to.

In-House IT vs. a Specialized MSP for Professional Firms

The honest caveat: a strong internal IT manager who understands your practice is genuinely valuable, and replacing them with an outside vendor is usually a downgrade. The better pattern is to keep them and add the depth around them.

How to Evaluate a Provider in One Meeting

Five questions separate specialists from generalists quickly.

1. “Show me a client security questionnaire you completed in the last quarter.” Redacted is fine. If nothing exists, they have not been through the exercise.
2. “What is your documented process when a client mailbox is compromised during tax season?” Listen for containment sequencing and who notifies whom, not for product names.
3. “How would you apply a legal hold in our environment?” A specialist answers with a platform and a procedure. A generalist asks what a legal hold is.
4. “When did you last complete a restore test for a firm like ours, and what broke?” The second half is the real question. Everyone’s restores have surprises; only honest providers describe them.
5. “Who owns the documentation if we leave?” Firms that hold environment documentation hostage exist. Settle it before you sign.

For a fuller version of this exercise, see our criteria for choosing a secure managed IT provider.

Frequently Asked Questions

Does a small law firm really need a specialized IT provider?

Below roughly ten people, usually not. The obligations still apply, but a disciplined solo or small practice can meet them with good cloud hygiene. The case for a specialist strengthens once you add staff who are not partners, because supervision duties under Model Rules 5.1 and 5.3 become harder to discharge informally.

Are accounting firms legally required to have a written security plan?

Yes. Tax and accounting professionals are required under federal law to create and maintain a Written Information Security Plan. IRS Publications 4557 and 5708 are the practical references, and the plan should be reviewed and updated rather than written once and filed.

What happens if our firm suffers a breach?

For law firms, ABA Formal Opinion 483 governs the duty to notify current clients, triggered when material confidential information is compromised or the firm’s ability to perform the work is significantly impaired. For accounting firms, the WISP obligations include reporting an incident affecting 500 or more individuals within 30 days. State breach notification law may apply on top of both.

Can we keep our internal IT person and still use a managed provider?

Yes, and for firms with existing internal IT this is usually the better arrangement. A co-managed model keeps your internal knowledge in place while adding after-hours coverage, security operations and the compliance documentation work that a single person cannot sustain.

How long does onboarding take?

For a professional firm, expect 45 to 90 days from signature to steady state. Discovery and documentation take the first few weeks, security baseline work follows, and compliance artifacts like the WISP review and access reviews come once the environment is stable.

Working With DKBinnovative

We have supported professional firms across Dallas-Fort Worth since 2004, which is 22 years of watching what actually goes wrong in practices like yours. Today that includes 2,632+ end users across 55+ companies, a 78% first-call resolution rate, and 98.14% client satisfaction. Our infrastructure work standardizes on Microsoft Azure and Microsoft 365, and our secure AI deployments run on Hatz.AI so that client-confidential material stays inside your tenant.

If your firm is in Frisco, Plano or Irving and you are weighing a change, the most useful next step is usually the smallest one: let us map your current environment against the obligations that actually apply to your practice area, and tell you plainly where the gaps are.

Call (888) 352-4832 or book a review.

Related reading: Managed IT for Law Firms · Managed IT for Accounting & CPA Firms · Investment & Professional Firms · Financial Services IT

External references: IRS Publication 4557, IRS Publication 5708, 17 CFR Part 248 (Regulation S-P), NIST Cybersecurity Framework.

Reviewed by Peter Bertran, Chief Client Officer, DKBinnovative

Post-quantum readiness is usually filed under problems for later. For a law firm it is not, because attorney-client privilege has no expiry date and encrypted traffic can be copied today and opened in a decade.

Most technology risks have a shape professional firms recognize. Something happens, you respond, you notify, you recover. This one is different. The damage would be done years before anyone knows, and the decision that determines whether it happens to you is being made now, quietly, by whoever controls how your firm encrypts data in transit.

This is not a prediction about when a cryptographically relevant quantum computer arrives. Nobody credible will give you that date. It is about a much narrower question: how long does your firm’s confidential material need to stay confidential, and is that longer than the time remaining before today’s encryption stops holding?

For a great many law, CPA and investment firms in Dallas-Fort Worth, the honest answer is yes.

What Is Harvest Now, Decrypt Later?

Harvest now, decrypt later is an attack in which encrypted data is captured today and stored until quantum computing makes it decryptable. The attacker gains nothing at the moment of capture, so there is no breach to detect and nothing to notify. The exposure is realized years afterwards, which makes the risk a function of how long your data must stay secret rather than of how strong your encryption is today.

That reframing is the entire point. A firm asking “is our encryption strong enough?” is asking the wrong question. The right one is “how long does this need to hold, and will it?”

Why This Lands Differently on Professional Firms

General business data has a short secrecy half-life. A price list stolen today and decrypted in 2034 is worthless. Professional firms hold the opposite kind of material.

Law firms: privilege does not expire

Attorney-client privilege survives the matter, the relationship and in most circumstances the client’s death. A privileged communication intercepted in encrypted form this year and opened in 2033 is still privileged, and its disclosure is still a harm. ABA Formal Opinion 477R already requires lawyers to make judgments about securing client communications based on sensitivity, and Model Rule 1.1’s technology comment requires keeping current with the risks of relevant technology. Neither of those obligations has a carve-out for risks that mature slowly.

Investment firms: retention outlasts the encryption

SEC recordkeeping obligations keep advisory records for years, and the customer information covered by Regulation S-P does not become harmless with age. Account numbers, tax identifiers and financial histories retain their value to an attacker far longer than a normal breach window. We cover the current obligations in our piece on what Reg S-P now requires firms to evidence.

CPA firms: the data is permanent by nature

A Social Security number does not get reissued because it was disclosed late. Tax records, beneficial ownership details and multi-year financial histories are among the longest-lived sensitive data any small firm holds, and the WISP obligations under IRS Publication 4557 apply to protecting it for as long as you hold it.

When Do Firms Need to Be Post-Quantum Ready?

Firms need to be post-quantum ready before the sum of their data’s required secrecy lifetime and their migration time exceeds the time remaining until quantum decryption is feasible. NIST has published the schedule that anchors this: quantum-vulnerable algorithms are deprecated after 2030 and disallowed after 2035, and the NSA’s CNSA 2.0 requires national security systems to migrate by 2030. A firm holding data that must stay confidential for ten years is already inside the window.

That arithmetic is worth doing explicitly, because it produces a different answer for different firms.

This is why the generic advice aimed at small business, which amounts to wait and see, is wrong for professional firms specifically. The waiting is the exposure.

What Is Crypto-Agility, and Why Is It the Actual Deliverable?

Crypto-agility is the ability to change the cryptographic algorithms a system uses without rebuilding the system. It matters more than any individual algorithm choice, because the practical failure mode is not picking the wrong cipher. It is having encryption hard-coded into applications, appliances and integrations so deeply that changing it requires a project nobody has budgeted.

NIST published the first three post-quantum standards in 2024, including ML-KEM for key establishment and ML-DSA for digital signatures. Most firms will never touch those names. What they will experience is whether their vendors can turn the new algorithms on, and whether anyone at the firm knows which systems are waiting on which vendor.

What a Firm Should Actually Do This Year

None of this requires buying quantum anything. The useful work in 2026 is inventory and leverage.

1. Build a cryptographic inventory. Which systems hold or transmit data with a long secrecy lifetime, what protects it, and who supplies that protection. Most firms have never written this down, and it is the prerequisite for every later decision.
2. Classify by secrecy lifetime, not by sensitivity. These are different axes. A document can be moderately sensitive and need to stay secret for thirty years. That is the one that matters here.
3. Put the question to your vendors now. Ask your document management, practice management, portfolio accounting, email and VPN providers for their post-quantum roadmap in writing. You are not expecting a migration date. You are establishing that you asked, and finding out which vendors have no answer at all.
4. Prioritize data in transit. Harvest now, decrypt later is primarily an interception problem. Traffic crossing untrusted networks is the first thing to care about, ahead of data sitting on an encrypted disk in your office.
5. Fold it into what you already do. Add a post-quantum roadmap question to your vendor review cycle, and add long-lived data to your client security questionnaire evidence pack. This should cost you a meeting, not a project.
6. Write down the decision. Whatever you conclude, record that the firm considered it and why it chose the timeline it chose. For lawyers this is the technology-competence duty discharged in the only way that is provable later.

The NIST post-quantum cryptography project is the authoritative reference if someone at your firm wants the primary source, and the NIST Cybersecurity Framework gives you a structure to hang the inventory on.

What Not to Do

Three failure modes are already visible in how this topic gets sold.

• Buying a product to solve it. There is no post-quantum appliance that makes a firm ready. Readiness is an inventory and a vendor posture, and anyone selling otherwise is ahead of the evidence.
• Treating it as urgent. It is not urgent. It is early, which is a different thing and calls for a different budget. A firm that panics now will overspend on the wrong layer.
• Ignoring it because the date is uncertain. The uncertainty cuts the other way. Because nobody can tell you when, a firm holding thirty-year secrets cannot argue it had time.

Frisco, Plano and Irving

Plano firms tend to hold the deepest archives, because the region’s established practices have twenty to forty years of accumulated matter files and client records. Long-lived data is exactly the exposure this creates, and it is usually spread across systems nobody has catalogued. Our Managed IT Plano team handles these inventories, and our Managed IT Plano security practice covers the financial-firm side.

Irving and Las Colinas firms will meet this first through someone else’s questionnaire. The corridor’s corporate and institutional clients run mature vendor diligence, and post-quantum roadmap questions have started appearing in enterprise assessments. Our Managed IT Irving practice works from an office at 7301 State Hwy 161, and our Managed IT Irving team tracks what is showing up in those reviews.

Frisco firms have the easiest version of this problem and the shortest path through it. Cloud-native practices inherit their cryptography from a small number of major platforms, which means readiness is largely a matter of knowing which platforms and keeping current. DKBinnovative is headquartered in Frisco; our Managed IT Frisco and Managed IT Frisco teams cover this work.

Frequently Asked Questions

What is harvest now, decrypt later?

Harvest now, decrypt later is an attack in which encrypted data is captured today and stored until quantum computing makes it decryptable. There is no breach to detect at the time of capture, so the risk is a function of how long your data must stay secret rather than of how strong your encryption is today.

When do firms need to be post-quantum ready?

Before the sum of their data’s required secrecy lifetime and their migration time exceeds the time remaining until quantum decryption is feasible. NIST deprecates quantum-vulnerable algorithms after 2030 and disallows them after 2035, and NSA CNSA 2.0 requires national security systems to migrate by 2030. A firm holding data that must stay confidential for ten years is already inside the window.

What is crypto-agility?

Crypto-agility is the ability to change the cryptographic algorithms a system uses without rebuilding the system. It matters more than any individual algorithm choice, because the common failure is encryption hard-coded into applications and appliances so deeply that changing it becomes an unbudgeted project.

Is this urgent for a small law or accounting firm?

It is early rather than urgent, and the distinction matters for budgeting. But it applies earlier to professional firms than to general businesses, because privilege does not expire and tax identifiers are never reissued. The work due this year is inventory and vendor questions, not spending.

Do we need to buy anything to become post-quantum ready?

No. There is no product that confers readiness. What a firm needs is a cryptographic inventory, a classification of data by secrecy lifetime, and written post-quantum roadmaps from the vendors that supply its encryption.

Does this affect our compliance obligations today?

Not directly. No current rule requires post-quantum migration for private firms. Indirectly it reaches lawyers through the technology-competence duty and reaches every firm through client security questionnaires, where post-quantum roadmap questions have begun to appear in enterprise vendor assessments.

Working With DKBinnovative

We have supported professional firms across Dallas-Fort Worth since 2004, which is 22 years, currently covering 2,632+ end users across 55+ companies with a 78% first-call resolution rate and 98.14% client satisfaction. Our infrastructure standardizes on Microsoft Azure and Microsoft 365, both of which are moving on post-quantum work at platform level, which is a large part of why cloud-native firms have a shorter path here.

If you want to know where your firm’s long-lived data sits and which vendors have an answer, that is a cryptographic inventory and it takes us a few weeks. It is the only part of this that is worth doing right now.

Call (888) 352-4832 or book an assessment.

Related reading: Investment & Professional Firms · IT Support for Law & Accounting Firms · Managed IT for Law Firms · Managed IT for RIA Firms · Client Security Questionnaires

External references: NIST Post-Quantum Cryptography Project, NIST Cybersecurity Framework, 17 CFR Part 248, IRS Publication 4557.

By the DKBinnovative Crew | Published: September 2, 2026 | Reviewed by Peter Bertran, Chief Client Officer

What is IT budget planning?

IT budget planning is the process of deciding what your organization will spend on technology over the coming year and, more importantly, what that spending is meant to accomplish. A useful IT budget is not a list of renewals. It separates the cost of keeping current systems running from the cost of protecting them and the cost of supporting where the business is going — and it is built from a technology roadmap rather than from last year’s invoices.

Most firms start this work in September and October, which is the right instinct. Budget season is the one point in the year when technology decisions get made deliberately instead of under pressure.

Why Most IT Budgets Are Really Just Last Year Plus Inflation

The common approach is to pull last year’s spend, add a percentage, and submit it. It passes review, and it quietly guarantees three outcomes.

Nothing gets retired. Every tool renews because nobody had a reason to question it. Firms routinely discover they are paying for overlapping products nobody chose deliberately.

Growth is unfunded. Last year’s budget was built for last year’s headcount and last year’s footprint. If you are hiring, opening a location, or acquiring, none of that work has money attached to it — so it gets deferred until it becomes urgent, which is the most expensive moment to fund anything.

Security stays flat while exposure grows. More people, more devices, and more data mean more to protect. A security line that does not move while the business does is a real reduction.

A Three-Bucket Framework: Run, Protect, Grow

Separating spend into three categories makes the trade-offs visible, which is the entire point of budgeting.

Run is what keeps the business operating today: licensing, connectivity, support, hardware refresh, backup. This is your floor. It should be predictable, and if it is not, that is the first problem to solve.

Protect is what keeps the business defensible: security tooling, monitoring, identity management, awareness training, incident response readiness, and the evidence work that regulated firms need. It should scale with headcount and data, not stay fixed. The NIST Cybersecurity Framework is a practical reference for what belongs in this bucket.

Grow is what supports where the business is going: new locations, migrations, acquisitions, automation, and AI adoption. This is the bucket most firms never fund explicitly — and the reason growth work keeps getting done in emergency mode.

If you cannot say roughly how your spend splits across those three, the budget is a renewal list rather than a plan.

Why We Do Not Publish Budget Benchmarks

You will find articles offering a percentage of revenue you should spend on IT. We do not publish those numbers, because they mislead more often than they help.

A thirty-person RIA with examination obligations, a thirty-person construction firm with field connectivity needs, and a thirty-person software company have almost nothing in common in what their technology has to do. A benchmark built by averaging them describes none of them. What actually determines your number is regulatory exposure, how distributed your workforce is, the age of your infrastructure, and how fast you are growing. Those are questions to answer, not a percentage to copy.

Planning your 2027 technology budget? Talk to our team or call (888) 352-4832.

What Investment and Professional Firms Have to Budget That Generic Guides Miss

General IT budgeting advice assumes an unregulated business. For firms handling client money, client data, or privileged information, several line items are not optional and are routinely forgotten until an examiner or insurer asks.

• Evidence collection, not just controls. Having multifactor authentication is one thing; being able to demonstrate it operated continuously across the period under review is another. That reporting work is a budget line.
• Examination and audit support. For RIAs and wealth management firms, SEC Division of Examinations cycles consume real time. Budget for the support, not just the controls.
• Written program maintenance. A written information security program is not a one-time document. Reg S-P, the FTC Safeguards Rule, and IRS Publication 4557 all expect review and update cycles.
• Seasonal capacity. Accounting and CPA firms add seasonal staff who each need devices, accounts, and security configuration — then offboarding. That is a predictable annual cost most budgets treat as a surprise.
• Confidentiality architecture. For law firms, each new practice area can require ethical walls and document access design. It is project work, and it belongs in Grow.
• Cyber insurance requirements. Renewal questionnaires increasingly require specific controls, most of them mapping to baseline practices CISA recommends. Discovering a gap at renewal is worse and more expensive than budgeting for it now.

Build the Roadmap First, Then the Budget

A technology roadmap is a sequenced plan of what changes over the next one to three years and why. The budget is what that plan costs. Doing it in the other order produces a number without a rationale, which is the version that gets cut first when finance looks for savings.

A workable roadmap answers four things:

1. What is reaching end of life? Hardware, operating systems, and applications with known end-of-support dates. These are the least negotiable items and the easiest to forecast.
2. What does the business plan require? Headcount targets, new locations, acquisitions, new service lines. Each one has a technology cost, and it is cheaper when it is anticipated.
3. Where is risk concentrated? Single points of failure, unsupported systems, gaps a cyber insurer or examiner would flag.
4. What is not earning its keep? Overlapping tools, unused licenses, and services nobody has evaluated in three years.

This is the work a vCIO does. If nobody is producing a document like this for your firm, the budget is being assembled without one.

Questions to Answer Before You Finalize

• What are we retiring this year, and what does that free up?
• Which line items scale with headcount, and does our forecast reflect our hiring plan?
• What in this budget is growth work, and what happens to the plan if it gets cut?
• Which controls will our cyber insurer or regulator ask about at renewal or examination?
• What have we deferred two years running, and what is the cost of deferring it again?
• If we opened a second location in Q2, what in this budget would have to change?

Planning With a Partner Instead of Alone

DKBinnovative has supported businesses across Frisco, Plano, and Irving since 2004. We are a growth-minded IT partner for small and mid-sized firms, which means we plan technology around where the business is heading — new people, new offices, acquisitions — with security and compliance built into that plan rather than bolted on after something breaks.

In practice, budget season is when a dedicated vCIO earns their place: mapping end-of-life exposure, sequencing projects against your business plan, and producing a roadmap finance can actually evaluate. Behind that sit 46 engineers, a 24/7 in-house Security Operations Center, a 3-minute average first response, and 98.14% client satisfaction scored on every ticket.

If your current provider has not sat down with you to plan next year, that is worth noticing during budget season. Our guide on whether your MSP can scale with your business covers what to ask.

Frequently Asked Questions

What is IT budget planning?

IT budget planning is the process of deciding what an organization will spend on technology over the coming year and what that spending is meant to accomplish. A useful IT budget separates the cost of running current systems from the cost of protecting them and the cost of supporting growth, and it is built from a technology roadmap rather than from last year’s invoices.

When should we start IT budget planning?

Most organizations begin in September or October for a January fiscal year, which allows time to gather end-of-life data, get quotes, and sequence projects before approval deadlines. Starting later usually means submitting last year’s numbers with an increase applied, because there is no time to build a roadmap first.

What should an IT budget include?

Group spending into three categories. Run covers licensing, connectivity, support, hardware refresh, and backup. Protect covers security tooling, monitoring, identity management, awareness training, incident response readiness, and compliance evidence work. Grow covers new locations, migrations, acquisitions, automation, and AI adoption. Most firms fund the first two and never explicitly fund the third.

How much should a company spend on IT?

Benchmarks expressed as a percentage of revenue tend to mislead, because two organizations of identical size can have completely different requirements depending on regulatory exposure, how distributed the workforce is, infrastructure age, and growth rate. The more useful approach is to build a technology roadmap covering end-of-life systems, business plans, concentrated risk, and underused tools, then cost that plan.

What is the difference between an IT budget and a technology roadmap?

A technology roadmap is a sequenced plan of what changes over the next one to three years and why. The IT budget is what that plan costs. Building the budget first produces a number without a rationale, which is the version most likely to be cut when finance looks for savings.

What do regulated firms need to budget for that other businesses do not?

Evidence collection to demonstrate controls operated continuously, examination and audit support time, maintenance cycles for written information security programs under Reg S-P, the FTC Safeguards Rule, or IRS Publication 4557, seasonal staffing capacity for firms with busy seasons, confidentiality architecture such as ethical walls, and the specific controls cyber insurers require at renewal.