Professional services | High Point, NC
IT Services for Law Firms, Accounting Firms and Professional Services
Preferred Data secures and supports the computers, Microsoft 365, networks and client files of law firms, accounting and tax practices, and other professional firms, on a managed IT plan priced per user per month, and every plan includes 24/7 threat detection and response. We are headquartered in High Point, North Carolina, work on site within 200 miles of our office, and deliver our services remotely to clients across the United States and around the world. Schedule a consultation or call (336) 886-3282.
What we look after for professional firms
- Managed IT and helpdeskWorkstations, servers and Microsoft 365, monitored, patched and supported.
- Cybersecurity24/7 detection and response, MFA, email protection and training.
- Backup and recoveryClient files and Microsoft 365 backed up and restore-tested.
- Cloud and Microsoft 365Secure remote access to files without an aging server.
- In business since 1987
- 39 years
- Active clients
- 100+
- Average client tenure
- 20+ years
- BBB Accredited rating
- A+
- On site from High Point; remote support worldwide
- 200 mi
- Threat monitoring on every plan
- 24/7
What IT does a law firm or accounting firm need?
A professional firm needs IT that protects client confidences first and keeps billable people working second: multi-factor authentication, encrypted email, monitored and patched computers, backups that restore, and a helpdesk that answers. In North Carolina, where we are headquartered, the professional and business services sector employed about 764,900 people in August 2026 (preliminary), up 3.1% in a year, according to the U.S. Bureau of Labor Statistics.
- Workstations, laptops, servers and Microsoft 365, monitored and patched under managed IT
- Multi-factor authentication and email threat protection on every account
- Email encryption and an enterprise password manager, included from Preferred Professional up
- Restore-tested backup for client files and Microsoft 365
- Secure remote access through cloud solutions and zero-trust VPN
Key takeaway: For a law or accounting firm, a breach is not only an IT problem. It is a professional-responsibility problem and a client-trust problem.
What do North Carolina's ethics rules say about lawyers and technology?
Two North Carolina Rules of Professional Conduct, numbered like the ABA Model Rules, set the standard. Comment 8 to Rule 1.1 says a lawyer should keep abreast of "the benefits and risks associated with the technology relevant to the lawyer's practice," and Rule 1.6(c) says a lawyer "shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client."
Comment 19 to Rule 1.6 lists what makes an effort reasonable: the sensitivity of the information, the likelihood of disclosure without more safeguards, the cost and difficulty of the safeguards, and how much they would get in the way of representing clients. That is a risk-based test, which is exactly how a managed security baseline is designed.
This page is general information, not legal advice. Your state bar and your own counsel decide what a rule requires of your firm.
What does the FTC Safeguards Rule require of tax preparers and accounting firms?
The FTC Safeguards Rule treats professional tax preparers as financial institutions and requires a written information security plan, according to IRS Publication 4557 (Rev. 6-2024). The plan must name a qualified individual, and multi-factor authentication is required for anyone accessing customer information, "regardless of size." Since May 2024 the FTC must also be notified no later than 30 days after discovery of a breach involving at least 500 consumers' unencrypted information.
| What the rule asks for | What Preferred Data plans supply |
|---|---|
| Written information security plan | The technical safeguards the plan describes, on every plan |
| A qualified individual who oversees the program | Reviews and reports that support the person you designate |
| Multi-factor authentication for anyone accessing customer information | MFA enforcement on every plan |
| Risk assessment, then regular monitoring and testing | 24/7 managed detection and response on every plan; recurring vulnerability scanning and an annual security assessment on Complete |
| Security awareness training with regular refreshers | Security awareness training on every plan |
| Oversee service providers and require safeguards by contract | A written proposal stating what the plan does and does not cover |
| Notify the FTC no later than 30 days after discovery of a breach of 500 or more consumers' unencrypted information | Detection and response that tells you quickly when something is wrong |
Every item in the table belongs to your firm: you write the plan (IRS Publication 5708 explains how), you designate the qualified individual and you file any notice. Our plans supply the technical safeguards the plan describes.
The FTC exempts firms that maintain information on fewer than 5,000 consumers from certain provisions of the rule, not from the rule itself. This is general information, not legal advice.
What are the biggest cyber risks for professional services firms?
Email fraud and unpatched software. The FBI Internet Crime Complaint Center 2025 report recorded more than $3 billion in reported business email compromise losses in 2025, and in the 2026 Verizon Data Breach Investigations Report exploited software flaws (31%) became the most common way into a breach for the first time.
For more on how these threats are changing, read cybersecurity and AI risks for professional services firms, or see what our cybersecurity services cover beyond the plan baseline.
- Spoofed partner, client or vendor email asking to change payment instructions: confirm by phone on a number you already have
- Phishing aimed at tax professionals during filing season, covered in our article on IRS tax pro phishing
- Unpatched laptops and remote-access tools, closed by patching and endpoint detection and response on every plan
- Stolen passwords, blunted by multi-factor authentication and, from Preferred Professional up, identity threat detection and response
Which managed IT plan fits a small law or accounting firm?
Most firms that handle confidential client files fit Preferred Professional, because it adds identity threat detection, email encryption, an enterprise password manager and zero-trust VPN to the security baseline every plan includes. Preferred Complete adds recurring vulnerability scanning, an annual security assessment and 24/7 helpdesk support.
| What a professional firm needs | Essentials | Professional | Complete |
|---|---|---|---|
| MFA, 24/7 threat detection and response, patching, training, restore-tested backup | Included | Included | Included |
| Email encryption and enterprise password manager | Not included | Included | Included |
| Identity threat detection and response | Not included | Included | Included |
| Zero-trust VPN and DNS filtering | Not included | Included | Included |
| Recurring vulnerability scanning and annual security assessment | Not included | Not included | Included |
| Helpdesk hours | Business hours | Priority response with extended hours | 24/7, including after-hours and weekends |
| Technician hours included each month (whole account) | 2 | 4 | 8 |
Managed IT is priced per user per month after a free quote; we do not publish a rate card. IBM's Cost of a Data Breach Report 2026 puts the global average cost of a breach at $4.99 million, which is the number to weigh the plan against. Compare every line on the pricing page.
Where do you work, and do you come on site?
Preferred Data supports law, accounting and other professional firms remotely across the United States and around the world, and on site within 200 miles of our headquarters at 1208 Eastchester Drive in High Point, North Carolina, which covers the Piedmont Triad, Charlotte, Raleigh and most of North Carolina. Our service area page lists what we deliver remotely and on site.
- IT services in High Point, where our office is
- IT services in Greensboro and Winston-Salem
- IT services in Charlotte and Raleigh
Free resource library
Free resources for law, accounting and other professional firms
Guides, free tools, policy templates and checklists picked for law, accounting and other professional firms, in one place. Everything here is free to read and use. Most of it needs no sign-up; the policy generators ask for your contact details before the finished document unlocks.
Start with a guide
GuideHow to Use AI at Work Safely: A Small Business GuideHow a small business can use AI tools safely: approve the right tools, keep sensitive data out, write a short policy, train people and have a person check the output.
GuideRansomware: How North Carolina Small Businesses Prevent It and RecoverWhat ransomware is, how criminals usually get in, the handful of controls the FBI and CISA recommend, what to do in the first day, and whether to pay.
GuideCyber Insurance for Small Businesses: What Insurers Ask and How to QualifyWhat cyber insurance covers, the security controls insurers commonly ask about, why claims get disputed, and how to get ready for your next renewal.
GuideNorth Carolina Data Breach Notification Law: A Plain-English GuideWho North Carolina's breach notice law applies to, what counts as personal information and a breach, who you must notify and when, and the written disposal policy the law expects.
Free tools
Free toolCyber Insurance Readiness CheckerSixteen quick questions about the security controls insurers commonly ask about, with a readiness score and a fix list in priority order.
Free toolCybersecurity AssessmentEighteen yes, partly or no questions on logins, computers, data and people, with a letter grade and the actions to take first.
Free toolIT Budget CalculatorPick the IT services your business needs and get a realistic monthly and yearly budget range for your size.
Free toolWebsite Health AnalyzerEnter any web address to check its speed, security settings and search basics, with a score for each.
Free toolM&A Technology Readiness AssessmentFor buyers of a business: rate the target company’s technology risk and see how hidden IT costs could change the deal math.
Free toolEmail Domain Security CheckerType your domain to see, in plain English, whether criminals can send email in your name and whether you meet the Google and Yahoo sender rules.
Policy templates
Policy templateWISP (FTC Safeguards Rule)A written information security program built for the FTC Safeguards Rule, for tax preparers, CPA firms, mortgage brokers, auto dealers that finance and other businesses the law treats as financial institutions.
Policy templateAI Governance PolicySet how your organization approves, uses, oversees and audits AI tools, aligned to the NIST AI Risk Management Framework.
Policy templateAI Acceptable Use PolicyGive every employee clear, signable rules for using ChatGPT, Copilot, Gemini and other AI tools at work without exposing company or customer data.
Policy templateIT Acceptable Use PolicySet clear rules for how employees use company computers, email, internet, software and data, and what monitoring they should expect.
Policy templateInformation Security PolicyEstablish the core security program every insurer, auditor and customer now asks about: data classification, access control, patching, encryption, logging and vendor risk.
Policy templateIncident Response PlanKnow exactly who does what in the first hours of a ransomware attack, data breach or business email compromise, including who to call and which notification clocks start.
Show 16 more policy templates
Policy templatePassword and MFA PolicyModern password and MFA rules based on current NIST SP 800-63B guidance: long passphrases, a password manager, no forced resets, and phishing-resistant MFA where it matters.
Policy templateRemote Work and BYOD PolicyLet people work from home and use their own phones safely, with clear rules for home networks, device enrollment, company data and what happens when someone leaves.
Policy templateData Backup and Recovery PolicyDefine what gets backed up, how often, where copies live and how fast you must recover, using the 3-2-1-1-0 rule that ransomware now demands.
Policy templateWire Transfer Verification PolicyStop fake invoices and email payment fraud with simple rules: call back on a known number before any bank change, two approvers for large payments, and no payment changes by email alone.
Policy templateVendor Risk Management PolicyChoose and monitor the vendors that hold your data or reach your systems: a vendor list, simple risk tiers, security questions, contract clauses, remote access rules and a clean exit.
Policy templateAccess Control PolicyGive people only the access they need, protect every sign-in with MFA, keep admin accounts separate, review access every quarter and remove it the moment someone leaves.
Policy templateData Retention and Destruction PolicyDecide what records to keep and for how long, with a sensible default schedule, legal holds, and secure destruction of paper and devices following NIST SP 800-88.
Policy templateSecurity Awareness Training PolicyDecide who gets cybersecurity training, when, how phishing tests work, and which training records you keep for insurers and customer questionnaires.
Policy templateBusiness Continuity PolicyKeep the business running through storms, outages, fires and cyberattacks: critical functions, recovery targets in plain words, a call tree and an annual tabletop test.
Policy templateData Protection and Privacy PolicySet internal rules for the personal and confidential data you hold: collect less, limit access, share carefully with vendors, handle requests, and respond to a breach under North Carolina law.
Policy templateIT Asset Disposal PolicyRetire old computers, phones, servers and copiers safely: track every device, wipe or destroy data to NIST SP 800-88, get certificates of destruction, and recycle through certified recyclers.
Policy templateVendor Remote Access PolicyControl how vendors, machine builders, software suppliers and IT providers connect in: approved tools only, a named account and MFA for every technician, access switched on per session, logged sessions and quick removal.
Policy templateIncident Response PlaybooksStep-by-step playbooks for email account takeover, vendor or IT provider compromise, insider data theft, malware, misdirected data and website attacks, built to work with your incident response plan.
Policy templateBreach Notification ProcedureDecide with your breach counsel whether an incident legally requires notice, then notify the right people with the right content: North Carolina rules by default, with HIPAA, FTC, DFARS and multistate steps when they apply.
Policy templateIncident Report FormThe forms to fill in during a cyber incident: an initial report, triage sheet, timestamped log, evidence and chain of custody register, decision log, notification tracker, cost tracker and closure summary.
Policy templateTabletop Exercise PlanRehearse your incident response plan in a two-hour guided discussion: ready-made ransomware, wire fraud and account takeover scenarios with timed injects, a scoring sheet and an after-action report.
Checklists
ChecklistRansomware: the first 24 hoursHour-by-hour steps for the first day after ransomware or a suspected breach: what to unplug, who to call, and what to report.
ChecklistEmployee offboarding IT checklistEverything to revoke, recover and transfer when someone leaves: accounts, MFA, shared passwords, email, devices, keys and licenses.
ChecklistOffice move IT checklistThe IT plan for moving or opening an office: internet orders, phones, cabling, Wi-Fi, cameras, cutover weekend and testing.
Recent articles for law, accounting and other professional firms
IT questions law and accounting firms ask us
Does the FTC Safeguards Rule apply to my accounting or tax practice?
If you prepare tax returns, yes: IRS Publication 4557 says the Safeguards Rule's definition of financial institutions includes professional tax preparers, and the FTC lists tax preparation firms among covered businesses. The rule requires a written information security plan, a qualified individual, and multi-factor authentication. Confirm how it applies to your practice with your own advisor.
Is multi-factor authentication required for tax preparers?
Yes. Under the FTC Safeguards Rule, as summarized in IRS Publication 4557, multi-factor authentication is required for anyone accessing customer information on your system, for all companies regardless of size. Every Preferred Data plan enforces MFA.
Do North Carolina lawyers have an ethical duty to understand technology?
Yes. Comment 8 to North Carolina Rule 1.1 says lawyers should keep abreast of the benefits and risks of the technology relevant to their practice, and Rule 1.6(c) requires reasonable efforts to prevent unauthorized access to client information. If you practice elsewhere, check your own state bar's rules. A managed IT provider supplies the safeguards; the lawyer remains responsible for the judgment.
Can Preferred Data write our written information security plan?
The plan belongs to your firm, and IRS Publication 5708 explains how to create one. What we supply are the technical safeguards it describes, such as MFA, 24/7 detection and response, training and tested backup, and a written proposal stating what our plan covers. Ask us what that looks like for your firm.
How much do IT services cost for a law firm or CPA firm?
Managed IT is priced per user per month, and the total depends on your headcount, the equipment we manage and the plan you choose. Preferred Data does not publish a rate card; we send a free written quote. Request one on the pricing page or call (336) 886-3282.
Do you provide email encryption?
Yes. Email encryption is included in Preferred Professional and Preferred Complete, along with an enterprise password manager and identity threat detection and response. Every plan, including Essentials, includes email threat protection and multi-factor authentication.
Do you provide on-site IT support in Greensboro, Charlotte and Raleigh?
Yes. Our office is in High Point and we provide on-site support anywhere within 200 miles, including Greensboro, Winston-Salem, Charlotte and Raleigh. Preferred Professional includes on-site visits when we cannot fix a problem remotely, and Preferred Complete includes unlimited on-site support.
Do you work with law and accounting firms outside North Carolina?
Yes. Managed IT, helpdesk, Microsoft 365 administration, email security, backup and 24/7 threat detection and response are delivered remotely to firms across the United States and around the world. On-site visits are within 200 miles of our High Point office. Microsoft 365 licensing outside the United States and any on-site need beyond 200 miles are set out in your written quote. Our service area page lists what we deliver remotely and on site.
Sources
- North Carolina State Bar, Rule 1.1 Competence (Comment 8)
- North Carolina State Bar, Rule 1.6 Confidentiality of Information
- IRS Publication 4557, Safeguarding Taxpayer Data (Rev. 6-2024, PDF)
- Federal Trade Commission, FTC Safeguards Rule: What Your Business Needs to Know
- U.S. Bureau of Labor Statistics, North Carolina Economy at a Glance
- FBI Internet Crime Complaint Center, 2025 IC3 Annual Report (PDF)
- Verizon News, 2026 Data Breach Investigations Report key findings
- IBM, Cost of a Data Breach Report 2026
Related services and resources
Protect client confidences with IT you can document
Tell us about your people, your practice software and what your clients or regulators expect. We will recommend a plan and put in writing what it does and does not cover before any work starts.
Preferred Data Corporation, 1208 Eastchester Drive, Suite 131, High Point, NC 27265