These are a small sample of the comments I regularly receive when consulting on IT security.  Business risk profile and budget concerns play a large part in information security strategic planning for companies, but we often focus on all the reasons why we cannot improve instead of discovering the various ways a business can improve their IT security risk profile without investing large amounts of cash.  This section of the Protect Your Business series will focus on a selection of perimeter and internal controls that can be implemented and layered to provide greater security for your business.

While there are numerous approaches I could delve into, I will only be discussing the following as related to IT security:

1. Perimeter defense
2. Internal controls

The most common defense at a network’s perimeter is the firewall.  A properly configured firewall can greatly reduce a network’s vulnerability to external threats.  For instance, many firewalls I see are implemented ‘as-is’ directly out of the box.  Sure, you have a wall around your kingdom, but how many metaphorical doors in the form of network ports have been left open.  The internet is the digital equivalent of the Wild West and you wouldn’t want just anyone waltzing into your business.  A common best practice for firewall configuration is to start with the firewall completely locked down.  Then, after taking inventory of which applications need external network resources, open only the necessary ports.   By only allowing necessary traffic in, you have effectively limited external attack vectors (from a network perimeter perspective) to those few ports.  The above step actually encompassed two important exercises:

1. Locking down the firewall
2. Taking inventory of applications requiring external network resources

This first item should be very low cost to implement as most companies will already have a firewall in place.  Many modern firewalls will come with a feature set that will allow you to customize firewall rules and provide complimentary security features.  However, some older firewalls might not provide the security and operational features that your business needs and thus might require an initial capital investment for a modern firewall along with the corresponding hardware and software maintenance plan. 

The second item is very important.  The phrase “You don’t know what you don’t know” might be familiar to some readers.  It is a dangerous position to outline your network security without knowing the environment you are protecting and the applications operating therein.  Take the time to perform proper discovery of your IT environment (hardware and software) and outline how the systems are connected and which enterprise goals they are supporting.  Here are some questions you should be asking:

1. Which applications are dependent on which servers and/or databases?
2. Which firewall ports must be open for our applications to operate?
3. Is our network topology updated?  If not, verify that all communication paths are outlined and relevant hardware present.
4. Is there a guest network?  If so, is it properly segregated from our internal network?

Knowing this information ahead of time will empower you to properly plan your IT security strategy. 

From an internal controls perspective, I only am going to touch on a few basics.  I would offer up that the following controls should be present in any business environment.

1. A management steering committee charged with oversight of IT, information security, and enforcing accountability for those tasked with managing the IT environment.
2. Limited access to perform administrative functions on the network, including:
   1. Firewall configuration, user access rights management, server management, etc.
   2. Limited access to server room or data closet.
   3. Formal process for authorizing, configuring, and reviewing employee access to IT resources.
   4. Annual IT security training:
      1. This could take the form of IT security awareness training and presents the perfect opportunity to re-educate employees on proper password management and use of business resources.
      2. IT security policies and procedures (lightweight and useful documentation) for items such as:
         1. Change management
         2. Risk assessments
         3. User access rights reviews
         4. Major system upgrades

I was speaking with a good friend the other day and the conversation turned to the (often dangerous) assumptions we make on a daily basis.  Avoid making assumptions when it comes to the security of your business.  For instance, do not assume that because you require your employees to read and sign off that they read the employee handbook (including the section on IT security and acceptable computer use) that they actually understand what is expected of them and why.  When in doubt, communicate!  The management steering committee actively works with the IT staff to evaluate business risks and ensure that employees are properly trained and empowered to protect the company’s interests.  Don’t assume that a security breach will never happen to you.  Proactively work with your IT staff to ensure that administrative access (physical and logical) is properly restricted to authorized personnel and reviewed regularly.

What are some of the potential changes within your industry in the next five years?  The velocity in which advances in technology are being introduced in the marketplace is like no other time in our country.  Change seems to be one of the only constant themes in business today.  What is the unchangeable core of your business?  What aspects of your business can you change in response to the market?

Great companies seem to have tremendous clarity about the nonnegotiable components of their business verses opportunities for innovation.  Apple, for example, represents a beautiful battle of the competing forces:  ART vs. TECHNOLOGY.  The competing forces have allowed them to approach new markets outside of computers with the same potency that made them contenders in the personal computer market.  What are the competing forces driving your business forward, while keeping it grounded in your core competency?

Note that, for Oregon, only employers who have 250 or more of any one type of 1099 (1099R, 1099MISC, 1099 G, and W-2G) need to submit electronically in 2012. PayrollTax News LISTSERV: iWire Update, Oregon Department of Revenue, January 2012

A GRAT can help minimize gift and estate tax liability associated with transferring ownership interests while retaining the much desired income stream for a specific time frame.  The strategy became even more powerful in light of the current economic climate where the gift tax exemptions are higher and the values of businesses are momentarily suppressed.

How does a GRAT work?

A GRAT is an irrevocable trust funded by a one-time contribution of assets by the “grantor”.  For example, a real estate owner developer can transfer some or all of their ownership interest in the business to the GRAT. The GRAT pays the owner as the grantor, an annuity for a specific time frame.

The annuity payment is a fixed percentage of the value of the initial contribution or a fixed dollar amount; either way, the payment must be made at least annually.  The owner maintains the right to the payment regardless of how much income the trust actually produces.

When the term of the GRAT expires, the asset remaining in the trust (aka remainder) transfers to the designated beneficiaries.  But your gift tax is assessed when the GRAT is funded, based on the value of the beneficiaries remainder interest.  The remainder interest’s value hinges on an IRS interest rate known as the Section 7520 rate, at the time the GRAT is created.  An asset such as an ownership interest in a closely held real estate business must undergo a valuation before the Sec. 7520 rate can be applied to calculate the remainder interest’s value.

If you think a GRAT could make sense for you and your business, we would be happy to explore the potential pros and cons of the strategy with you

The American Payroll Association (APA) has issued a press release titled 5 Tips for Businesses to Avoid Compliance Penalties When Paying Contractors that includes the following basic tips on how to avoid IRS penalties when paying independent contractors:

1. Form 1099-MISC is required for noncorporate service providers. Employers must provide a Form 1099-MISC, Miscellaneous Income, by Jan. 31, 2012, to any noncorporate service provider who was paid at least $600 for services during 2011. The Form 1099-MISC does not have to be provided to a corporate service provider. Employers should look at the completed Form W-9, Request for Taxpayer Identification Number and Certification, that they received from the service provider to determine whether the service provider is “noncorporate” or “corporate.” Employers must provide Form 1099-MISC to sole proprietorships, partnerships, attorneys, and medical service providers who do business as corporations.
2. Form 1099-MISC not required if contractor paid electronically. There is no requirement to send a Form 1099-MISC to any contractor that was paid electronically, such as by credit card, debit card, PayPal, or gift card. The bank or credit card company that made the actual payment to the contractor will send the contractor Form 1099-K, Merchant Card and Third Party Network Payments.
3. Pilot program for truncation of TIN numbers has been extended. The IRS pilot program that allows for the truncation of taxpayer identification numbers (TINs) on 1099 forms has been extended to include 1099s through the 2012 calendar year (filed in 2013). This means that the first five digits of the TIN can be replaced with asterisks or Xs on the payees’ paper copies of Form 1099, but copies filed with the IRS must have their full TIN.
4. Better safe than sorry. The APA advises employers who are unsure whether a Form 1099-MISC is required to go ahead and send one. Employers can’t go wrong by sending more 1099s than are required, but could be subject to penalties if they do not send all qualified service providers their Form 1099-MISC.  
5. File forms on time. Paper copies of Forms 1099-MISC must be mailed to the IRS no later than Feb. 28, 2012. Forms 1099-MISC filed electronically must be submitted to the IRS by April 2, 2012.

OASDI tax rate. Social Security’s Old-Age, Survivors, and Disability Insurance (OASDI) program and Medicare’s Hospital Insurance (HI) program are financed primarily by employment taxes.  Prior to 2011, the OASDI tax rate was 6.2 percent for employees and employers, each; and the OASDI tax rate for self-employment income was 12.4 percent.

OASDI limits the amount of earnings subject to taxation for a given year. This limit changes each year with changes in the national average wage index.  For 2011, the OASDI wage base was $106,800. The OASDI wage base is $110,100 for 2012. There is no limitation on HI-taxable earnings.

2011 temporary reduction. The Tax Relief, Unemployment Insurance Reauthorization, and Job Creation Act of 2010 reduced, for wages and salaries paid in 2011 and self-employment income in 2011, the OASDI tax by two percentage points, applied to the portion of the tax paid by the employee and the self-employed individual (4.2 percent and 10.4 percent, respectively). The employee-side payroll tax cut under the 2010 Tax Relief Act was scheduled to expire after December 31, 2011.

Two-month extension. On December 23, 2011, Congress approved and President Obama signed a two-month extension of the employee-side payroll tax cut. The Temporary Payroll Tax Cut Continuation Act of 2011 extends the two percentage point employee-side payroll tax cut through the end of February 2012.

Recapture. Shortly after President Obama signed the Temporary Payroll Tax Cut Continuation Act, the IRS explained that the new law includes a recapture provision, which applies to individuals who receive more than $18,350 during the two-month extension period. The OASDI wage base for 2012 is $110,100, and $18,350 represents two-months of the full-year amount. The recapture tax would be payable in 2013 when the employee files his or her income tax return for the 2012 tax year. The House Ways and Means Committee reported that the recapture provision will only apply if the payroll tax reduction is not extended for the remainder of 2012.

Implementation. The IRS instructed employers to implement the reduced payroll tax rate as soon as possible in 2012 but no later than January 31, 2012. For any Social Security tax over-withheld during January, employers should make an offsetting adjustment in employees’ pay as soon as possible but no later than March 31, 2012, the IRS advised

In business, great companies are always experimenting.  Jim Collins, author of Built To Last, refers to the concept simply as “try a lot of stuff”.   True innovation rarely occurs as a singular revelation, rather it is the cumulative impact of lower risk activities taken to develop a new idea.  Peter Sims does a nice job exploring the concept in his book, Little Bets.

Though I agree with both Collins and Sims, I find value in the “burn the boats” philosophy as well.  A major reason why small companies survive their launch is because there was no other option.  It was focus, adapt, and succeed or the business was going to fail.  Sink or swim?  The fortitude to stay the course despite adversity is a common trait of any successful business owner.

So which is it… little bets or “burn the boats”?  The answer… both.  Little bets enable people to take small, calculated risks that initially spark the necessary ember of innovation.  It is the “burn the boats” fortitude that enables a business owner to fan the ember into a fire.

We have had the privilege of experiencing steady growth over the last several years.  The firm originally occupied 60% of the 2^nd floor at 4500 Kruse Way.  In 2008, we expanded to take over the entire floor, accommodating over 90 employees at our peak.  We are very excited about this opportunity and have enjoyed working with a great team of people in the community to facilitate our transition.  Effective December 5^th, our new address will be 5885 Meadows Road No. 200, Lake Oswego Oregon.

Our new space provides a designated area for continued professional training, multiple conference rooms, full access to the building’s exercise facilities and a mother’s room.  “Both our clients and our employees will benefit from the collaborative and efficient workspace designed for a digital office with the added convenience of modern amenities and easy access.” said Dave DeLap, Managing Partner.  Our new location provides the team an opportunity to expand comfortably and take advantage of energy efficient and eco-friendly amenities.

For nearly 80 years, Delap has leveraged firm experience to serve the Pacific Northwest, empowering business owners and individuals to realize personal and professional goals.  Call us today at 503-697-4118 to see what one of Portland’s oldest, largest local accounting firms can do for your business.