Modern accounting offices increasingly base their work on advanced IT, which allows client data to be managed efficiently. Digitalising accounting processes brings undeniable benefits, but it also creates new cybersecurity challenges. Protecting sensitive financial information and personal data is becoming a key element of running an accounting office professionally.
Cyber threats to accounting offices are particularly serious because of the nature of the data processed. Clients' financial information, personal data, accounting records and confidential business strategies are an attractive target for cybercriminals. Effective protection against these threats requires a comprehensive approach covering both technical and organisational aspects.
Basic steps to increase cybersecurity
Software updates as the foundation of security
Keeping software up to date is a basic rule that must be followed to properly secure the data processed by an accounting office. Software vendors regularly release patches that fix detected security vulnerabilities, which is why keeping all systems updated is extremely important. Data security is only one item on a longer list, which we cover in our article on the obligations of accounting offices.
Regular software updates are the first line of defence against cyberattacks. Vendors systematically identify and fix security vulnerabilities that cybercriminals could use to gain unauthorised access to systems
The update process should cover not only the core accounting software but also operating systems, web browsers and all supporting applications used in daily work. It is particularly important to install and regularly update antivirus software and firewalls, which help detect and neutralise threats before they cause damage within the organisation.
Automatic updates can greatly simplify this process, but they require proper configuration and monitoring. For critical accounting systems, consider testing updates in a test environment before rolling them out to the production system. This approach helps avoid potential compatibility problems that could disrupt the office's daily work.
Password management and authentication
Using strong passwords is a basic cybersecurity rule in every accounting office. Passwords should be sufficiently complex and contain a combination of letters, digits and special characters. A password should be at least 12 characters long, preferably more, to provide an adequate level of protection.
A strong password contains at least 12 characters, including upper and lower case letters, digits and special characters. Avoid dictionary words, birth dates, names or other easily guessed personal information
Implementing two-factor authentication (2FA) significantly increases protection by requiring an additional step when logging in, such as a code from a mobile app or a text message. This extra layer of security means that even if a password is compromised, it is much harder for an unauthorised person to access the system without the second authentication factor.
Password managers are an invaluable tool for managing access security. They make it possible to generate and store unique, strong passwords for every account, removing the temptation to reuse the same passwords across systems. Accounting office staff should be trained in using such tools and be aware of the risks of poor password management.
Encrypting data in transit and at rest
Encrypting stored and transmitted data is key to securing it properly in an accounting office. Sensitive data should be encrypted both on hard drives and in email communication. As a result, even if unauthorised persons intercept the data, reading it without the right encryption key will in practice be very difficult.
Encryption is the process of turning data into a form that cannot be read without the right decryption key. In accounting offices it is particularly important to encrypt databases with client information and email communication containing financial documents
Using a VPN (Virtual Private Network) is an additional layer of protection that encrypts data sent over the internet, which makes interception by unauthorised persons much harder. Accounting office staff should always use a VPN, especially when working remotely or using public Wi-Fi networks. It is an additional layer of protection for the data processed by the accounting office.
Monitoring network traffic can be a useful tool for detecting irregularities and potential attacks early. Network traffic analysis tools can automatically detect suspicious activity and notify the right people. Such early warning systems allow a quick response to threats, minimising potential damage.
Organisational aspects of security
Clean desk policy and physical access control
A clean desk policy requires employees to clear all documents and equipment from their desks at the end of the working day. This helps prevent accidental disclosure of sensitive information, especially when the office is open to clients. Documents should be kept in locked cabinets, and electronic devices protected with a password or screen lock.
A clean desk policy is particularly important in accounting offices visited by clients. Other clients' documents left on a desk may be accidentally seen by unauthorised persons, which is a breach of confidentiality and may have legal consequences
Physical access control to the accounting office premises should include locks, alarms and video surveillance. Particularly sensitive areas, such as server rooms or document archive rooms, require additional safeguards. A log of people entering and leaving the office can help identify potential security breaches.
Employees' mobile devices, such as smartphones and tablets, that have access to company data should be properly secured. A mandatory screen lock, data encryption and the ability to wipe data remotely if a device is stolen or lost are minimum security requirements.
Permission management and backups
An accounting office should apply the principle of least privilege, which means granting employees only the permissions they need to do their jobs. Limiting access to sensitive data minimises the risk of its accidental disclosure or theft. The permission system should be reviewed regularly and updated as the organisational structure changes.
- Audit the current permissions of all employees
- Define roles and the corresponding levels of data access
- Implement a system that grants permissions automatically based on roles
- Establish procedures for periodic review and updating of permissions
- Introduce mechanisms for logging and monitoring access to sensitive data
Making regular data backups is an essential practice that increases the security of the data processed by an accounting office. Backups should be stored in a secure place, preferably offline, to avoid their destruction or encryption by ransomware
A backup strategy should be based on the 3-2-1 rule: three copies of data, on two different media, with one copy stored off-site. Regularly testing data recovery from backups is as important as creating them. Without checking that the copies work and are complete, they may turn out to be useless in a critical situation.
Staff training and awareness
Regular cybersecurity training for accounting office staff helps raise awareness and the ability to recognise threats such as phishing or social engineering. Employees are often the weakest link in the security chain, which is why their education is key to effective protection against cyberattacks.
An accounting office employee received an email supposedly from a well-known client asking for tax documents to be sent urgently. The email contained language errors and an unusual sender address, but under time pressure the employee almost sent the confidential documents. Thanks to earlier training, however, they recognised the phishing attempt and verified the sender's identity by phone.
A training programme should cover various forms of cyber threats, from classic phishing attacks to advanced social engineering techniques. Simulated phishing attacks can help check employees' awareness in practice and identify areas that need further training. Regular reminders of security rules and up-to-date information about new threats should be a permanent part of internal communication.
Security policies and risk management
Developing a comprehensive information security policy
To manage security properly in an accounting office, it is worth introducing internal policies describing the organisation's cybersecurity procedures. One of the key policies is the information security policy – a document setting out the rules and procedures for protecting data and IT systems against threats.
The information security policy should be tailored to the specifics of the organisation and take into account its needs and the risks related to information processing. The document should contain general principles that form the foundation of information security in the organisation and cover the basic elements of security.
| Policy element | Description | Responsibility | Review frequency |
|---|---|---|---|
| Confidentiality | Access only for authorised persons | All employees | Quarterly |
| Integrity | Protection against unauthorised modification | IT administrators | Monthly |
| Availability | Access available when required | Technical team | Weekly |
| Risk management | Identifying and minimising threats | Management | Every six months |
The information security policy should set out the roles and responsibilities of all employees and organisational units for information security. It is important to clearly define responsibility for managing information security at all levels of the organisation
Risk management is an integral part of the security policy and should include a systematic approach to identifying, assessing and managing potential threats. Risk identification means recognising potential threats to information security, while risk assessment focuses on analysing the likelihood of threats and their potential impact on the organisation.
Security incident response procedures
Every accounting office should have a security incident response plan. Without such a plan, the response to an attack can be chaotic, which increases the risk of data loss and other damage. The plan should contain clear procedures for different types of incidents, from minor breaches to serious cyberattacks. Losing records can also end in a dispute with a client — the consequences of an accounting office withholding documents are explained separately.
The incident response procedure should include the following stages:
- Detection and reporting of the incident by employees or monitoring systems
- Initial assessment of the scale and nature of the threat by the IT team
- Notifying the right people in the organisation according to the hierarchy
- Isolating the affected systems to limit the spread of the attack
- Detailed analysis of the incident and documentation of all actions
- Removing the threat and restoring normal system operation
- Analysing the causes of the incident and implementing preventive measures
The security incident response plan should be regularly tested and updated. Simulated exercises help check the effectiveness of procedures and prepare the team for real crisis situations
Documenting security incidents is important not only for internal purposes but may also be required by regulators. In the case of a personal data breach, the data controller must notify the President of the Personal Data Protection Office (UODO) without undue delay and, where feasible, not later than 72 hours after becoming aware of it – unless the breach is unlikely to result in a risk to the rights and freedoms of individuals (Article 33(1) of the GDPR (RODO)). Where the accounting office processes data entrusted by clients (e.g. their employees' data) as a processor, it must notify the controller without undue delay (Article 33(2) GDPR), and every breach must be documented (Article 33(5) GDPR). Other duties of the office, linked to closing the financial year, are set out in our piece on an accounting office's duties regarding financial statements.
Regular audits and security assessment
Regular security audits help identify weak points in the accounting office's IT system. An audit should include a review of network security, security policies and data management procedures. This makes it possible to detect and fix potential security gaps on an ongoing basis.
A security audit can be carried out internally by qualified IT staff or by an external, independent party. External audits often give a more objective assessment of security, because the auditors are not involved in the organisation's daily operations and may notice problems that internal staff could overlook.
The scope of a security audit should cover various aspects of the accounting office's operations:
- Security of the IT network and infrastructure
- Access control and identity management systems
- Backup creation and storage procedures
- Compliance with personal data protection rules
- Effectiveness of staff cybersecurity training
- Physical security of premises and equipment
Most common mistakes and threats to avoid
Mistakes in password and access management
You should absolutely avoid simple passwords such as 123456, password or ones referring to your first name, surname or date of birth. Such passwords are the first target of attacks in which hackers try to guess the password using automated tools. Dictionary attacks can test millions of combinations of popular passwords and phrases in a short time.
Using one password for many accounts is an equally serious security mistake. If one account is compromised, other systems can easily be accessed. Each account should have a unique, strong password that is not used in any other service or application.
Keeping passwords on notes on the desk, in text files on the computer or in emails is a serious security threat. Instead, use professional password managers, which store and manage passwords securely using strong encryption
Employees' mobile devices need special attention in terms of security. Smartphones and tablets with access to company data should be properly secured with a screen lock, encryption and the ability to wipe data remotely if they are stolen or lost.
Threats in electronic communication
Sending sensitive data over unsecured channels, such as ordinary unencrypted email, exposes information to interception by unauthorised persons. Use secure methods of data transfer, such as encrypted file-sharing platforms or secure client portals.
Ignoring system alerts can lead to important warning signs being missed. System alerts can provide valuable information about potential threats, attempts at unauthorised access or irregularities in system operation. Every alert should be properly analysed and documented.
An accounting office employee went on a business trip, during which his backpack with his work phone was stolen. The phone had no lock or password and gave access to the personal data of the office's clients. The backpack and phone were found the same day, thrown into a bin near the place of the theft. The lack of proper safeguards, such as a screen lock or encryption, exposed the data to disclosure, which was a personal data breach and – given the risk to the people concerned – required notification to the President of the Personal Data Protection Office (Article 33 GDPR).
Neglecting physical and external safeguards
Cybersecurity is not only about protecting virtual data but also about implementing appropriate physical safeguards. You cannot ignore the need for physical safeguards such as locks, alarm systems or video surveillance. Otherwise you may be exposed to theft of equipment and data.
External threats, such as DDoS attacks or intrusion attempts, should not be ignored even if internal systems seem well protected. External attacks can paralyse an accounting office's operations by preventing access to key accounting systems. Investing in tools to protect against such threats is justified.
It is important for an accounting office to be secured both digitally and physically. A comprehensive approach to security covers all aspects of the organisation's operations, from securing servers to controlling access to office premises. If you are looking for a trusted partner, see our accounting firm in Warsaw.
