Accountancy firms are an outsized cyber target. A 25-person UK practice typically holds payroll for 600+ employees across 80 clients, VAT records for 200 businesses, the personal tax data of hundreds of self-assessment clients, plus client bank account details for direct-debit and BACS submissions. From an attacker’s point of view, that’s a far better hit-rate than attacking 80 separate businesses individually.
Recent UK data backs this up. The 2024 Cyber Security Breaches Survey identified professional services as one of the three highest-incidence sectors. ICO enforcement actions against UK accountants have risen sharply post-2023, with several £10,000+ monetary penalties for failures around encryption, MFA and phishing controls. This guide explains what UK accountancy firms specifically need to do in 2026 — the regulatory expectations, the practical controls, and realistic costs.
What UK regulators actually expect from accountancy practices
ICAEW (Institute of Chartered Accountants in England & Wales)
ICAEW expects member firms to comply with the Code of Ethics and the Audit Regulations where applicable. Cyber security is folded into the “Confidentiality” principle (5.140) and the “Professional Competence and Due Care” principle (5.130). Practical implications: documented data-protection controls, encryption of client data in transit and at rest, breach-notification procedures aligned to UK GDPR, and proportionate technical controls relative to firm size. ICAEW publishes specific cyber-security guidance for members, recommending Cyber Essentials as a baseline.
ACCA (Association of Chartered Certified Accountants)
ACCA’s Code of Ethics and Conduct similarly requires confidentiality and competence. ACCA’s 2024 update strengthened the technology-and-ethics guidance, addressing AI tools, client data hosted in cloud SaaS, and remote working scenarios.
AAT (Association of Accounting Technicians)
AAT licensed members must comply with the AAT Code of Professional Ethics, which covers confidentiality and the safeguarding of client information. AAT requires Member in Practice firms to hold professional indemnity insurance covering cyber-related claims.
HMRC Agent Standard
HMRC’s Standard for Agents (April 2024) explicitly references the need to protect client information and comply with data-protection law. Authorised tax agents have an HMRC duty of care for client data exchanged via Agent Services Account, and HMRC has increased monitoring of agent-account compromises following the 2023 spike in fake repayment-claim fraud.
FCA (where applicable)
If your practice is FCA-authorised (CF/IFA designation, regulated investment advice, mortgage broking), you fall under the FCA’s operational resilience and SYSC 13 / SYSC 18 requirements. From 2026, in-scope firms also need to align with DORA-equivalent expectations on third-party ICT risk and cyber incident reporting.
UK GDPR & the ICO
Regardless of which professional body regulates the firm, all UK accountancy practices are data controllers under UK GDPR for client personal data. ICO enforcement against accountants has focused on: lack of MFA on email (most common), unencrypted laptops with payroll data, failure to notify the ICO within 72 hours of a breach, inadequate sub-processor due diligence on cloud apps. Recent UK accountancy ICO fines have ranged £3,500–£25,000.
The threats UK accountancy firms actually face
1. Payroll diversion fraud
An attacker compromises a partner’s email account, then emails a client’s HR contact “please update employee X’s bank account before this Friday’s payroll run.” Funds go to the attacker. UK payroll-diversion losses run into millions per year and almost always start with a compromised accountancy firm email account. More on BEC here.
2. Tax repayment fraud
Compromised Agent Services Account credentials are used to file fraudulent self-assessment repayment claims for the agent’s clients. HMRC has tightened controls but the attack pattern persists.
3. Ransomware during tax season
Attackers time ransomware deployments for late January / early February to maximise leverage. A practice that can’t access client data when self-assessment deadlines loom has dramatically reduced bargaining power.
4. Phishing of trainee staff
First-year trainees are statistically 3–5x more likely to click phishing links than partners. Attackers know this and target trainee mailboxes during exam-stress periods.
5. Cloud-app credential theft
Modern accountancy firms use 15–25 SaaS apps (Xero, QuickBooks, Sage, IRIS, CCH, Receipt Bank, Capium etc.). Credential-stuffing attacks on these apps spread laterally through firms via reused passwords and missing MFA.
The cyber controls every UK accountancy practice should have in 2026
Built specifically around the threats above and ICAEW/ACCA/AAT guidance:
Identity & access
- MFA enforced on every email account, every cloud app, every remote-access route. No exceptions for partners.
- Conditional access policies blocking sign-in from outside the UK by default; exception process for travelling partners.
- Privileged Access Management — admin accounts separate from daily-driver accounts.
- Quarterly access reviews — trainees who’ve qualified and moved sectors regularly retain logins for years.
Email security
- SPF, DKIM, DMARC properly configured (most accountancy firms we audit have DMARC at p=none, which is no protection).
- Microsoft Defender for Office 365 P1 (included in M365 Business Premium) or equivalent third-party tier.
- External-sender warning banners, especially for emails impersonating partners.
- Anti-impersonation rules for partner names.
Endpoint protection
- EDR on every laptop, desktop and server. Microsoft Defender for Business is sufficient for most firms; Sophos Intercept X or SentinelOne for larger practices. EDR comparison here.
- BitLocker / FileVault encryption on every device.
- Centrally-managed mobile device management (MDM) via Intune or equivalent, including remote-wipe for lost or stolen devices.
Backup & recovery
- 3-2-1-1 backup strategy: 3 copies, 2 different media, 1 offsite, 1 immutable / offline.
- Tested restores monthly — not annually. A backup you haven’t tested in tax season is wishful thinking.
- Specifically include the practice management system (CCH, IRIS, Sage Practice etc.) and any database file shares, not just M365 mailboxes.
Detection & response
- Managed Detection & Response covering endpoints and email, ideally 24/7 during tax season.
- Documented incident response plan with named decision-makers (managing partner + IT lead + DPO).
- Pre-arranged DFIR firm via incident-response retainer, OR via your cyber insurer’s panel.
Compliance & governance
- Cyber Essentials certification annually as a minimum.
- Cyber Essentials Plus if you have enterprise clients or public-sector tax work.
- Documented Data Protection Impact Assessment (DPIA) for any new SaaS app handling client data.
- Annual cyber awareness training tracked per-individual, with role-specific modules for partners, trainees and admin staff.
Realistic cyber security budget for a UK accountancy firm
Three indicative budgets for differently-sized UK practices, using mid-band 2026 pricing:
3-partner sole-practice / micro firm (5–10 staff)
- Microsoft 365 Business Premium (includes Defender, MFA, Intune): £18.10 × 8 × 12 = £1,738/year
- Cyber Essentials managed: £750/year
- Awareness training: £2 × 8 × 12 = £192/year
- Backup beyond M365 retention (Datto / Spanning / Dropsuite): £3 × 8 × 12 = £288/year
- External pen test (every 2 years): £1,750/year amortised
- Total: ~£4,720/year (cyber insurance free via IASME bundled with CE).
10-partner mid-size practice (25 staff)
- M365 Business Premium: £18.10 × 25 × 12 = £5,430/year
- MDR (24/7 during tax season, business-hours otherwise) at £15/endpoint: 25 × 15 × 12 = £4,500/year
- Cyber Essentials Plus: £3,500/year
- Awareness training: £2.50 × 25 × 12 = £750/year
- Practice-management backup add-on: £1,200/year
- Annual external pen test: £5,000
- Cyber insurance (£2m cover): £3,500/year
- Total: ~£23,880/year (~£80/user/month all-in).
30+ partner regional firm (80–150 staff)
- Premium tier managed cyber including SIEM & threat hunting: £30 × 100 × 12 = £36,000/year
- M365 E3/E5 mix: £38,000/year
- Cyber Essentials Plus + ISO 27001 surveillance: £9,000/year
- Awareness training + role-specific modules: £4,000/year
- Pen testing (web app + external + internal annual): £15,000/year
- Cyber insurance (£5m cover): £9,000/year
- IR retainer with UK CREST firm: £6,000/year
- Total: ~£117,000/year (~£100/user/month).
Tax-season-specific cyber checklist
Self-assessment season is when UK accountancy firms have the highest cyber risk and the lowest tolerance for downtime. Six weeks before 31 January:
- Run a tabletop exercise covering “ransomware deploys on 27 January” with named partner-level decision-makers.
- Test full restore of practice-management database from immutable backup.
- Verify your IR retainer is current and out-of-hours hotline tested.
- Push refresher phishing-simulation training; pay particular attention to trainee mailboxes.
- Review external-sender rules for partner-impersonation patterns.
- Confirm cyber insurance cover renewed and the BEC sub-limit is realistic for your client size.
- Verify HMRC Agent Services Account credentials are tied to MFA-protected accounts and admin access is monitored.
Frequently Asked Questions
Cyber Essentials isn’t mandated by ICAEW, ACCA or AAT directly — but it is the most credible way to demonstrate the “proportionate technical controls” expected under each body’s Code of Ethics. Several UK accountancy networks (e.g. Kreston, MGI, IAPA) now require members to certify. Audit clients in regulated sectors (FCA-authorised, NHS suppliers) increasingly require Cyber Essentials Plus from their auditors. Practical answer: certify it — the cost is small, the diagnostic value is significant, and it pre-empts client questions.
UK GDPR requires you to notify the ICO within 72 hours of becoming aware of a personal-data breach, unless the breach is unlikely to result in risk to data subjects. For accountancy firms holding payroll, tax and banking data, almost any breach reaches that risk threshold. Recent ICO enforcement actions against UK accountants have focused on three patterns: lack of MFA, unencrypted devices and inadequate sub-processor due diligence. The ICO publishes its breach reporting form online; in practice, your DFIR firm and cyber insurer will run the notification with you.
Realistic 2026 budgets: 3-partner sole practice ~£4,500–£6,500/year; 10-partner firm with 25 staff ~£20,000–£28,000/year; 30+ partner regional firm with 100+ staff ~£100,000–£150,000/year. As a benchmark, cyber should consume 4–7% of total IT spend for an accountancy practice (slightly above the all-sectors average because of the data sensitivity).
UK GDPR requires a Data Protection Officer only if your core activities involve large-scale, regular and systematic monitoring of individuals, or large-scale processing of special-category data. Most small accountancy firms don’t meet this threshold. However, you must still designate someone responsible for data protection compliance — typically the managing partner or operations partner — and document that designation. Many UK accountancy firms also use an outsourced DPO service for £1,500–£5,000/year to provide expert backup without the cost of a dedicated in-house DPO.
Business email compromise leading to payroll diversion fraud is the #1 active threat for UK accountancy firms in 2026. The pattern: attacker phishes a partner’s email credentials, sets up forwarding rules, monitors for emails about pending payroll runs, then emails the client’s HR contact requesting last-minute bank account changes. Average loss per incident: £25,000–£120,000. Defence: enforce MFA on every email account without exception, use anti-impersonation email rules, train HR contacts at every client to verbally verify last-minute bank account changes via a known phone number.
NCSC and ICO guidance is to avoid paying ransomware demands wherever possible. UK sanctions law also prohibits payments to threat actors on the consolidated sanctions list, with potential criminal liability for directors. The practical answer for UK accountancy firms: maintain immutable backups so paying is never the only option, hold cyber insurance with a credible IR retainer, and document the ransomware decision-making process before an incident happens (not during one). If your only path to recovery is to pay, the underlying defence has already failed and you have a wider cyber programme problem.
Want a UK accountancy-aware cyber security review of your practice? Request a free cyber gap analysis — we’ll cover the controls ICAEW, ACCA, AAT and the ICO actually expect, and identify the gaps that would cause a Cyber Essentials Plus audit failure or insurer-claim rejection. See also our guide to UK cyber security companies.
Related Reading
More from the Connection Technologies blog.