Intuit provided a pretty good article:

https://proconnect.intuit.com/taxprocenter/practice-management/cybersecurity-basics-for-the-tax-prac...

If you received an offer from someone you had not contacted, I would ignore it. That's a cold call. You cannot verify it.

Do you have, or are you a member of, a professional organization, such State CPAs? They should have referrals and/or cautionary notes. Check with peers in your area. Someone might be offering this, if they already have it inhouse and are large enough to have an IT person/Dept.