Microsoft-managed Reverse Connect is active on your AVD host pool. This means no inbound RDP ports are exposed to the public internet — the most common attack vector for remote desktop environments. All connections route through Microsoft's secure gateway infrastructure.

MFA is enforced for all AVD logins and Microsoft 365 applications containing client data. Logs confirm full coverage across critical applications, ensuring no one can access the virtual desktop or client data with a password alone.

Microsoft Antimalware extension is deployed on the AVD session host VM with real-time protection active and scheduled quick scans configured to run every Sunday.

To verify inside your VM: Windows Security → Virus & Threat Protection → Confirm real-time protection is On → Scan Options.

The OS disk is protected with Azure server-side encryption using platform-managed keys. All client data stored in the virtual environment is encrypted at rest.

Your VM is configured as a Trusted Launch virtual machine with vTPM enabled — providing secure boot and advanced protections against rootkits, bootkits, and kernel-level malware.

Idle timeout and automatic screen lock are configured to prevent unauthorized access during unattended sessions. Clipboard, USB, and drive redirection are restricted.

Diagnostic settings are now enabled and fully active. Activity Logs and user sign-in events are forwarded to Log Analytics Workspace for retention and review. Every login, every access event, and every security action in your AVD environment is now captured and stored — providing the audit trail that regulators and insurers require.

Microsoft Defender for Cloud is now fully onboarded and active. Secure Score is enabled, vulnerability management is running, and compliance monitoring provides continuous real-time validation that all security controls are functioning as required. Azure Update Manager periodic assessment is configured with automated update deployment scheduling — ensuring every patch is applied, centrally tracked, and documented.

Your customized WISP document — stored directly on your AVD for instant access — includes a complete, pre-filled Incident Response Plan. This covers detection triggers, containment steps, the IRS e-Services reporting URL (24-hour reporting window), FTC notification requirements, client notification procedures, and post-incident review steps. You will never scramble during a breach trying to remember what to do or who to call.

The FTC Safeguards Rule requires documented employee training with signed acknowledgments on file. Technical controls protect the environment — but human error remains the #1 cause of tax office breaches. A phishing email clicked by one staff member can expose thousands of client files that your AVD security controls were designed to protect.

Apex Tech 4 Tax Pros offers certified Cybersecurity Awareness Training as an add-on service. Courses run up to 90 minutes, include a phishing simulator to test your team, generate completion certificates and LinkedIn badges, and produce the signed training records that satisfy FTC §314.4(f).

Every AT4TP subscriber receives a fully customized, IRS-compliant WISP document written specifically for their firm. Your WISP documents every required component of the FTC Safeguards Rule and IRS Publication 4557.

Your customized WISP includes a vendor inventory section documenting all service providers with access to client data.

Your customized WISP names your Qualified Individual and defines responsibility for overseeing your information security program.