Before Filing Season: A Security Training Plan for Tax Firm Staff (2026)
A pre-season security training plan for tax firm staff: what the FTC Safeguards Rule and IRS Publication 5708 expect, why seasonal hires are the gap, and a six-week plan.
SMB
Your IT Company Fixes the Systems. Who Handles the Breach?
A small business data breach response usually starts with one phone call: “Get our IT company on the line.” That is the right first call. It is also where many firms stop planning. Your IT provider can work on the systems. Someone at your firm still has to decide who gets told, what they hear, and when. Last Updated: November 2026 This small business post-breach playbook is for owners, principals, and operations leads at firms with no full-time security leader. That includes independent insurance agencies, tax and accounting firms, and mortgage brokers and lenders. It separates the work IT does from the work that stays with your firm. It also gives you the questions to ask your provider before you need the answers. Key takeaways Your IT company is the right owner for containment, evidence, and recovery of your systems. Reporting decisions, regulators, clients, employees, and records usually stay with […]
Finally Protected: Why We Rebuilt defend-id for Small Businesses
The email comes in on a Tuesday. A carrier, a client, or a lender wants to know how your firm protects their data. Do you train your staff? Who reviews your vendors? What happens if you get breached? Nobody at your firm owns security, so the questions land on the owner or the office manager, on top of everything else they already do. Small firms live this every week. Big companies hand it to a security team. That difference is why defend-id exists, and it is why we rebuilt it. Last Updated: October 2026 Why we started defend-id defend-id started with something personal. About ten years ago, my own identity was stolen. The hardest part was not knowing what to do or who to call, and figuring it out took time I did not have. Underneath it all was a worse question: had my wife’s information been taken too? My […]
Tax Firm Data Breach Response Plan: Who Calls Whom Before Filing Season
The first sign usually shows up in January. A client calls to ask why the IRS rejected a return the firm hasn’t filed yet. Another client gets a refund for a return they never signed. By then, the question is no longer whether the firm was breached. The question is who makes the next call, and whether anyone wrote that down. A tax firm data breach response plan answers that question before filing season, while there is still time to think. Last Updated: October 2026 This guide is for owners, managing partners, and office managers at tax and accounting firms with no full-time security lead. It covers what federal guidance expects and who to notify, in what order. It also covers the warning signs that mean you are already in the plan, and how to turn the plan into routine work. Key takeaways In October 2026, the IRS restated that […]
Q3 2026 Results: defend-id’s Recovery Advocates Cut Abandon Rate to 2.2%
When an employee calls to say their identity was stolen, or a phished mailbox exposes staff records, the first question is simple: who picks up the phone? For a 30-person firm with no security team, that answer is part of the incident plan whether anyone wrote it down or not. defend-id publishes the service numbers of our identity theft recovery advocates every quarter so owners and operations leads can check the answer instead of taking our word for it. Last Updated: October 2026 Q3 2026 Snapshot: Every Service Goal Met Metric Q3 2026 Q2 2026 Goal Abandon Rate 2.2% 3.0% 3% max Average Speed to Answer 0:15 0:15 0:20 max Calls Answered in 20 Seconds or Less 83.5% 82.6% 80% min Abandon rate fell from 3.0% in Q2 to 2.2% in Q3, a full 0.8 points under our ceiling. Average speed to answer held at 15 seconds, five seconds better […]
Mortgage Wire Fraud Prevention: A Control Plan for Brokers and Lenders (2026)
Mortgage wire fraud prevention usually gets treated as the title company’s job. The title company holds the escrow account, so the title company should worry about the wire. That logic breaks the moment a criminal gets into a loan officer’s mailbox. From there, they can see the closing date, the borrower’s name, the cash-to-close figure, and the tone your team uses with clients. Then they send the borrower “updated” wire instructions that look like they came from you. Last Updated: October 2026 This guide is for owners, operations managers, and compliance leads at mortgage brokerages and independent lenders with roughly 10 to 150 employees. It covers what the numbers show, what the FTC Safeguards Rule may expect of your shop, and a mortgage wire fraud prevention plan your team can run without a full-time security hire. Why mortgage wire fraud prevention starts with your shop The FBI’s Internet Crime Complaint […]
Cybersecurity Awareness Month 2026: A Four-Week Plan for Firms Without a Security Team
Cybersecurity Awareness Month for small business has always had a mismatch. The campaign’s advice assumes someone on staff owns security. At a 30-person tax firm, insurance agency, or mortgage shop, nobody does. Last Updated: September 2026 Key takeaways Train staff in week one with a live, 30-minute session on the attacks your industry actually sees, and record who attended. Review every vendor that holds client data in week two, including its breach notice terms and whether MFA is enforced. Scan for vulnerabilities in week three, give each fix an owner and a date, and test one backup restore. Rehearse the first hour of an incident in week four with a 45-minute tabletop and a one-page contact sheet. Finally, keep the records. By November 1, that evidence is what clients, carriers, and examiners ask to see. However, that does not make the month useless. It changes what the month is for. […]
The 72-Hour Clock: An Incident Response Plan for Independent Insurance Agencies
An insurance agency incident response plan gets written in one of two moments. Some agencies write it on a quiet afternoon, with time to think. Others write it in the first hour of a cybersecurity event, while a producer’s mailbox sends fake invoices to clients. The second version costs far more, and it starts a legal clock the agency may not know about. Last Updated: September 2026 Here is how that hour usually looks at a 25-person agency. A client calls to ask why your office emailed new wire instructions. Nobody sent them. The account manager assumes it is spam. The owner is at a carrier meeting. By the time anyone asks who is in charge, half a day is gone. Under the insurance data security law in many states, that half day may count against a 72-hour deadline to notify the insurance commissioner. This guide covers what that deadline […]
Business Data Protection Practices: Six Pillars Every Company Needs in 2026
Data breach notification requirements for small businesses changed in more states than most owners realize this year. California shortened its notice deadline to a hard 30 days. Oklahoma expanded what counts as reportable data and attached six-figure penalties to businesses that cannot show they had reasonable safeguards in place. Virtually every small business handles customer or employee data. If yours does, the rules you followed in 2025 are already out of date. Last Updated: September 2026 Most small business owners think of a data breach as an IT problem. It is also a legal deadline, and in 2026 that deadline got shorter, stricter, and more expensive to miss. The businesses least prepared for that shift are not the ones getting breached. They are the ones who get breached and then find out, in the middle of the worst week of their year, that they had 30 days to notify customers. […]
