CyberSafeCheck Free · No sign-up · Instant score, action plan and PDF report · Mapped to Essential Eight, ISO 27001, Privacy Act, PCI-DSS, SMB1001
Why accounting and financial firms are targeted
Most attacks on accounting practices are not sophisticated. A staff email account is taken over through a fake Microsoft 365 login page, and the attacker quietly reads mail until a payment is due. Then a client, or your own team, receives an invoice or a "change of bank details" that looks completely normal.
The other common path is stolen client data. A practice's email and document storage holds years of tax returns, identity documents and financial statements. That information is valuable for identity fraud and for fraudulent refund claims lodged in your clients' names.
What the finance & accounting check asks about
The quick check has 20 questions and the full assessment 44. Both cover the fundamentals every business needs (access and passwords, devices and updates, email and phishing, backups, governance and data protection), plus questions specific to your sector:
- BEC / payment fraud controls
- PCI-DSS — cardholder data
- APRA CPS 234 / regulatory expectations
- Secure client data exchange
- Records retention obligations
- Transaction monitoring
You get a score out of 100, a breakdown by area and a prioritised action plan that shows which framework each recommendation relates to.
Obligations that may apply to you
- Tax file numbers. If you handle TFNs you must protect them under the Privacy (Tax File Number) Rule, and a breach involving TFN information is covered by the Notifiable Data Breaches scheme whatever the size of your practice.
- The Privacy Act. Practices with annual turnover above $3 million must comply with the Australian Privacy Principles, including taking reasonable steps to secure personal information.
- ATO online services. Access to Online services for agents requires multi-factor sign-in through myID, and the ATO expects practices to protect client accounts from misuse.
- Licensees and regulated entities. AFS licence holders are expected to manage cyber risk as part of their licence obligations (ASIC took RI Advice to court over exactly this in 2022), and APRA-regulated entities must meet CPS 234.
- Ransomware payments. Businesses with turnover above $3 million must report a ransomware payment to the Australian Signals Directorate within 72 hours.
Four things to do first
- Turn on multi-factor authentication for email, accounting software and remote access
- Verify every change of bank details by phone, using a number you already hold
- Move client document exchange to a secure portal rather than email attachments
- Keep tested, offline backups of practice data
Start the free finance & accounting check
Frequently asked questions
Does the Privacy Act apply to small accounting practices?
The Australian Privacy Principles generally apply to businesses with annual turnover above $3 million. However, if you hold tax file numbers, the TFN Rule applies regardless of size, and a data breach involving TFN information must be assessed and, if serious harm is likely, notified under the Notifiable Data Breaches scheme.
What is the biggest cyber risk for an accounting firm?
For most practices it is business email compromise: a staff mailbox is taken over and used to redirect payments or request client documents. Multi-factor authentication on email, plus a firm rule that bank-detail changes are verified by phone, stops most of it.
Is this check an audit?
No. It is a free self-assessment that gives you a score and a prioritised action plan. It is a good starting point and a useful record of where you stand, but it is not a formal audit, certification or legal advice.
This page and the assessment are general information and an educational guide to your security posture. They are not a formal audit, certification or legal advice.