A compromised mailbox can expose far more than one employee’s emails. For an accountancy practice, it can reveal tax returns, payroll records, bank details, ID documents and commercial information for hundreds of clients. That is why Cyber Essentials for accountants is not simply a badge for the website. It is a practical baseline for reducing the risks that cause real disruption, reputational damage and difficult conversations with clients.

For firms handling sensitive financial data, a sensible security standard also makes commercial sense. Clients, insurers, larger businesses and public-sector buyers increasingly ask what controls are in place. Being able to give a clear, evidenced answer is better than relying on assurances that systems are probably secure.

What Cyber Essentials means for an accountancy practice

Cyber Essentials is a UK Government-backed certification scheme designed to help organisations protect themselves against common cyber attacks. It focuses on five technical control areas: firewalls and secure internet connections, secure configuration, user access control, malware protection and patch management.

The standard is deliberately achievable for small and medium-sized businesses. It does not claim to make a firm immune to attack, and it is not a replacement for wider cyber security, staff training, backups or incident planning. What it does do is establish a minimum standard that closes many of the gaps criminals routinely exploit.

For accountants, those gaps are often unremarkable on the surface: an old laptop still used at home, a shared Microsoft 365 account, an administrator account used for daily work, unpatched software for a specialist application, or a former employee whose access was never fully removed. A criminal only needs one route in.

Cyber Essentials has two levels. Cyber Essentials is assessed through a detailed self-assessment questionnaire, verified by an external certification body. Cyber Essentials Plus includes an independent technical assessment, with checks carried out on devices and systems. The right choice depends on your client base, tender requirements, insurer expectations and appetite for external validation. Many firms begin with the standard level and move to Plus when a contract or compliance requirement calls for it.

Why accountants are a frequent target

Accountancy firms hold information that is valuable for fraud, identity theft and convincing social engineering. Criminals can use a compromised mailbox to impersonate a partner, request a change to bank details or send a believable invoice. They may also target payroll teams around pay runs, or use a client’s stolen credentials to access shared portals and cloud files.

The technical impact can quickly become operational. If staff cannot access Microsoft 365, practice-management software or client records at a critical filing deadline, the immediate issue is lost productivity. If data is encrypted or stolen, the firm may also face notification, recovery, legal and reputational work at the same time.

Cyber Essentials does not remove the need for professional judgement. It does, however, force useful questions: which devices access client data, who has privileged access, where are systems exposed to the internet, and how quickly are security updates applied? A clear answer to those questions makes a practice easier to run as well as harder to compromise.

The five controls in day-to-day terms

Secure your internet connection and devices

Your router, firewall and remote-access services should be configured securely and kept up to date. Default passwords must be changed, unnecessary remote access removed, and only approved methods used for staff working away from the office.

This matters where partners and staff use a mix of office PCs, home devices and mobile phones. A policy saying that personal devices are allowed is not enough. The firm needs to know whether those devices are encrypted, protected by a passcode, updated and capable of being removed remotely if lost.

Keep software and configurations under control

Standardised builds make security manageable. A practice with a known set of supported laptops, operating systems, browsers and business applications is in a stronger position than one where every user has different software and local settings.

Remove software that is no longer needed, disable unused accounts and services, and avoid giving staff local administrator rights unless there is a specific business reason. This can feel restrictive at first, particularly in small firms where people are used to fixing their own IT issues. In reality, it reduces accidental changes and makes support faster when something goes wrong.

Give people only the access they need

Access control is particularly relevant in accountancy because roles change throughout the year. Temporary staff may join for busy periods, trainees may gain wider responsibilities, and leavers need to be removed promptly.

Each person should have their own account, rather than sharing logins. Multi-factor authentication should protect email, cloud services and remote access. Privileged accounts should be separate from normal day-to-day accounts, so an administrator is not browsing email and opening attachments with elevated permissions.

There will be exceptions. A legacy accounting package or a specialist integration may need a service account with broader access. Those exceptions should be documented, reviewed and protected, not quietly accepted because the system is difficult to change.

Protect against malware and phishing

Managed endpoint protection, email filtering and web protection are sensible layers, but they are not a substitute for informed users. Most serious incidents still start with a convincing email, a fake Microsoft 365 sign-in page or an attachment that looks like it came from a client.

Staff should know how to report suspicious messages without worrying that they are wasting anyone’s time. Short, regular awareness sessions work better than an annual presentation that is forgotten by February. Focus training on the frauds staff are likely to see: changed bank details, document-sharing invitations, HMRC impersonation, payroll requests and urgent messages apparently sent by senior colleagues.

Patch promptly, including the less obvious systems

Patching means applying security updates to operating systems, browsers, Microsoft 365 applications, firewalls and other software. Attackers commonly use known vulnerabilities because they know many organisations delay updates.

The challenge for accountants is timing. Updates can affect specialist software, and nobody wants unexpected disruption near a filing deadline. That does not justify leaving systems exposed indefinitely. A managed approach tests and schedules updates where appropriate, tracks failures and applies urgent security fixes quickly. It also identifies unsupported hardware or software before it becomes a problem.

Preparing for Cyber Essentials certification

A good starting point is an honest review rather than rushing to complete a questionnaire. Certification answers need to reflect what actually happens across the practice, including home workers, directors’ devices, cloud services and any systems managed by third parties.

Begin by creating a simple asset list. Record laptops, desktops, mobiles, servers, firewalls, key software, cloud platforms and who supports each element. Next, review user accounts and administrator privileges. This often identifies dormant accounts, shared credentials and old access permissions that should have been removed.

Then look at the basics that are easy to overlook: supported operating systems, automatic updates, encryption, anti-malware protection, multi-factor authentication, secure backups and documented processes for joiners and leavers. Backups are not one of the five Cyber Essentials controls in isolation, but they are vital to recovery and should be checked properly. A backup that has never been tested is only an assumption.

The certification process can expose awkward issues. Perhaps an old machine is needed for one client file, a director uses a personal laptop, or a line-of-business application cannot yet support the preferred configuration. The answer is not to hide the problem. Assess the risk, put compensating controls in place where possible and create a realistic plan to retire or replace the weak point.

Avoid treating the certificate as the finish line

Cyber Essentials certification lasts for a year, but threats and staff changes do not work to an annual timetable. A new starter, a departed employee, a newly adopted cloud application or a missed update can change your security position quickly.

For that reason, the strongest firms build the controls into normal operations. They review access when roles change, monitor devices, keep an eye on failed backups, test recovery arrangements and make security part of supplier decisions. The certificate then becomes evidence of an established way of working, rather than a one-off compliance exercise.

Keyhole IT Solutions can help accountancy practices assess their current position, address technical gaps and keep the everyday controls behind Cyber Essentials working properly. The aim is straightforward: fewer avoidable risks, less time spent chasing IT issues and greater confidence when a client asks how their information is protected.

The most useful next step is to identify one real weakness in your practice this week – an unused account, an ageing laptop or an untested backup – and deal with it before it becomes the route an attacker chooses.