IT Checklist for GTA Accounting Firms Before Tax Season
Tax season is when your firm is busiest, and when attackers know you're distracted. Staff are working late, logging in from home, juggling client portals, and moving a lot of personal and financial data. That's exactly when a weak backup, a missing MFA prompt, or a CRA-looking phishing email causes the most damage.
I'm Ali Jaffar, founder of Midas Tech in Richmond Hill. We've spent 15+ years supporting professional firms across the GTA. This checklist is the short list I walk accounting and CPA teams through before filing season ramps up. You don't need to do every item this week. Start with the ones that would hurt most if they failed on April 30.
1. Test your backups, don't just assume they work
Almost every firm tells me they have backups. The next question is the one that usually gets silence: when did you last restore a file, a mailbox, or a whole workstation?
Before tax season, pick a few real scenarios and run them. Restore a client folder. Restore a staff mailbox. Confirm you can get a laptop working again from backup. Write down how long each restore took. If the backup needs a password nobody remembers, or it lives on the same network as your live files, fix that now, not during an outage.
We keep backups in Canadian data centres and separate from day-to-day logins. The point isn't the product name. It's knowing you can get people working again when something goes wrong.
2. Enforce MFA on Microsoft 365 for everyone
Multi-factor authentication (MFA) means a password alone isn't enough. For accounting firms, turn it on for every Microsoft 365 account, including partners and seasonal staff. Don't "offer" it. Enforce it.
The Canadian Centre for Cyber Security recommends MFA on accounts that hold sensitive data. Client tax returns and banking details qualify.
Prefer an authenticator app over SMS where you can. Then add MFA to remote access, payroll, banking, and your practice management tools. Admin accounts first if you have to sequence it.
3. Brief the team on CRA-themed phishing
Every tax season, fake CRA emails and texts spike. They talk about refunds, notices of assessment, or account problems, and push people to click a link or send money.
The real CRA is clear about this. On its Recognize a scam page, the Agency says it will not ask for personal or financial information by email or voicemail, will not demand payment by Interac e-transfer, crypto, gift cards, or prepaid cards, and will not threaten arrest or deportation. Official CRA pages start with canada.ca or end in cra-arc.gc.ca. When in doubt, type the address yourself.
Tell staff: don't click the link, don't open the attachment, and report it. Give them a simple internal channel so they aren't guessing what to do.
4. Patch Windows, browsers, and tax software now
Attackers don't need a brand-new exploit when last month's update is still sitting uninstalled. Patch Windows and macOS, browsers, PDF tools, firewalls, and your tax and practice software before peak filing weeks.
If patching still depends on someone remembering to click Update, it'll slip during busy season. Automating updates, and tracking which machines are behind, saves a lot of late-night firefighting.
5. Lock down remote access before people work from home
Tax season means more evening and weekend work from home. That's fine. Open remote desktop or file sharing straight to the internet is not.
Use a proper VPN or a modern secure remote access setup. Require MFA on it. Disable unused remote accounts. Remove access the same day someone leaves, including contractors and seasonal tax preparers. The Canadian Centre for Cyber Security's baseline controls for small and medium organizations covers guest networks, remote access, and keeping admin rights tight. Those basics matter more when half the firm is dialling in after dinner.
6. Treat laptops like the office, because they are
Laptops leave the building with client data on them. Full-disk encryption should be on. Auto-lock after a short idle time. Local admin rights off for day-to-day work. Endpoint security installed and updating.
If someone loses a laptop in a rideshare or at the airport, encryption and a remote wipe option are the difference between an inconvenience and a privacy incident.
7. Tighten e-filing and client portal access
EFILE credentials, Represent a Client, and client portals are high-value targets. Use unique passwords, MFA where available, and sign out after each session. The CRA's own EFILE program updates keep pushing strong passwords, monitoring, and careful session habits for a reason.
Limit who can file. Don't share one EFILE login across the whole office. Review portal permissions before the rush: seasonal staff should only see what they need, and access should end when their contract does.
The CRA has also warned that threat actors ramp up attempts to access taxpayer accounts during tax season. Their tax tip on keeping information safe is worth a five-minute read with your team.
8. Know who answers the phone after 5:30
Our regular hours are Monday to Friday, 8:30 a.m. to 5:30 p.m. Tax season problems don't respect that. A ransomware note at 9 p.m., a partner locked out of Microsoft 365 on Saturday, or a phishing click right before a filing deadline needs a clear after-hours path.
Confirm with your IT provider what after-hours support actually covers, how to reach someone, and what the first steps are if email or a server is down. We provide after-hours support and a 24×7 SOC watching the cybersecurity stack, including dark web monitoring for firm email addresses that show up in known leaks. Whatever you use, write the contact path down where partners can find it without digging through old emails.
One night a lawyer's email account was compromised. We cut off the access, cleaned the account, and restored from cloud backup in about an hour and a half. The firms that recover fast already had backups working and a number to call. The ones that struggle usually discover both gaps at the worst moment.
9. Remember PIPEDA while you're racing deadlines
Accounting firms hold sensitive personal and financial information. Under PIPEDA, you need safeguards appropriate to that sensitivity. The Office of the Privacy Commissioner of Canada spells this out in Principle 7 – Safeguards: protect against loss, theft, and unauthorized access, and use a mix of physical, organizational, and technological controls. Passwords, encryption, patches, staff training, and need-to-know access aren't optional extras. They're part of how you meet that obligation.
If something does go wrong, some breaches must be reported. Know who decides, and don't wait until you're in the middle of it to figure out the process.
A practical order for the next two weeks
If time is short, do this sequence:
- Enforce MFA on Microsoft 365.
- Run one real restore test.
- Brief staff on CRA phishing.
- Patch everything, including tax software.
- Confirm remote access and after-hours contacts.
That covers a lot of the risk without boiling the ocean.
Need a second set of eyes before filing season?
If you want a quick pass over your setup, get in touch. We're based in Richmond Hill and support accounting firms across the GTA. Managed IT plans start at $109, $149, and $199 per user, depending on what you need. You can also read more about local support on our IT Support Richmond Hill page, or call 905-787-2038.