Cyber Essentials for accountants and bookkeepers

Practices hold clients' bank details, payroll and tax records, and access to HMRC on their behalf. That makes them a target all year, and especially around deadlines.

What attackers go after

• HMRC agent accounts. Criminals target practices' agent credentials to file false returns or redirect repayments. Protect these logins as if they were bank accounts.
• Email and invoice fraud. A compromised mailbox lets criminals send convincing "our bank details have changed" emails to your clients. See our phishing guide.
• Tax-season phishing pretending to be HMRC, Companies House or your software provider.
• Cloud accounting and practice software logins, which give access to every client at once.

Where Cyber Essentials fits

Cyber Essentials was launched in 2014 at Chartered Accountants' Hall, and ICAEW's own cyber guidance is designed to help practices reach it. Some clients, lenders and partner networks now ask practices for a certificate, and occasionally for Cyber Essentials Plus.

The controls map neatly onto the risks above: multi-factor login on email and cloud software, updates within 14 days, no everyday admin accounts, and malware protection on every device.

Practical steps for a small practice

1. Multi-factor login on everything: Microsoft 365 or Google, your practice software, cloud accounting and your HMRC agent access.
2. A phone check for any change of bank details, both for your own payments and when clients ask you to update theirs.
3. Tell clients how you'll contact them, and that you'll never change your bank details by email.
4. Remove access promptly when staff or seasonal workers leave.
5. Back up anything that isn't already held in the cloud, and test a restore.