Accounting Firm Cybersecurity: A Practical Guide for 2026

Accounting Firm Cybersecurity: A Practical Guide for 2026

Accounting firm cybersecurity comes down to three jobs: keeping client financial data private, keeping it accurate, and keeping it available when you need it. For a small practice, that means a written security plan, multi-factor authentication on every account that matters, tested backups, trained staff, and someone watching your systems around the clock. It is also a legal duty, not only good practice. Federal rules treat accounting and tax firms as financial institutions, whatever their size.

This guide explains what applies to your firm, which threats actually hit practices like yours, and a baseline you can work through in order. It is written for partners, owners and office managers, not for IT staff.

TL;DR

• Accounting and tax preparation firms count as financial institutions under the FTC Safeguards Rule, so a written information security program is required, not optional.
• Business email compromise and phishing are the threats that most often turn into money lost. Train staff, and require MFA that attackers cannot easily bypass.
• Backups only count once you have restored from them. Test partial and full restores on a schedule.
• The IRS "Security Six" (antivirus, firewall, two-factor authentication, backup, drive encryption, VPN) is a sensible floor, not a ceiling.
• Monitoring matters as much as prevention. Breaches are often discovered by outsiders first when tools are left on default settings.

Table of Contents

• Why accounting firms are a target
• What the law expects of your firm
• Cybersecurity is a risk function, not an IT chore
• A 10-step security baseline for a small accounting firm
• Phishing, BEC and payment fraud
• The IRS "Security Six" at a glance
• Our perspective: what we see in small firms
• When to bring in a managed provider
• How Great Plains Networking can help
• A 30-day plan to get started
• FAQ
• Sources

Why accounting firms are a target

Your firm holds Social Security numbers, bank account details, payroll data, prior-year returns and the passwords or portal access that go with them. One client folder can be enough to file a fraudulent return or redirect a payment. The IRS tells tax professionals they are the first line of defense against identity thieves, and warns that criminals use stolen PTINs and EFINs to file false returns.

The money side is just as real. The FBI's 2025 IC3 Annual Report records 24,768 business email compromise complaints and more than $3.04 billion in losses for the year, up from roughly $2.77 billion in 2024. Firms that move client payments and handle invoices by email sit directly in the path of that fraud.

Verizon's Data Breach Investigations Reports have long shown that professional, technical and scientific services, a category that includes accounting, are heavily targeted by financially motivated attackers using social engineering. The same report points to a pattern we see in small offices: security tools are bought but left on default settings or never monitored, so outsiders find the breach before the firm does.

What the law expects of your firm

The FTC Safeguards Rule

Under the FTC Safeguards Rule, accounting and tax preparation firms are classified as financial institutions. That brings a duty to maintain a written information security program, often called a WISP. Since May 2024, the FTC also requires covered firms to report a notification event to the agency when unencrypted customer information of 500 or more consumers is acquired without authorization. The report is due as soon as possible and no later than 30 days after discovery.

The final rule text is long, but the practical meaning is simple: you need to know what customer data you hold, assess the risks to it, put safeguards in place, test them, and be able to prove it. We map each requirement to the evidence an auditor would ask for in our guide to FTC Safeguards Rule IT evidence.

The IRS written security plan

The IRS publishes Publication 5708, a guide to creating a Written Information Security Plan for a tax and accounting practice. If you prepare returns, start there. For a plain-language walk through the plan's elements, see the nine IRS-required WISP elements.

This is a general overview, not legal advice. If you are unsure whether a specific rule covers a specific part of your practice, ask your firm's attorney or your professional liability carrier.

Cybersecurity is a risk function, not an IT chore

NIST frames security around the CIA triad: confidentiality, integrity and availability. Accountants usually think of confidentiality first. Integrity matters just as much to you. If an attacker, or a failing disk, quietly alters a ledger or a payroll file, the damage is to the numbers your clients rely on. NIST's guidance on detecting and responding to ransomware and other destructive events stresses that detection and response are as vital as defense, because some incidents will get through.

That is why a purchase of antivirus software does not settle the question. A defensible program covers prevention, detection and recovery, with a named person responsible for each.

A 10-step security baseline for a small accounting firm

Work through these in order. Steps 1 to 5 deliver most of the risk reduction for the least effort.

1. Inventory your data and devices. List where client data lives: practice management software, tax software, email, cloud storage, laptops, phones, scanners and any personal devices used for work. You cannot protect what you have not listed.
2. Write your security plan. Document who is responsible, what risks you face and what safeguards you use. Use the IRS template above as your outline.
3. Turn on MFA everywhere it is offered. Email, tax software, client portals, remote access, banking and admin accounts first.
4. Patch and update on a schedule. CISA lists updating business software among its four core practices, alongside phishing training, strong passwords and MFA.
5. Back up, then restore. More on this below.
6. Encrypt drives and sensitive email attachments. A lost laptop should be an inconvenience, not a breach notification.
7. Lock down your network. Use a business-grade firewall, separate guest Wi-Fi from your office network, and use a VPN for remote access.
8. Limit access by role. The intern does not need access to every client folder. Remove accounts the day someone leaves.
9. Train your staff and test them. Short, frequent and specific to accounting scenarios.
10. Monitor and have an incident plan. Know who to call, what to disconnect and what to document before something happens.

Passwords and MFA that hold up

Strong, unique passwords are the base layer, and a password manager makes them practical. A password audit guide can help you understand how to review which credentials in your office are weak, reused or exposed.

Not all MFA is equal. Codes sent by SMS can be phished. CISA recommends phishing-resistant MFA, specifically FIDO authentication, which is built into modern browsers and smartphones and blocks an attacker even when a user is tricked into signing in at a fake site. Prioritize it for email, administrator accounts and anything that can move money.

Backups you have actually restored

The common 3-2-1 rule is three copies of your data, on two types of media, with one copy off-site. CISA recommends it as part of resilience against ransomware. The FBI's report also advises off-site or offline backups that are encrypted and immutable, maintained and restored regularly.

The pitfall is assuming the schedule equals protection. CISA warns that firms should run partial and full restore tests, because otherwise they discover during a ransomware event that restores take far longer than expected or that the data is incomplete. For a tax practice, two numbers drive the plan:

• RTO (recovery time objective): how long you can be down. In March, that may be hours, not days.
• RPO (recovery point objective): how much work you can afford to lose. If the answer is "none from today," nightly backups are not enough.

Document both, test against them, and record the results. Our backup and recovery service is built around exactly that loop: back up, verify, restore-test, document.

Phishing, BEC and payment fraud

Most serious incidents at small firms begin with an email. Common patterns include a fake client asking you to change wire instructions, a spoofed partner asking staff to buy gift cards, and a fake e-signature or document-share link that harvests your Microsoft 365 login.

Controls that work:

• Call-back verification. Any change to bank details is confirmed by phone, using a number already on file, never one in the email.
• Dual approval. Payments above a threshold you set need two people.
• Email filtering and external-sender banners. They make spoofed messages easier to spot.
• Reporting without blame. Staff should be able to report a mistaken click in seconds.

Training helps, with realistic expectations. It is not a silver bullet, but it turns employees into an early warning system. Verizon research summarized in its ransomware education whitepaper indicates that recently trained staff are far more likely to report phishing. The same paper notes the main entry point for ransomware has shifted toward exploiting vulnerabilities in internet-facing systems. That is a reason to pair training with prompt patching. For more on the technical controls that blunt phishing and payment fraud, see this roundup of phishing and defense trends.

The IRS "Security Six" at a glance

The IRS lists six safeguards for tax professionals. Here is what each means in an office your size.

Treat this list as the minimum. It does not cover staff training, access control, vendor oversight or incident response, all of which your written plan should address.

Our perspective: what we see in small firms

We work with small businesses across Norman, Moore and Oklahoma City, and accounting practices share a pattern. The partners are careful people. They lock the filing cabinet, shred paper and vet new hires. The digital equivalent is where gaps hide, usually in three places.

First, the plan exists only in someone's head. Nobody has written down who the responsible person is or what happens after a suspected breach. Second, backups run every night, but nobody has restored a single file to see what happens. Third, security tools are installed but not watched, so alerts go unseen for days.

We built our service around closing those three gaps. We monitor around the clock so problems are caught before they interrupt your work, we answer in plain language without jargon, and we respond the same day. We do not require long-term contracts, because we think a provider should earn the next month. Compliance work is part of the job. We help firms document what they do so an auditor, a carrier or a client can see it.

If you do one thing this quarter, restore a real file from your backup, time it and write down the result. It is the quickest honest test of your readiness.

— Nicholas

When to bring in a managed provider

A solo preparer with two laptops can handle much of the baseline alone. Outside help makes sense when any of these is true:

• You have more than a handful of staff, or seasonal staff who need access for a few months.
• Nobody in the office owns IT, so patching and monitoring depend on whoever has time.
• A client, a lender or your insurer has asked for proof of your controls.
• You rely on remote access, and you are unsure how it is secured.
• You have never tested a restore.

When you evaluate any provider, ask for specifics. Who watches alerts, and when? How fast do they respond? Will they document the work for your security plan? Can you leave without a long lock-in? Vague answers on these points are a warning sign.

How Great Plains Networking can help

We offer managed IT support with 24/7 monitoring and a responsive helpdesk, plus cybersecurity covering ransomware and phishing protection, and Microsoft 365 support for the email and document platform most firms depend on. Details of how we serve practices like yours are on our accounting IT support page.

Not sure where you stand? Start with our 10-minute readiness audit, which is free. It gives you a quick read on gaps before you decide anything else.

A 30-day plan to get started

Week 1: Inventory data and devices. Name the person responsible for security. Turn on MFA for email and tax software.

Week 2: Draft your written security plan from the IRS template. Confirm which devices are encrypted.

Week 3: Run a restore test and record how long it took. Fix what failed.

Week 4: Run a short phishing training session, set the call-back rule for payment changes, and write a one-page incident contact sheet.

Then repeat the restore test and review user access each quarter.

FAQ

Do small accounting firms really have to follow the FTC Safeguards Rule?

Yes, in general. The FTC classifies accounting and tax preparation firms as financial institutions regardless of size, which brings the written security program requirement. Specific exemptions and thresholds can apply to parts of the rule, so confirm the details with your attorney.

What is the most common cyber threat to accounting firms?

Phishing and business email compromise are the leading concerns. The FBI's 2025 report counted 24,768 BEC complaints and more than $3.04 billion in losses. A call-back rule for payment changes and MFA on email are the two cheapest defenses.

How often should we test our backups?

CISA says to run partial and full restore tests regularly, without prescribing one interval. A reasonable pattern for a small firm is a spot restore of a few files every month and a full restore test at least once or twice a year, plus one before tax season. Record the time each test takes and compare it with your RTO.

Is cyber insurance enough protection?

No. Insurance may help pay for costs after an incident, but it does not stop an attack or restore your data. Carriers also often ask about controls such as MFA and backups, so the safeguards in this guide support your coverage as well. Review your policy terms with your broker.

Sources

• FTC: Safeguards Rule notification requirement now in effect
• FTC: Standards for Safeguarding Customer Information (final rule)
• IRS: Tax Security 2.0 checklist
• IRS Publication 5708: Creating a Written Information Security Plan
• FBI IC3 2025 Annual Report
• Verizon Data Breach Investigations Report
• Verizon: Reading, writing and ransomware
• NIST SP 1800-26: Data Integrity
• CISA: Cyber Guidance for Small Businesses
• CISA: Four Cybersecurity Essentials for Businesses
• CISA: Level Up Your Defenses

Recommended

• Cybersecurity Insurance for Law Firms: 2026 Guide
• Law Firm Cybersecurity Audit Steps: 2026 Guide
• Legal Industry Cybersecurity Compliance Examples: 2026 Guide