Get your free cup >>

1. fear of the unknown
2. fear of security
3. lack of control over data/systems
4. previous investments in technology
5. previous investments in people
6. lack of connectivity options
7. cost compared to current IT spend
8. contract rigidity
9. concern about the provider viability

I’ll be writing an article to tease these out in the coming weeks.  Stay tuned.

p.s.  I would love your comments on why you wouldn’t take your firm to the Cloud  (and of course, we welcome any comments on how).

As of March 1, 2010, Massachusetts-based firms and those who maintain records on its residents (regardless of the state they’re based in) will be required to meet increased information security standards that will force many firms into their next major wave of technology management investments. With the passing of this legislation, you can be certain that other states will follow closely behind.

Here’s the Readers Digest view of what you need to begin preparing for the following:

Duty to Protect
With many of our current security management activities being reactive in nature, we will soon be required to proactively ensure the safety and security of private information.

201 CMR 17.00 stipulates that we have a “Duty to protect” the following:

•    Personal information. (i.e. a  resident’s first name and last name or first initial and last name in combination with any one or more of the following data elements that relate to such resident: (a)  Social Security number; (b)  driver’s license number or state-issued identification card number; or (c)  financial account number, or credit or debit card number.)

•    Records. (i.e. written, drawn, spoken, visual, or electronic)

The firm must designate one or more employees to design, implement, and coordinate maintenance of a comprehensive written information security program.  This program consists of identifying and assessing internal and external risks to the security, confidentiality, and/or integrity of any electronic, paper or other records containing personal information.

This written plan must:
•    be managed by one or more employees
•    provide regularly scheduled employee training
•    actively monitor compliance
•    include properly upgraded and maintained systems (i.e. network, software, storage, etc.)
•    provide for locked facilities with monitored access
•    include telecommuting policies that address access and transport of private data
•    require third-party vendor access procedures and requirements
•    provide an inventory of all paper and electronic records, media, devices, etc.
•    include documented procedures for post-incident responsive actions

Computer System Security Requirements
“Every person that owns, licenses, stores or maintains personal information about a resident of the Commonwealth and electronically stores or transmits such information shall include in its written, comprehensive information security program the establishment and maintenance of a security system covering its computers, including any wireless system, that, at a minimum, shall have the following elements:”

•    complex passwords that contain greater than 7 characters and ideally include multiple special characters (such as: *!()$#@)
•    access enabled for only active accounts and automatic blocking after multiple failed attempts
•    restricted access to data based on job function requirements with disciplinary measures imposed for policy violations
•    128-bit (or higher) encryption of portable devices containing private data (USB drives, USB memory keys, corporately connected PDAs/smart phones, laptops, etc)
•    backup tapes must be encrypted; otherwise the use of armored guard or similar service is required
•    monitoring and access logging of networks and systems for unauthorized access
•    up-to-date patches and protection definitions on firewall(s), anti-virus, anti-spyware
•    restricted physical access to systems containing private information and written access procedures that log access by all parties

If you don’t currently shut the door to your server room, because “it gets too hot in there”, or the servers are located in a public area such as a hallway or copier/production room, compliance to this legislation will require that you either relocate the servers to a secure location, or retrofit the existing location with adequate security and cooling.  Most  servers have an internal self-protection function that automatically and forcibly shuts them down when they reach a certain temperature, so proper cooling will be an essential concern.

Unless you can accommodate the janitorial schedules, you’ll need to be comfortable with the ‘server room’ not being cleaned — since now your cleaning crew will need escorted access to the ‘server room’ by an authorized employee.

Pose these questions to your technology personnel:
•    Is our firewall updated to the most current patch release?
•    How many of our PCs and/or servers are running the latest security patches?
•    Are our PCs and servers running the most current security definitions for anti-virus and anti-spyware?
•    Is our wireless access encrypted using WPA2 or better?
•    Are our tape backups encrypted and stored offsite in a secure location?
•    Do our auditors store client data on USB sticks (or USB drives)? If so, are they encrypted?
•    Do we have a written security policy?

Should the responses you receive fall short of giving you confidence, it may be time to get a head start on 201 CMR 17.

If your firm is based in Massachusetts, you’ll be thankful to know that the original compliance deadline of January 1, 2010 has been extended until March 1, 2010.  Given that accounting firms have copious amounts of free time in the first quarter, the added grace will come in handy.  Wahoo!

For the complete text of the 201 CMR 17 law, go here.

Outsourcing taboo?

Mention “outsourcing” in the accounting community and the first thing that comes to mind is sending tax preparation to India. To some that is a good thought, yet many others have an immediate and negative reaction.

However, since the invention of fire… oh, and the abacus… CPAs, themselves, have successfully convinced businesses that outsourcing their accounting and tax compliance functions is a good thing:

“Take advantage of our experts.”
“We do this all day long.”
“We have the credentials.”
“It’s too risky to do it on your own.”

These are all good points, and I agree completely – hence I use an accountant, and thus my own company uses a CPA firm to do its taxes. We couldn’t possibly compete with our CPA’s experience and, most importantly, I couldn’t do my day-job if I tried.

The paper-based to Internet-based transition is a perfect example of outsourcing’s advantages. As with tax research, technologies of all kinds are following suit. It’s pervasive. Software is being web-enabled. Servers are being virtualized. Networks are moving to the cloud (see Jason Conger’s article Is Cloud Computing just a fancy name for Virtualization?). And the younger generations are thankful for it. They get it. They want it. And they don’t understand why we’re resistant to the change.

What is the cloud?

Firms today are moving toward the inevitable – the cloud – a model where technology help desk, hardware, software, and management can be completely outsourced. No more servers, fewer IT people, improved productivity and more time to focus on the business.

If India just popped into your mind, you can rest easy. Few, if any, US-based hosting providers are opting to offshore their IT talent, so we needn’t worry about our precious client data traversing the globe to lands far far away. Plus, learning about the provider’s operations is a straightforward piece of the due diligence process.

Remember when the “web” became the catchy new term for the up-and-coming Internet? Well the “cloud” lives on the web and it’s the new hip way to refer to a cornucopia of outsourced web-based technologies. The cloud is best defined as a “pay as you go computing web-infrastructure, leveraged for economies of scale.” You will often hear the cloud referred to as SaaS (Software-as-a-Service), PaaS (Platform-as-a-Service), and even IaaS (Infrastructure-as-a-Service). Wikipedia is a great resource for learning more about each.

What can be put in the cloud?

All of your software will eventually live in the cloud- tax, practice management, engagement/trial balance, document management, QuickBooks™/Peachtree™, the aforementioned tax research, Microsoft Office™ collaboration tools (email, shared calendars, tasks). Nearly everything will go into the cloud; it’s just a matter of time.

You’d be surprised how many firms have already moved there. Small firms with two employees, large firms with hundreds of employees and everything in between. Multi-office firms and firms who need remote access are especially good candidates because everything is securely accessible via the web… from the cloud.

What does this mean for all of us?

In short, all of our technology will eventually live in the cloud, and we will be better for it. This transition will allow us to focus on what we do best in our businesses, leaving the rest for people who focus, and are experts, on what we don’t care to do or are not good at. Technology is a cornerstone to most of our businesses in terms of success — we can’t live without it. But ask yourself why you started your business to begin with. If ‘technology management’ or ‘technology services’ isn’t core to your firm’s purpose and mission, then it likely falls squarely into the ‘headache’ category. Aside from the distractions related to doing technology well, there are inherent risks to consider. Security, reliability, performance, compatibility, redundancy, and obsolescence are just a few that come to mind.

As a profession, accounting firms can no longer be a pioneer on the outsourced technology/hosting front. The good news is that many firms have made the transition successfully and they’re asking themselves why they didn’t go there sooner. Their client data is far more secure in a SAS-70, type II data center than it ever was in their closet at the office. These firms now live in a world where they spend little, if any, time planning for technology upgrades or future IT expenditures, working on IT staffing issues or fretting over security concerns.

Just as in most successful transitions to outsourced services in the past, we are much better off after the change if we can just get ourselves to start the move in that direction. Of course, there’s always the alternative of walking uphill, in the snow, barefoot. Think fancy three-ringed binders on beautifully ornate book shelves.

By the way, has anyone seen the tax binder containing Revenue Code KGF 6386 Z9 C644 1979? It’s not where it should be!  Hello?

• Topical discussion forums (audit, tax, practice, technology, firm admin…)
• Blogs
• Wiki based best practices libraries
• Member to member communication
• Document repositories
• Events calendar
• Industry announcements

We need a less creative, more politically sensitive name for the community forums.  So we are turning to YOU for ideas.

A cool new Amazon Kindle will go to the person who comes up with the best name for the forum.

Submit your brilliant ideas to Tami Ezell (tezell@xcentric.com) by August 7, 2009.