Cybersecurity Assessment Checklist.

MFA is now a standard requirement for most cyber insurance policies. It should be active on Microsoft 365, QuickBooks Online, remote access, and any cloud platform — with no exceptions. A single account without MFA is a potential entry point for credential-based attacks.

Not every employee needs access to every client file. Role-based access controls ensure that a compromised account — or a departing employee — cannot access data beyond what their role required. Overly permissive access is one of the most common gaps discovered in accounting firm security assessments.

Accountants accessing client data from home over an unsecured connection represents a significant exposure. Remote access should be channeled through a properly configured VPN or a zero-trust remote access solution — not ad hoc screen sharing or consumer remote desktop tools.

Backups that have never been tested are a liability, not an asset. Verify that your QuickBooks company file, client documents, and email are backed up automatically, that the backups are completing successfully, and that you have tested a restoration — not just assumed it would work.

Ransomware routinely attempts to encrypt or delete accessible backups before triggering the encryption of primary data. An effective backup strategy requires at least one copy that is off-network, immutable, or both — so that a ransomware attack does not take both your data and your recovery option.

Sending tax returns, financial statements, and W-2s via unencrypted email is a privacy and liability risk. Secure client portals or encrypted file delivery ensure that sensitive documents cannot be intercepted or accessed by unintended recipients.

Accounting firms are high-value targets for phishing attacks because of the financial data they hold and the wire transfers they routinely facilitate. Advanced email filtering, anti-spoofing controls (SPF, DKIM, DMARC), and staff awareness training are all part of a complete email security posture.

Modern endpoint protection goes beyond traditional antivirus — it uses behavioral detection and active monitoring to identify and stop threats before they cause damage. Workstations that are not actively protected and monitored represent silent attack surfaces.

Many firms discover mid-claim that their coverage is disputed because they represented having controls that were not actually in place. Your cyber insurance policy has specific technical requirements — MFA, endpoint protection, backup practices, incident response procedures. Verify you can document compliance with each of them.

When a security incident occurs — a ransomware attack, a data breach, a phishing compromise — the first hour matters most. A documented incident response plan ensures the right people take the right steps quickly, limiting damage and satisfying the notification requirements your state and your insurance policy require.