# CPA Security

> Automated Written Information Security Plan (WISP) generation and FTC Safeguards §314.4(e) cybersecurity awareness training platform engineered specifically for Certified Public Accountants (CPAs), tax preparers, and accounting firms. Partnered with Call Center Options (ccoptions.net).

## Core Information
- **Website:** https://cpa-security.com
- **Partner Organization:** Call Center Options, LLC (https://www.ccoptions.net)
- **Compliance Desk Phone:** (904) 586-1977 | tel:+19045861977
- **Support & Compliance Email:** support@cpa-security.com
- **Operating Jurisdiction:** United States Federal (IRS & FTC regulations nationwide)

## Regulatory Mandates Addressed
1. **FTC Safeguards Rule (16 CFR Part 314):**
   - Applies to all non-banking financial institutions, explicitly including professional tax preparers and accountants.
   - Statutory penalties for non-compliance reach up to $53,088 per violation under 15 U.S.C. § 45 (16 CFR § 1.98).
   - Mandatory Controls: Designated Qualified Individual, comprehensive risk assessment, multi-factor authentication (MFA), data encryption in transit and at rest, employee cybersecurity training (§314.4(e)), third-party service provider oversight, annual WISP evaluations, and written 30-day Incident Response Plan (IRP).
2. **IRS Publication 4557 ("Safeguarding Taxpayer Data"):**
   - Mandates that all authorized e-file providers maintain a written information security plan (WISP).
   - Non-compliance risks immediate revocation of Electronic Filing Identification Numbers (EFIN) and Preparer Tax Identification Numbers (PTIN), halting tax preparation operations.
   - Enforces the IRS "Security Six": Antivirus software, firewalls, two-factor authentication, backup software, drive encryption, and virtual private networks (VPNs).

## Subscription Pricing Tiers & Accountants' Math
- **Tier 1: WISP Essentials ($249/year):**
  - Automated WISP generation wizard built on IRS Pub 4557 and the FTC Safeguards Rule.
  - Incident response procedures, third-party vendor logs, and audit-ready PDF export vault.
  - Includes 1 solo practitioner / coordinator seat.
- **Tier 2: Compliance Plus ($449/year) [Recommended]:**
  - Everything in Essentials, plus:
  - 5 CPA-specific interactive employee training modules (phishing recognition, wire fraud prevention, password/MFA hygiene, physical security, incident response).
  - 10 staff seats included free. Additional seats beyond 10 are +$15/seat/year.
  - Passwordless employee training portals with unique 32-character tokens.
  - E-SIGN Act digital signature capture generating timestamped SHA-256 hashes recorded in official Appendix C: Staff Training Log.
- **Tier 3: Full Shield & Managed Defense ($999/year) [Managed Security Service]:**
  - Everything in Compliance Plus, plus:
  - Managed Security Service: our security engineering team coordinates quarterly simulated spear-phishing campaigns and delivers executive audit reports directly to the firm.
  - Office Perimeter Scan: checks the subscriber's own office internet connection (after consent) for exposed services such as Remote Desktop and file sharing. Included in Full Shield; $150/yr add-on otherwise.
- **Free Email Security Check (no account needed):** https://cpa-security.com/email-check checks a firm's SPF, DKIM and DMARC settings and how one real test email arrives, with free fix guides at https://cpa-security.com/email-security-guide.
- **Add-Ons & Hardware Sensors:**
  - **Hardware Network Sensor (coming soon, not yet for sale):** a small device for the office network that will check computers and devices inside it for known weaknesses.
  - **White-Glove Policy Review ($499 one-time):** 1-on-1 consultation call with a CPA Security compliance specialist to review your WISP and policies.
- **VIP White-Glove Onboarding for Orders $1,000+:**
  - Orders totaling $1,000 or more automatically unlock dedicated 1-on-1 setup consultation with a senior security specialist, priority partner escalation, and QuickBooks Net-15 Invoice payment options alongside credit card and ACH direct debit (capped $5 fee).

## Discoverable Tools & Endpoints
- [Professional Compliance Insights](https://cpa-security.com/insights): Authoritative legal, IRS Pub 4557, FTC Safeguards, and cyber insurance research articles for accounting firms. Supports `Accept: text/markdown`.
- [Sitemap](https://cpa-security.com/sitemap.xml): Machine-readable XML map of public resources.
- [Full Context Documentation](https://cpa-security.com/llms-full.txt): Comprehensive technical and regulatory brief.
- [API Catalog](https://cpa-security.com/.well-known/api-catalog): OpenAPI specification for public endpoints.
- [AI Authentication Guide](https://cpa-security.com/.well-known/auth.md): Authentication specifications for agents and automated clients.
- [Agent Card](https://cpa-security.com/.well-known/agent.json): A2A Agent-to-Agent declaration card.
- [Skills Index](https://cpa-security.com/.well-known/skills.json): Discoverable capabilities for AI assistants.
- [MCP Manifest](https://cpa-security.com/.well-known/mcp.json): Model Context Protocol server tools schema.