Cybersecurity for professional services firms is mostly a small number of unglamorous controls applied consistently, not a budget problem. The overwhelming majority of successful attacks on accounting and law firms arrive through a handful of well-worn doors: a convincing email, a reused password, an unpatched machine, a vendor nobody vetted. Close those doors properly and you've dealt with most of what will ever come at you. Leave one open and the rest of your spending barely matters.
That should be encouraging, because it means a firm of eleven can be genuinely well defended without a security team or a six-figure line item. It's also uncomfortable, because it removes the excuse. The firms that get hurt usually weren't outgunned. They had MFA on email but not on the file server, or a backup that had been failing silently since October, or a partner with local admin rights and a habit of clicking.
This guide covers why firms your size get picked, the threats that actually reach you, the controls that stop them, the compliance obligations you already have whether or not anyone told you, what your insurer will demand, and what to do in the first hour of a bad morning.
Why firms your size get picked
Nobody has a vendetta against accountants. The targeting is arithmetic.
Start with what sits on your file server. Social Security numbers for entire families. Bank account and routing details. Prior-year returns with everything needed to file a fraudulent one. In a law firm, add settlement terms, deal documents before they're public, and the kind of personal history clients tell exactly one professional. Per gigabyte, a small firm is one of the richest targets in the economy, and the attackers know the ratio better than most firm owners do.
Then add the second reason, which is the one that gets underrated. You are a path to your clients. An email from your firm gets opened by every business you serve, because you're the trusted sender who always attaches PDFs. Compromise a ten-person accounting practice and you've bought credible access to two hundred businesses. That's why campaigns get built specifically for tax preparers, and why the IRS Security Summit publishes warnings to the profession every filing season instead of leaving it to general business advice.
And the timing is deliberate. Attacks aimed at accounting firms cluster in the weeks when preparers are drowning, because a person processing their ninetieth document of the day and their fortieth email of the hour is not the same person who would spot a mismatched domain in August. The attack isn't really against your software. It's against your February.
The threats that actually reach you
Ignore the taxonomy in vendor whitepapers. Four things account for nearly everything that happens to firms this size.
Email that looks exactly like your Tuesday
Phishing stopped being the badly spelled prince years ago. What lands now is a message that looks like a client sending a document, a bank asking you to confirm something, or your own managing partner asking for a favor while traveling. The English is clean, the branding is right, and the timing is chosen. The attachment is a tax document with an extra extension, or the link is a login page pixel-identical to the real one on a domain one character off.
Its expensive cousin is business email compromise, where nobody installs anything at all. Someone reads a compromised mailbox quietly for weeks, learns how your firm talks about money, then sends payment instructions at exactly the right moment in a real thread. There's no malware to detect because there's no malware. The fix is procedural: verify any change to payment details by calling a number you already had, never a number in the email, and make that rule apply to partners too. The full treatment of both is in how to protect client financial data from phishing and ransomware, and the filtering and domain-authentication layer is our phishing protection service.
Ransomware, and the second demand
The old version encrypted your files and sold you the key. The current version copies the data first, then encrypts, then demands payment twice: once for the decryption key and once for silence. That second demand is why "we have good backups" stopped being a complete answer. Backups get your operations back. They do nothing about a leak site with your client list on it.
Which is why the ransomware conversation has to include the boring controls that prevent the intrusion in the first place, and the notification obligations that follow if data left the building. Both are covered below.
Passwords that were already for sale
A staggering amount of intrusion requires no cleverness at all. Someone reused a work password on a site that got breached in 2021, the credential ended up in a database, and an attacker tried it against your email. That's the whole attack. No exploit, no malware, just a login.
Multi-factor authentication blocks most of it, which is why the next section spends time on MFA and then immediately on why MFA alone isn't the finish line.
The vendor nobody vetted
Your security perimeter includes every company holding your client data, and that list is longer than you think: the document portal, the payroll platform, the e-signature service, the backup provider, the practice management vendor, and now whatever AI tool someone signed up for with a firm credit card. A breach at any of them is your breach as far as your clients and your state's notification law are concerned.
You don't need an enterprise vendor risk program. You need a list of who holds what, a current SOC 2 report or equivalent from each of them, a signed agreement, and an answer to the deletion question. AI vendors deserve extra attention right now because the category is young and the terms vary wildly, which is the subject of how to assess the security of AI vendors before you buy. The wider discipline of knowing who your vendors are and what they hold belongs to operations, and it's in our firm operations guide.
The controls that stop most of it
Here's the part where security writing usually turns into a list of forty items nobody completes. Six controls carry most of the weight. Do these properly before you do anything else, and do them everywhere rather than mostly.
MFA on everything, then the harder question
Multi-factor authentication is the highest-value security control available to a small firm and it's close to free. Turn it on for email, for remote access, for the practice management system, for the file storage, for the banking, and for the administrative consoles of every platform above. Partial coverage is the common failure: firms protect email, then get compromised through the VPN that MFA never reached.
Then the harder question, because attackers adapted. Push fatigue, where someone approves a prompt at 2am to make it stop. Real-time phishing proxies that capture the code as it's typed. Session token theft that skips authentication entirely. The answer isn't to abandon MFA, it's to use phishing-resistant factors where you can, kill push-approval spam, keep sessions short on sensitive systems, and monitor for logins from places your staff isn't. That whole argument, with the specific attacks and specific fixes, is in why MFA alone isn't enough, and the deployment work is our multi-factor authentication service.
Email defenses that do the boring work
Filtering that inspects links at click time rather than delivery time, attachment sandboxing, and external-sender banners that are actually visible. Then the domain authentication records: SPF, DKIM, and DMARC, set up properly, which stops other people sending mail as your firm and is the single most commonly skipped item on this entire list. It's skipped because it lives in DNS and DNS belongs to whoever built the website, who left.
Patching, endpoints, and the machine in the closet
Most successful intrusions use a vulnerability that had a patch available. Automate operating system and browser updates, keep the endpoint protection current on every device including the laptop that only comes in during busy season, and take local administrator rights away from people who don't need them, which is nearly everyone. Then find the server in the closet running something the manufacturer stopped supporting three years ago, because most firms have one, and it's usually holding something important. This is where security and day-to-day IT stop being separate conversations, a point we make at length in our IT management guide for firms.
Backups you have actually restored from
Three copies, two kinds of media, one off-site and offline or immutable. That's the old rule and it survives ransomware because the offline copy is the one the attacker can't encrypt from inside your network.
The rule that matters more: a backup you have never restored is a hypothesis. Test a real restore quarterly, time it, and write down how long it took, because that number is your actual recovery time and it's usually much worse than anyone assumed. Firms discover during an incident that the backup captured the file server and not the practice management database, or that it had been failing since a password change in the autumn and the alerts were going to a mailbox nobody reads.
Encryption, access control, and getting rid of things
Encrypt devices (full disk, on every laptop, so a theft is an inconvenience instead of a notification event), encrypt data at rest with your providers, and stop sending client documents as email attachments in favor of a portal. Then restrict access by role, so the seasonal preparer can reach the returns they're working on and not the partner compensation folder.
And then the one nobody wants to do: delete things. Data you no longer hold cannot be stolen, and most firms are sitting on a decade of client records with no retention policy at all, which converts a small breach into a large one. Set a schedule that satisfies your professional obligations and then actually run it. The full framework is in data retention, access control, and encryption for firms, and the implementation side is our client data encryption service.
Someone watching, ideally not you
The gap between a compromise and its discovery is where the damage compounds. Small firms almost never find intrusions themselves, because nobody is reading logs at 3am and the alerts land in a console nobody has opened since setup. Managed detection, where somebody else watches and calls you, is one of the few genuinely worthwhile subscriptions in this category for a firm without IT staff. That's what our threat monitoring service does.
If you want the whole set as something to work through rather than read, we keep it as a practical cybersecurity checklist for professional firms.
The obligations you already have
A lot of firm owners assume compliance is something that starts when they get big enough. It started when you took your first client.
If you prepare tax returns, the FTC Safeguards Rule applies to you as a financial institution under Gramm-Leach-Bliley, and it requires a written information security plan. IRS Publication 4557 lays out what the Service expects of preparers, and the written plan is not optional there either. Most small firms either don't have one or have a template someone downloaded, filled in halfway, and never revisited. The plan is also the first document requested after an incident, which is a bad time to find out it says your firm uses a backup provider you dropped in 2023. Our IRS Publication 4557 compliance service exists because this is the single most common gap we find.
Beyond that: every state has a breach notification law and they differ on timing and thresholds, so a firm with clients in six states has six sets of clocks. Law firms carry ethical duties around competence and confidentiality that bar associations have been steadily interpreting to include technology. And your larger clients are increasingly writing security requirements into their engagement terms, which means a questionnaire arrives and somebody has to answer it truthfully. The gaps that show up most often, and the order to close them in, are in the most common compliance gaps in small professional services firms.
Your insurer became your auditor
Cyber insurance used to be a form you signed. Now it's an examination. Carriers ask specific technical questions, verify some of the answers independently, and price or decline based on the results. MFA coverage, endpoint detection, backup design, email filtering, and how quickly you patch are the usual subjects.
Here's the part that costs firms money at the worst moment. The application is a set of representations, and if you answered that MFA was deployed everywhere when it covered email only, the claim conversation gets difficult. Answer the questionnaire with the person who actually knows, not the partner who thinks they know, and fix what the questions reveal rather than papering over it. The questions are a decent free security assessment, and treating them that way is the trick. What carriers are asking for and what to put in place first is in cyber insurance requirements, and what to put in place first.
The first hour, and the first day
Assume it happens. The difference between a contained incident and a firm-ending one is almost entirely about the first few hours, and those hours go badly when the plan is being invented during them.
Two instincts to correct in advance. The first is to power everything off, which destroys volatile evidence and can make recovery harder. Isolate from the network instead: pull the cable, disable the wireless, leave it running. The second is to say nothing to anyone while you figure it out, which burns the notification clock and, in a regulated context, is its own problem.
What should happen instead: isolate affected systems, call your insurer's incident hotline before you call anyone else because the policy usually requires it and they have counsel and forensics on retainer, engage that counsel so the investigation carries privilege where possible, preserve logs before anything overwrites them, and start a written timeline the moment you begin. The hour-by-hour version is in what to do in the first 24 hours after a breach.
The plan itself should be short and printed. Who decides. Who calls the carrier. Who talks to clients and who absolutely doesn't. Phone numbers that work when email is down and the office network is off, which means paper, in a drawer, not a document on the server that just got encrypted. Rehearse it once a year over lunch, in the form of a scenario read aloud, and you'll find three broken assumptions in forty minutes. Building it is covered in how to build a breach response plan for a small firm.
The part that's actually people
Every control above can be defeated by one tired person in a hurry, which is why the annual compliance video does nothing. It's forty minutes of somebody's screen while they answer email, and everyone involved knows it.
What works is smaller and more frequent. A short, specific message every month about a thing that's actually circulating, ideally an email your own firm received. Simulated phishing used as a measurement rather than a punishment, with results discussed as a firm number instead of a wall of shame. Practical rules people can follow under pressure: verify money movement by callback, never send a client document to a new address without confirming it, report anything odd immediately.
And one cultural decision that matters more than any of it. Make reporting a mistake completely safe. The difference between a two-hour incident and a two-week one is usually whether the person who clicked said something at 10am or waited until they were found out. Firms that punish the click train their staff to hide it. More on making that stick without turning the firm into a compliance department is in how to create a security culture without slowing down the business.
Two practices, two threat pictures
The controls overlap almost entirely. The pressure points don't.
Accounting firms
Everything concentrates into a ten-week window when the data is most valuable, the staff is most tired, and seasonal people with fresh access are moving through the office. Refund fraud gives attackers a direct, immediate way to monetize what they take, which is not true of most stolen data. Practical implications: get seasonal access provisioning and removal right, tighten verification rules before January rather than during, and be specific with staff about what the seasonal phishing wave looks like. The full picture is in cybersecurity essentials for accounting firms.
Law firms
Law firms hold information whose value is strategic rather than financial: deal terms before announcement, litigation strategy, the personal facts a client told one person. That makes them attractive to a different class of attacker and gives an extortionist unusual power, since publication can be worse than downtime. Add ethical duties with real teeth and client audit requirements from institutional clients, and the standard is higher than for most businesses of the same size. Covered in cybersecurity for law firms.
If you're starting from nothing this week
Do these in order and stop reading security content until they're done.
Turn on MFA everywhere, not on email only. Confirm a backup exists, then restore something from it and time how long that took. Write or update the written information security plan, because it's required and because writing it surfaces what's missing. Inventory every vendor holding client data and get their security documentation. Remove access for everyone who left, which will take twenty minutes and will find at least one active account. Then get someone competent to look at the whole picture, since the gap you can't see is the one that gets used.
That's a month of intermittent effort for a small firm. It moves you past most of your peers, which sounds like a low bar and is exactly the bar attackers are measuring against.
Where this leaves you
Security at a professional services firm is not a project with an end date, and it's also not the endless money pit vendors imply. It's a short list of controls, kept current, plus a written plan, plus a staff that reports mistakes quickly. The firms that come through incidents intact are rarely the ones that spent the most. They're the ones whose backup worked, whose MFA covered everything, and who knew who to call before they needed to know.
Pick the three weakest items on your list and fix them this quarter. Then pick three more. That's the whole method, and it works at eleven people the same way it works at four hundred.