Written information security plan and a cyber-insurance renewal passed at a tax and accounting firm
An accounting and tax firm of about 35 people, a leader in its segment.
- Scale
- 1 written plan, 1 Microsoft 365 tenant, ~35 users, 41 laptops, 1 renewal questionnaire of 62 questions
- Engagement
- 6 weeks from kickoff to renewal, ahead of the busy season
The challenge
The firm handles Social Security numbers and bank details for hundreds of households and small businesses. Its insurer sent a renewal questionnaire that asked for multi-factor authentication on all email, endpoint detection, tested backups and a written security program, and the partners had none of the last three on paper. A wrong answer risked a higher premium or a declined renewal, and nobody at the firm owned the plan the FTC Safeguards Rule expects.
What our team delivered
- Gap review against the questionnaire and the IRS Publication 4557 checklist, with a one-page list of what was true, partly true and missing
- A written information security plan built from the IRS template and tailored to the firm: a named qualified individual, a risk assessment, access rules, an incident response plan, vendor oversight and a yearly review date
- Phishing-resistant multi-factor authentication for partners and admins, authenticator-based sign-in for everyone else, and legacy authentication blocked
- Endpoint detection and response on all 41 laptops, disk encryption verified, and a patch cadence with a measured time to patch
- Backups with a copy the firm's own accounts cannot delete, and a restore test of the client file share with the result written down
- An evidence pack for the insurer: screenshots, policy exports and dated test results mapped one to one to each questionnaire answer, plus a short training record for all staff
Result
Every answer on the 62‑question renewal was backed by a document, the renewal went through without a follow-up round, and the firm now has a plan its partners can explain to a client or an auditor. Median time to patch fell from 19 days to 6. The plan is reviewed on a set date each year. This is an illustrative engagement that describes the kind of work our team does; details are composite.
Get this for your company
Related services with fixed prices and a written scope.
Emergency package: security engineer in 1 hour
Is your company in a cybersecurity crisis? Purchase this package and a security engineer will call you within 1 hour.
Callback within 1 hour, 24 hours a day, 365 days a year
$1,950 per incident
Initial assessment of public endpoints
What an attacker can see and reach from the internet: your domains, mail, websites, remote access and cloud exposure.
Report within 5 business days of kickoff
$1,000 per assessment
Insurance-ready bundle
The three things cyber insurers and clients ask for most: an external assessment, a phishing simulation for 25 users and a disaster recovery plan.
Assessment report in 5 business days; plan draft in 15 business days
$5,400 per bundle, phishing simulation for 25 users
Show 3 more
Managed IT and security (MSP)
One monthly price per team member: help desk, device management, patching, backup monitoring and security basics.
Onboarding starts within 10 business days
$100 per team member, per month
Phishing simulation
A realistic, authorized phishing campaign with short training for anyone who clicks. Priced per person.
Campaign launches within 5 business days of approval
$12 per user, per campaign
Managed security monitoring
Endpoint detection and response watched by our analysts, priced per device.
Agents deployed within 7 business days
$18 per endpoint, per month
After you purchase, we contact you within 1 hour, any time of day or night, to start onboarding.
No payment is taken online. When we call you within the hour we confirm the scope and send an invoice (ACH, card or crypto).
The evidence pack and who asks for what
Twelve artefacts a firm can show about its AI use, and the party that most often asks for each: an insurer at renewal, an auditor or client questionnaire, or a regulator. A typical pattern only; the exact list depends on the policy, framework and sector.
Every sign-in, verified
Staff sign in once, but behind the scenes the device, the identity, a phone approval and your access policy are all checked before any app opens, and strangers are turned away.
Critical patches in days, not months
Distribution of days from vendor patch release to deployment for critical-severity CVEs, before and after a managed patching service. The dashed line marks two weeks: under CISA BOD 22-01, US federal agencies must remediate Known Exploited Vulnerabilities within two weeks for CVEs assigned in 2021 or later (six months for older ones). Private organisations are not bound by it, but it is a sensible benchmark. Illustrative figures.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.