Information Security

Effective date: October 16, 2026

Thomas E. Scott CPA PLLC protects the confidentiality, integrity and availability of client information through a documented information security program and Written Information Security Plan (WISP).

Our Program

Our program is designed to meet the FTC Safeguards Rule (16 CFR Part 314), IRS Publication 4557 and Publication 1345, Internal Revenue Code §7216, the AICPA confidentiality rule, and Arizona data breach law. The Firm's Owner, Thomas E. Scott, CPA, serves as Information Security Officer and reviews the program at least annually.

Key Safeguards

• Risk assessment: written risk assessment performed at least annually and after material changes
• Access control: role-based, least-privilege access; unique user accounts; quarterly access reviews; access removed promptly when staff leave or change roles
• Multi-factor authentication: required on all systems that store or process client or consumer financial data
• Encryption: TLS 1.2+ in transit; encryption at rest on devices and cloud services
• Secure integrations: applications connect using scoped OAuth tokens or API keys over TLS, never shared passwords
• Endpoint and network security: managed, updated devices with malware protection; firewalls and encrypted Wi-Fi
• Vendor oversight: security review before engagement and annually thereafter
• Training: security awareness training for all staff at hire and annually
• Monitoring and backups: activity logging, encrypted backups and tested restores
• Incident response: documented response plan, including notification to affected individuals and regulators as required by law

Reporting a Security Concern

To report a suspected security issue, contact tscott@tescottcpa.com.