IT Security Checklists for Law Firms, CPAs, and Medical Offices

Three short checklists for the offices we support most. Each fits on a page, uses plain English, and links to the source behind it. Work through one with your office manager, mark what you have, and fix the gaps from the top down.

These are technical IT checklists, not legal or compliance advice. Your attorney, CPA, or compliance lead decides what your rules require.

Law firm checklist: backups and wire fraud
CPA checklist: FTC Safeguards Rule
Medical office checklist: MFA

Law firm checklist: backups and wire fraud

Ransomware and payment fraud are the two events most likely to stop a firm cold. The FBI’s Internet Crime Complaint Center logged 24,768 business email compromise complaints in 2025, with reported losses over $3 billion. CISA warns that ransomware crews look for backups and try to destroy them first.

Three copies, one off-site, one that can’t be changed. Keep a local backup for fast restores and a cloud copy that cannot be deleted or encrypted from a compromised account.
A dated restore test. Restore a real matter folder and a mailbox at least once a quarter, and write down the date and how long it took.
Backups of the cloud, too. Microsoft 365, Clio, and other platforms are not a backup of themselves. Know what each vendor keeps and for how long.
MFA on every account. Email, remote access, practice software, banking, and the backup console itself.
Alerts on mailbox rule changes. Attackers often add a hidden rule that forwards or deletes client email. Turn on alerts for new forwarding rules.
A call-back rule for payment changes. Any change to wiring instructions is confirmed by phone, using a number already on file, never one in the email.
Outside-sender tags and look-alike domain checks. Make it obvious when “opposing counsel” is really writing from a near-copy of their domain.
Separate admin accounts. Nobody does daily work from an account that can change security settings.
A written breach plan. Who to call, what to unplug, what to preserve. California’s breach notice law is Civil Code 1798.82; your attorney advises on notice.

See our full 15-point law firm IT risk checklist and law firm backup and ransomware recovery.

Sources: FBI IC3 annual reports; CISA #StopRansomware Guide

CPA checklist: FTC Safeguards Rule

Tax preparers and accounting firms are covered by the FTC Safeguards Rule, 16 CFR Part 314. IRS Publication 4557 explains the basics, and Publication 5708 gives a sample written information security plan (WISP).

A named Qualified Individual. One person oversees the security program. It can be someone at a service provider, but the firm stays responsible.
A written risk assessment. List what customer data you hold, where it lives, and what could go wrong.
MFA for anyone who reaches customer data. Email, tax software, portals, remote access, and cloud storage.
Encryption at rest and in transit. Encrypted laptops, servers, backups, and secure file exchange instead of email attachments.
Access by need. Seasonal staff get only what they need and lose it the day they leave.
Activity logging. Keep sign-in and file-access logs long enough to investigate a problem.
Testing. Continuous monitoring, or a penetration test every year and a vulnerability scan at least every six months.
A written incident response plan. Roles, steps, and who talks to clients and regulators.
FTC notice for larger breaches. Since May 2024, an event involving 500 or more consumers must be reported to the FTC within 30 days of discovery.
Secure disposal. Generally delete customer data within two years of last use unless you need to keep it.

Firms with data on fewer than 5,000 consumers are exempt from a few items, including the written risk assessment, testing, the written incident plan, and the annual report, but not from MFA or encryption. See FTC Safeguards Rule compliance help and IT support for accounting firms.

Sources: 16 CFR 314.4 (eCFR via Cornell LII); 16 CFR 314.6 exceptions; IRS Publication 4557; IRS Publication 5708

Medical office checklist: MFA

A Microsoft study of Azure AD accounts found MFA cut the risk of account compromise by 99.22%. HHS proposed in January 2025 to make MFA a HIPAA Security Rule requirement. That rule is not final, but MFA is worth doing now.

Start with email. Require MFA for every active user’s Microsoft 365 or Google account first. Block direct sign-in to Microsoft 365 shared mailboxes so staff open them through their own accounts, use delegation or a Google Group instead of a shared login in Google Workspace, and disable former employees’ accounts and sign them out of every session.
Then the EHR and practice software. Use the vendor’s MFA or single sign-on through Microsoft.
Remote access and VPN. Nobody reaches the office network from outside without a second factor.
Phone approvals, not text codes. App-based approvals are faster at the front desk and harder to intercept.
Unique logins on shared stations. No shared front-desk password. Use fast user switching so check-in stays quick.
Admin accounts get stronger MFA. Use security keys or phishing-resistant methods for anyone who can change settings.
Block legacy sign-in. Old email protocols bypass MFA. Turn them off.
Plan for lost phones. Write down how staff regain access, and make sure it requires checking who they are.
Write it down. Record where MFA is on and any exceptions, for your risk analysis.