Posts

An accounting firm considering to accept cloud technology.

Why CPA’s Need Cloud Services To Survive

/in /by

Cloud Services For Accountants is More Important Than Ever

As a CPA firm you’re going to have to adjust to this new remote reality. No one expected the lock-down, however, firms operating on the cloud had an advantage over those who hadn’t yet or only did so partially.

Many accounting firms learned to understand how the right technology could help them access and review financial information, create reports, manage accounts and more.

There is no telling how or when businesses will open up. Moreover, reopening A CPA firm to its full capacity requires much more than opening the doors, turning the lights on and wiping off the dust from your desk.

It is a gradual process that requires much planning and the transition itself depends on many factors.

That is why cloud technology has become so pivotal in the last few months. The lock-down put many accounting systems to the test, forcing everyone from individual practitioners to larger firms to operate continually outside of the office.

Firms that migrated to the cloud prior to the lock-down are doing well. Their client data secured in a data center and their applications on a cloud network ready to use. The Accounting industry has been discussing the impacts that would occur as a result of the cloud. Now, it’s no longer a theoretical discussion.

Experts predict cloud accounting to be a permanent feature of any CPA firm. Firms that didn’t migrate to the cloud previously might be asking if it’s too late for them. The answer is a definitive no.

Video Conferencing

Firms that use Microsoft 365 might be familiar with Teams. Teams is one of the many video conferencing applications firms are using to communicate while working remotely.  There are also applications like Zoom, Google hang outs, and Skype. These video tools facilitate collaboration and, with the right cloud service provider, can create an effective remote environment.

Financial services experts and CPA’s are discussing the possibility of permanent remote advising. Remote advisory services was always the direction technology was heading in. However, the lock-down that preceded the COVID-19 pandemic only sped this transition.

These remote services will only be afforded to firms willing to migrate and adopt the virtual tools necessary to perform these roles efficiently.  That means finding a managed services provider with cloud hosting capabilities that are designed to meet your firm’s needs.

 Remote Advising Through The Cloud

Remote advising is the future of the financial services industry. Technology was already in the processes of changing the role of CPA’s towards more advisory positions. With software automating much of the compliance work once handled by an accountant or bookkeeper.

James C. Bourke, a CPA and accountancy technology expert, predicts that if CPA’s are not spending on technology solutions that are accessible remotely, they will be revisited.

“Priorities are going to change on technology spending, once we are all back in the office,” he said in a recent podcast.

Migrating  Your Firm to The Cloud

Can you migrate mission critical applications to the cloud now? Specifically can you migrate Document, tax, engagement, and practice management to the cloud?

According to Bourke, currently, migrating to the cloud will be difficult but CPA’s should do everything they can to prepare themselves for a cloud migration when we return to normalcy.

That requires firms to research the best cloud providers, checking to see if they have the right security and compliance tools to provide your firm with the proper IT support without failing to meet regulation standards.

Technology disruption and the shifting to more advisory services are creating a professional environment where accountants must offer more valued and diverse skill sets.  However, this also means shifting focus to the client’s specific needs and away from other aspects of your practice like software, cyber security and IT services.

Leveraging the Cloud

If you plan on working as a trusted advisor you need to understand the implications of these shifts and what these tools mean for your firm. It’s not only adopting a cloud solution but adopting one that has the services that benefit your firm the most. Migrating to the cloud is like purchasing a car. Just because it has four wheels and an engine doesn’t mean it will be the vehicle you.

There are many types of cloud providers and every cloud provider has different assets, strengths and weaknesses. There are public, private and hybrid cloud. Different cloud companies like Azure have cloud services but require you to pay an extra fee for support services. Nerds Support’s accounting cloud services utilizes software that complies with SOX and FINRA standards, for example.

Other cloud providers like AWS are public clouds with thousands of clients. Their service would be less personal and contacting support is difficult.

Cloud Accounting is The Future

A Survey The New Jersey Society of CPAs, revealed that 40 percent of participants expected a decrease in revenue as a result of the COVID-19 pandemic. The development of cloud technology and remote services will work to mitigate revenue loss once properly implemented.

The abrupt switch from in-person accounting services to remote focused work was jarring. Firms were unprepared for the demands of a remote work environment. However, now that industries, not just Accounting, have seen the results of a shut-in, firms will work to eliminate this vulnerability by revisiting cloud technologies and focusing on remote tools.

Managed Service Providers expect an increase in demand for public cloud services. Specifically, a an increase in SaaS, industry- focused apps. These include collaboration and other productivity and business continuity tools.

The social shift towards online platforms (VOD, social media platform, and cloud gaming) shift focus towards cloud infrastructure automation/management software.

In other words, cloud environment reliability, optimizing online platforms and the performance of your infrastructure determine the success of your firm in the future. Clients now and in the future will require and request online services.

Make sure your firm stays protected and ready for this new shift.

Cyber criminal breaching federal emergency loan site for access to money.

8,000 Emergency Loan Applicants Affected by Data Breach

/in /by

The SBA Was Breached

8,000 small business owners who applied for loans from the Small Business Administration potentially had their personal information exposed last month, admits the agency.

The Economic Injury Disaster Loan program (EIDL) offers up to $10,000 to owners currently struggling with their businesses due to the COVID-19 pandemic.

Who Is Affected?

The breach affects people who applied for the EIDL. Traditionally, it was used to aid owner whose businesses were impacted by tornadoes, hurricanes and other natural disasters. Congress expanded it in the $2.2 trillion CARES Act.

Notification letters were sent to 7,913 applicants possibly impacted by the breach and then the letters were posted online. The letters revealed that personal data could have been exposed to other applicants. This data included phone numbers, addresses, dates of birth, income and financial information, and social security numbers.

What’s In the Loan Program?

The Economic Injury Disaster Loan program (EIDL) offers up to $10,000 to owners currently struggling with their businesses due to the novel coronavirus pandemic.

A Trump administration official described the issue to CNBC saying that an error occurred when some owners would hit the back button on a page they would see the information of someone else’s businesses rather than their own.

How Did The SBA Find Out?

According to reports by the Washington Post, the SBA was initially silent on the duration of the breach or about details of its discovery. Businesses that may have been affected were notified by the SBA and offered one free year of credit monitoring.

The Agency said it discovered the vulnerability on March 25 and notified those affected with letters. A copy of the letter was posted by a victim after the breach. The letter itself mentioned that there is no sign of data misuse as of last week.

What’s The SBA’s Track Record?

Business owners have had issues with the disaster loan website before. The site was taken down for maintenance for several hours on March 16, and owners could not apply during that time. On March 29, the SBA revised its application process for the disaster loans and owners had to reapply. Many learned days or weeks later that they needed to reapply.

Business owners experienced issues with the loan website previously. In fact, the site was taken down for maintenance for hours on March 16. This meant owners couldn’t apply for a loan in that time. About two weeks later on March 29, the SBA updated the application process for the loans and owners were required to reapply.

How Much Money Was Allocated?

As of April 19, SBA had approved almost 27,000 EIDL loans valued at $5.6 billion. Another 755,000 businesses received EIDL grants worth a total of $3.3 billion. The Trump administration official told CNBC that 4 million business owners had applied for assistance worth $383 billion—far more than the $17 billion allocated for the program.

Even before the breach the agency website was strained by a flood of applications for the loan that overburdened funding, keeping businesses waiting for weeks to receive money.

Before the COVID-19 crisis small businesses should have been eligible for up to $2 million in disaster loans. Unfortunately, because millions of companies are now seeking assistance,  the SBA had to limit the loans to the previously mentioned $10,000

What are the Risks Now That There Was a Breach?

That being said, the SBA approved nearly 27,000 EIDL loans since April 19. However, the breach raises a problem for anyone looking to exploit personal information on the website for social engineering scams. IBM Securities published research revealing it had seen a 6000% increase in email campaigns impersonating the SMB.

For more information on cyber security, cloud, remote work and more, visit Nerds Support’s blog.

 

Os33 Workplace cloud complies with FINRA, SOX, SOX11

Compliance on the Cloud 101

/in /by

What is Compliance?

Compliance when dealing with cloud computing can be an issue for those using cloud storage or backup services. When you transfer data from your internal storage to a cloud provider’s you must examine how that data is stored so that you stay in compliance with laws and regulations. Financial cloud computing, for example, requires IT sox compliance to ensure quality of service.

In 2002 the Sarbanes-Oxley Act (SOX) was implemented as a response to huge accounting scandals. Companies like Enron, Global Crossing and others misled investors and cost shareholders billions of dollars. This, in turn, changed the IT world forever. What does this have to do with IT? It changed how we approach things like storage, data, security and other functions. 

Cloud compliance is, simply put, a principle that states a cloud based system must be compliant with standards that the cloud customer faces.

Compliance departments ensure that businesses conform to established rules and it’s important to understand, when switching over to a cloud service, how and in what ways the cloud meets compliance standards. Luckily, there are cloud providers that ensure compliance with regulations like SOX. 

If you’re in the financial services industry there are a few things to think about when considering an IT solutions cloud provider. 

How Compliance Works 

A global survey conducted by Veritas Technologies, a data management company, revealed that of the 13 countries and 1,200 businesses surveyed, 69 percent of organizations or 828, wrongfully believed that data protection, data privacy and compliance are the responsibility of the cloud service provider.

It isn’t.

When it comes to cloud compliance you need to be aware of the data you should move to the cloud and the data that should remain in house, the questions you need to ask of your cloud provider and what be written in a service-level agreement (SLA) to maintain industry compliance.

When SOX was first written, it explicitly left out how regulations should be met. This ensured that industries could adopt the most recent technology instead of having to wait for lawmakers to catch up to technology. Because of this, the cloud is a viable infrastructure for financial companies that forced to adhere to compliance rules. 

 The way IT departments store records changed due to the implementation of SOX. Regulations state what kind of information needs to be stored that relate to SOX compliance. Things like electronic records and messages, spreadsheets and emails are considered valuable and fall under the regulation.  

It’s important that you not take this for granted, and evaluate your SLA’s with the provider.

The first thing that organizations need to do is be aware of the type of services they use. There may be certain information that’s regarded as highly confidential and a company may decide to keep it on an internal network. Or if it is moved to the cloud, it’ll be a private cloud that will be hosted on the premises.

Nerds Support has a hybrid cloud in a secure location that has military grade security.

Ensuring Cloud Compliance 

Once your company has decided what information is to be transferred over to the cloud look at the contracts you have between with your cloud provider. Depending on whether the cloud is internal or external the approach will be slightly different. If it’s external, you have to make sure both you and the provider are clear about what type of data should reside on their cloud services and how they’ll protect said data. If it’s an internal cloud, are you going to have internal compliance checklist to make sure you’re within the regulatory standards?

With cloud financial services, customers and cloud providers share the responsibility to maintain compliance. It’s the duty of the organization to investigate the security policies of the vendor. 

Important questions to ask include: 

  • Where is data stored?
  • Who has access to the storage areas or data centers?
  • How is my data protected?

Compliance 101 SOX FINRA Cost Statistics

Service Organization Controls 

In some cases, companies can look at providers that certify compliance and chose their services without any further research. There are times, however, where a company will have to be more thorough and get involved in the cloud providers security to make sure it complies with industry standards. When it comes to SOX compliance, however, you should look for a vendor that provides you with Service Organization Controls.

This report enables user auditor to evaluate audit risks associated with the use of a financial cloud provider.   

It’s also important to establish and verify benchmarks that help check the effectiveness of the security around your data on the cloud.  Make sure your provider uses federal government guidelines for cloud security if it’s based in the US.

In order to avoid miscommunications between your cloud provider and your organization, make sure you take the time to classify the data in level of importance, delegating carefully what is suitable for the cloud and what needs to remain internally stored. Have the right contracts and go through them, establishing what will be covered under their services and how they’ll protect and back up your data. A business continuity plan is also imperative, just in case of any hiccups.

Nerds Support has cloud services that comply with financial regulations.

Contact us today to schedule a free IT assessment that can identify gaps in your IT infrastructure.

CPA Firms Data Cloud Protection

How CPA Firms Benefit from Miami Data Protection

/in /by

All companies today have data. It could be anything from personal files and client data, to product information and financial transactions. In fact, data is one of the most important assets to a company. For that reason, data protection should be a serious consideration for any company. Data protection included guarding the data and making it available to employees who need it. Moreover, it requires ensuring the data is correct and updated as well as keeping the data confidential.

Data is currently the lifeblood of a business. That is why Facebook and Google became the tech giants they are today. The amount of data they have over their users is so valuable, industries depended on them to drive business, develop relationships and predict behaviors.

Imagine if that data were stolen and used for nefarious purposes. Imagine if it were sold on the black market or bought by a third party. You don’t have to be Facebook or Google to appreciate the severity of a situation like this. If your industry fails to protect both client and employee data, this could destroy your business.

Customers have a minimum expectation that your firm or business will keep that data safe. Data governance builds trust and trust builds a business. There are practices that everyone needs to follow to protect important data from breach.

Now more than ever, you find data hacks and attackers everywhere online. 53 percent of companies experienced a cyber-attack in the last year. This was up from 38 percent the previous year. This is why finding the right services that offer data protection in Miami is a good idea. Ransomware and hackers in particular are hitting accounting, the financial services industry and even educational companies all over the world.

Data protection keeps hackers from taking advantage of human errors

Whether you like it or not, human errors can appear from time to time in just about any business. And yes, they can lead to lots of downtime. Hackers will wait for such an error to appear and they will immediately gain access to your business information. If you don’t store your information adequately, hackers will just attack your business, and that can lead to a huge set of problems in the long term.

Training

This is such a huge issue that government regulations are now in place that make data governance a requirement. An important component of safety measures is security awareness training. Employees need to understand the importance of data security and procedures.

Online Safety

Our online activities reveal aspects of our daily life. What we search, where we enter our names, home address, and phone numbers. Facts about our education, our shopping habits, all of these things are recorded on the internet.

The amount of information that can be found on the internet is staggering. People expose their private lives online on a regular basis and that means these details can be exploited to gain access to employee information at work.

Data protection keeps hackers from taking advantage of human errors.  There are three main human errors that cyber attackers leverage to gain sensitive data:

Error 1: Phishing

Phishing and pretexting account for 93 percent of social related breaches, and email attacks are the most common.
The biggest mistake companies make is to neglect cyber until an attack or breach occurs. What every financial organization, accounting firm, and any business with sensitive data needs to do is create a security focused culture. Taking the time to address important warnings and issues in brief meetings or short five minute videos can give your business a huge advantage over cyber criminals.

Error 2: Poor passwords

81 percent of company data breaches are due to weak passwords. That’s because people recycle the same passwords across their various online accounts. Not only do people use the same passwords, but they continue to use those passwords as long as possible until it they’re told to change it by an IT department or affected by a cyber-attack. Businesses need to take an active role in helping their staff develop password good password hygiene. The reason many people use reuse these passwords are fear of forgetting. In fact, it was the number one reason for reuse. 61 percent of users admitted this in a poll by Lastpass.

There are password manager software applications that collect data and store it in encrypted databases. Nerds Support uses password expiration tools that instructs users to change their password every 30 days.

Error 3: Unauthorized access to devices

Although  industries  have become more mobile through smartphone technology, tablets and laptops, companies still issue devices to their employees. Over half of working adults allow friends and family to access employer-issued devices at home. Furthermore, it’s possible for employees to download malware that could gain access to important data and applications.
Implementing security controls on devices like two factor authentication and password protection is necessary in this case to avoid these risks. Also, introducing a thorough and comprehensive information security plan that addresses such concerns will lead to a more cyber secure culture within the workplace.

This is especially important for accounting firms due to the sensitive nature of their data. Financial firms are also vulnerable to these types of human error and critically impact the business. Nerd Support’s cloud accounting technology mitigates these risks by implementing rigid compliance centered practices.

Data protection Safeguards Against Breaches

Daily data backups, storing your data in an undisclosed location and taking the security measures mentioned above can go a long way. Data protection needs to be a top priority for all industries, because not only will you lose data, you’ll lose trust and eventually clients.

 

CPA Firms Data Protection Statistics

 

Daily data backups, storing your data in an undisclosed location and taking the security measures mentioned above can go a long way. Data protection needs to be a top priority for all industries, because not only will you lose data, you’ll lose trust and eventually clients.

Data Protection saves you money

The average total cost of a data breach is 3.92 million US dollars, according to extensive study by the Ponemon Institute. The average size of that data breach is 25, 575 records. In other words, 25,575 records are stolen on average whenever there is a data breach. Having strong protections is not a luxury, it’s a necessary investment. Most companies don’t realize this until a breach has taken place. The true financial impact is immeasurable when you consider future losses due loss of trust, credibility as well as the fines and fees.

Data protection keeps your company in compliance with the law

All businesses must safeguard their data. In Florida it’s important to remain compliant with the Florida information protection act of 2014. It’s a lot easier to avoid any potential lawsuits this way too. And, the most important thing, this way you can create powerful business relationships with each client.

By following compliance standards many of the vulnerabilities associated with human error are eliminated entirely. So you need to find IT solutions that take compliance not only into consideration but make compliance the basis for those solutions.

For accounting, it’s GAAP compliance standards that should be met. In the case of financial services, using FINRA approved cloud storage services is key.

What Happens When Data Protection is Underestimated?

There were huge data breaches in government run facilities in the past year. Ecuador was victim to a data breach that compromised the information of up to 20 million people. This included adults and children, dead and alive. To give you a sense of scale, Ecuador has a population of 16 million people. These attacks are only getting worse as hackers expose long neglected security weaknesses.

If you want to make sure that your company data is safe, contact Nerds Support for more information. Our dedicated data protection services team can give you a free consultation to discuss your industry and compliance needs.

Financial women blind-folded in front of books representing regulatory compliance.

Regulatory Compliance: Compliance is Everything

/in /by

The Need For Regulatory Compliance

Regulatory compliance is  a dull subject. Yet, if your financial institution or business ignores or isn’t aware of it –it could cause problems.

Regulatory compliance ensures organizations follow state and federal law, as well as federal standards and procedures. That may sound simple enough, but considering the variety of mandated regulations like HIPAA, SOX and PCI DSS, falling out of compliance happens fairly frequently. If that happens, you’re looking at possible audits, federal fines, even public scrutiny and negative attention that comes with an investigation. In a time where social media shapes perception, a company cannot risk losing business because of their reputation.

The reality is, not maintaining regulatory compliance only takes you towards significant revenue loss for your organization, or even worse.

Penalties for violating SOX compliance standards, for example, and can lead to millions of dollars fines, removal from listings on the public stock exchange and even years in prison. That is why compliance is often the focus of an organization’s security system.

Regulatory Compliance Isn’t Easy But…

While there are different types of compliance regulations for different industries, the three largest are HIPPA, SOX and PCI DSS. Your particular organization might need to comply with one or all three. Whatever the case may be, it’s important to familiarize yourself with the specifics of the regulations that apply to you. That being said, it’s possible to think you are taking the necessary measures to ensure compliance and still be in violation of one or more regulations. This happens unintentionally or unknowingly.

Some of the reasons for this might be because you’re referencing outdated material, updated or new wording of rules replaces old and misunderstandings on how these laws are interpreted by the various enforcement agencies.

Furthermore, these regulations are constantly changing and keeping track of all the minute alterations can take time and energy better used on other business related goals.

 

Cloud Compliance

Cloud computing for banking and investment services involves a lot of data. Even processing data has to go through regulatory benchmarks. These benchmarks are called Data localization laws. Cloud compliance just means that a cloud service provider is meeting regulatory standards required for their clients.

Data localization is important to understand financial cloud compliance. It should not be confused with data sovereignty. Data localization laws require personal data to be handled in a specific territory instead of a cloud provider. Laws in different countries often differ regarding this. Here are some financial tech support requirements you need to verify with any potential cloud provider.

SOX Compliance

SOX requires the following to be bench-marked, audited and monitored regularly, specifically sections 302, 404, and 409:
• Information Access
• Internal controls
• Database activity
• Account activity
• User activity
• Network Activity
• Login activity

Industry Costs of Compliance Statistics
IT Security:

The Gramm-Leach-Bliley (GLB) Act requires companies legally defined as “financial institutions” to ensure the security and confidentiality of sensitive client information. Therefore, IT security is an essential requirement everyone in the financial services industry.  Given the nature of the data a financial organization possesses, there are serious repercussions for shirking this responsibility.

Make sure the right controls are installed to avoid data breaches and you have the tools ready to alleviate any issues if they occur. Investing in services that monitor and protect your financial database is essential to complying with regulation.

Data Backup:

Always keep backup systems to protect your sensitive data. Both data centers and on-site IT infrastructure are subject to the same SOX compliance requirements. Finance IT solutions is not only about support but security as well.

Access Controls:
This regards both electronic and physical systems put in place to stop unauthorized users from viewing sensitive financial information. Part of this is adopting effective security measures like implementing multi-factored authentication, keeping servers or data centers in secure locations.

What Can You Do?

Considering you are in the best position to look after your businesses’ affairs, you should familiarize yourself with the most recent regulatory compliance information. Knowing as much as possible about the nuances of regulatory mandates prepares you to understand compliance regulations. Moreover, you can leverage this information to stay updated on any changes and plan accordingly.

You should then adopt IT solutions for finance that are in complete compliance with industry standards. That means finding cloud financial support with expert knowledge on regulation and compliance.

You should try to find an organization that creates a customized infrastructure that serves your specific requirements. Additionally, it should take into consideration all the standards mentioned previously: HIPAA, SOX and PCI DSS.

For more information on compliance standards and compatible IT solutions visit our website or call us at (305) 551-2009 and we’ll answer any questions or inquires you might have.