Practices hold exactly the information criminals want: bank details, tax records and ID. The essentials are two-step verification on email and accounting software, a portal instead of email for client documents, a phone check before acting on bank detail changes, and removing access for former staff and clients.
Why practices are targeted
The government's Cyber Security Breaches Survey 2025/26 found that 46% of small businesses had a cyber breach or attack in the past year, with phishing the most common. Accountancy practices are especially attractive because one mailbox can hold tax returns, payslips and bank statements for hundreds of clients.
The protections that matter most
- Two-step verification everywhere. Email, cloud accounting software and practice management systems. Missing it on any cloud service is an automatic fail for Cyber Essentials.
- A client portal, not email. Sending tax returns and bank statements as email attachments risks sending them to the wrong person, or to a criminal reading a hacked mailbox.
- Bank detail changes checked by phone. Before acting on any change to a client's or supplier's bank details, call them on a number you already hold.
- Access reviews. Former staff, and former clients who were given access to shared software, should be removed promptly.
Supporting your clients
More of your clients will be asked for Cyber Essentials by their customers, insurers and tenders, and many will ask you first. Brightlock Cyber's partner programme lets you point them to a plain-English route, and multi-business mode lets you keep track of several clients' readiness in one place.
Common questions
Do accountants need Cyber Essentials?
It isn't a legal requirement, but it's a clear way to show clients, lenders and insurers that their financial data is protected.
Is it safe to email tax returns to clients?
Ordinary email isn't ideal for sensitive documents. A client portal or encrypted file sharing is safer, and avoids sending to the wrong address.
What's the biggest risk for a small practice?
A hacked email account, often through a fake sign-in page. Two-step verification stops most of these.
Sources
This guide is general information, not legal advice. Fees and rules can change, so check the sources before you rely on them.