Security, backup & IT

What a small firm has to be able to show

A firm holds every client's identity documents, bank details and tax file, which makes it a target regardless of size. What a client, insurer or regulator asks to see is consistent: multi-factor sign-in on every system, a way to remove a departed staff member's access in one place, devices that are encrypted and can be wiped, backups of the cloud data the firm cannot afford to lose, email that stops the obvious phishing, and a written plan that says who does what when something happens. Each maps to a tool category, and none of them is expensive at practice scale.

What to look for

Identity first: a single sign-in layer that every other tool accepts, with multi-factor enforced and a leaver process that is one click. Password management for the systems that cannot use it, shared vaults per team. Device management that enforces encryption and updates on laptops and phones, and can wipe a lost one. Backup that covers the cloud systems (email, documents, the ledger data the firm holds), with a restore the firm has actually tested. Email security that filters and warns. And a monitoring or managed service that watches all of it, because a small firm has nobody to watch a dashboard.

For firms with offshore or outsourced staff, access scoped by role and by location matters as much as any of it.

Buying it as a service

Most small firms should not run this themselves. A managed provider that specialises in accounting practices brings the tools, the plan, the monitoring and the answer to the insurer's questionnaire. The firm's job is to choose one that knows the practice systems and ledgers, to own the leaver process, and to test the restore once a year. The cost is a line in overhead; the alternative is a partner's weekend.

The written plan matters more than any tool. It is what the tax authority in some countries requires of preparers, what the insurer reads, and what the team follows at two in the morning. It should fit on a few pages and name people.

Pricing and how firms recover it

Vendors price per user per month, per device, or as a managed bundle per user. The directory records what vendors publish; it does not say what a firm should charge, and nothing here is fee advice. Firms describe treating security as overhead inside every fee, and sometimes offering a security review to clients as an advisory service once the firm's own house is in order.

Client data in AI tools

The newest question a client asks is where their data goes when the firm uses an AI assistant. The answer belongs in the security plan: which tools are approved, what they may read, where the data is stored, and what the firm has agreed with the vendor. A firm that can answer in one paragraph keeps the client; one that cannot is guessing.

What to avoid

Multi-factor on some systems and not others. A leaver process that is a list of tools to remember. Backups never restored. A security plan written for the insurer and never read. Consumer tools on staff devices holding client files. And running all of this in-house with nobody whose job it is.