Central Coast
Cybersecurity for Arroyo Grande CPA, law and medical offices
Arroyo Grande anchors a cluster of small professional offices in the Five Cities, where a handful of people can hold years of tax returns, case files and patient records. Keith Systems helps those offices protect client data and prepare for the rules that come with it.
Who does business in Arroyo Grande and the Five Cities
Arroyo Grande is the professional-office end of the Five Cities. The last published Census ZIP Business Patterns (2018) counted about 800 business establishments in ZIP 93420. They include CPA and bookkeeping offices, law offices, and medical and dental practices.
Countywide, Census County Business Patterns (2023) counts about 149 accounting firms, 150 legal services firms, 341 physician offices and 154 dentist offices in San Luis Obispo County. A typical office here has a few people and an outside IT person who comes in when something breaks. What sets it apart is the data: Social Security numbers, tax returns, bank details, privileged case files and patient records, often years of them.
Tax offices and the FTC Safeguards Rule
The FTC treats tax preparation firms as financial institutions, so many CPA, tax and bookkeeping offices are covered by the Safeguards Rule (16 CFR 314). The rule expects all of the following:
- A written information security program (WISP)
- A named Qualified Individual
- A risk assessment
- MFA and encryption of customer information
- Staff training and oversight of service providers
If unencrypted information about 500 or more consumers is acquired, the FTC must be notified within 30 days of discovery. Firms with information on fewer than 5,000 consumers are exempt from some written requirements, so check the rule against your own situation.
Keith Systems helps you prepare in three ways:
- A risk assessment your WISP can stand on
- A review of MFA and encryption across your existing accounts and computers
- A written incident-response plan
This supports your compliance work and is not legal advice. Start with the FTC Safeguards and WISP guide.
Law offices have confidentiality duties, defined by bar guidance and your counsel. Medical and dental offices need a HIPAA risk analysis. The same practical controls support all three.
A scenario: October extensions and the 30-day clock
Picture a three-person CPA office in the second week of October, racing the October 15 extension deadline. A staff member approves an MFA prompt she did not start, assuming it was a glitch. Two days later, a client calls about an odd email from the firm. That mailbox holds attachments full of client tax documents.
Several questions now arrive at once. Was data actually acquired? How many people were affected? Do you need to notify anyone? California Civil Code 1798.82, as amended by SB 446 and effective January 1, 2026, requires notice to affected residents within 30 calendar days. If more than 500 residents are notified, the Attorney General must receive a sample copy within 15 days after the consumer notices go out. Thirty days goes fast when the first week is spent figuring out who to call.
What helps:
- A rule: never approve a prompt you did not start, and report it
- Mailbox audit logs turned on before you need them
- A one-page plan naming who calls counsel, the insurer and your IT person
- A practice run
Incident response readiness builds that plan. The California breach notification guide explains the clock. Both are general information, not legal advice.
The smart stuff in a professional suite
Five Cities office suites fill up with connected gear nobody thinks of as computers:
- The printer that scans client documents to email
- The conference room smart TV
- Front-desk tablets
- Thermostats, cameras and door controllers
On a flat network, any of them can reach the file server.
Keith Systems works on the network side only:
- Placing those devices on their own segment
- Reviewing firewall rules so they cannot reach client files
- Keeping lobby guest Wi-Fi fully separate
- Adding DNS filtering
- Reviewing the email accounts those devices send from
It does not log into or manage the devices and does not recommend products.
Free and local help, and where Keith Systems fits
The EDC SBDC, which offers free counseling in Santa Barbara and Ventura counties, is running a free small-business cybersecurity webinar series from October 1, 2026 to April 7, 2027. The series includes a session for accountants on the FTC Safeguards written information security program. Arroyo Grande is in San Luis Obispo County, so ask the SBDC whether the series is open to you.
Keith Systems fits when you want someone to look at your actual accounts and network. That can be a security assessment with prioritized written findings, help with your WISP, or a plan your staff has practiced. See accountants and law offices for more. Jacob Keith holds the CISSP, CompTIA CySA+ and CompTIA SecurityX, and he has about six years of security compliance work on government systems.
Serving Arroyo Grande and nearby communities
Keith Systems is based in Lompoc. On-site work covers Arroyo Grande, Grover Beach, Pismo Beach, Oceano, Nipomo and the rest of southern San Luis Obispo County, plus Santa Barbara County. Remote work is available anywhere, which helps during deadline weeks. The free consult takes about 30 minutes. After it, the fee is stated in writing before work begins. Book a free security consult or call (805) 800-8163.
Questions
Before you call.
Does the FTC Safeguards Rule apply to my small tax or bookkeeping office?
If you prepare tax returns, the FTC generally considers your firm a financial institution covered by the rule. Bookkeeping-only offices should check their own situation. Confirm with your counsel and the guidance at ftc.gov. Keith Systems helps you prepare with a risk assessment, a controls review and an incident-response plan. This is preparation support, not legal advice.
We already have an IT person. Do we still need this?
Often, yes, and the two roles fit together. Your IT person keeps systems running. A security review looks specifically at accounts, access, email protections, data handling and incident planning, then hands over a prioritized list your IT person can act on. Keith Systems does not replace your IT support or sell equipment.
Our suite shares a building network with other tenants. Is that a problem?
It can be. If one network serves the whole building, other tenants' devices may be able to see yours. Start by finding out who controls that network gear. Keith Systems reviews what your office controls. It also writes plain requirements you can hand to whoever manages the building network.
If a staff laptop goes missing, do we have to notify clients?
It depends on what was on the laptop and whether it was encrypted. California's notification law focuses on unencrypted personal information, and the 30-day clock is tight, so talk to counsel quickly. Full-disk encryption on every laptop makes that conversation much shorter. This is general information, not legal advice.
Related services
Guides
- Clicked a phishing link? What a small business should do in the first hour
- Wire fraud and fake invoices at wineries: how to stop payment-change scams
- HIPAA risk analysis for a small dental office: a practical guide
- CMMC Level 1 for small suppliers: the self-assessment in plain English
- CMMC Level 2 readiness for small defense suppliers: where to start
Not sure if we're a fit? Call (805) 800-8163 or send a message anyway. If it's not something I do, I'll say so and help you figure out where to look.
Start with a free security consult.
A short call to understand your business, what you have to protect, and what to do first. No obligation.