For accounting and bookkeeping practices
Cyber insurance for accounting firms and bookkeepers
The short answer
Accounting practices answer the standard cyber insurance questions, with two twists. You hold tax and payroll data for every client, so carriers weight data protection and email security heavily. And the FTC Safeguards Rule already requires many tax preparers and accounting firms to keep a written information security program, which is most of what an application asks to see.
What's different about accounting and bookkeeping practices
You're a data concentrator. One compromised mailbox in a fifteen-person firm can expose Social Security numbers, bank details and payroll records for hundreds of businesses and thousands of individuals. Underwriters price that concentration, and they ask about it in the data-protection and email sections of the form.
Season matters. From January to April your staff are moving faster, opening more attachments from more unfamiliar addresses, and approving more payments than at any other time. A phishing email that would be obvious in September lands differently in March. Carriers don't ask about seasonality directly, but the training and email-security answers are how they get at it.
Seasonal help is the gap nobody writes down. Contract preparers, an offshore bookkeeping team, a part-timer who comes back every January: each one needs access to client data, and each one should lose it in April. Carriers ask about account provisioning and removal precisely because seasonal access tends to be granted quickly and revoked never.
The useful news: if the FTC Safeguards Rule applies to your practice, you are already required to have written security policies, a named coordinator and a documented risk assessment. That's not a separate project from the insurance application. It's the same documents, and carriers read them as a sign the firm takes this seriously.
What already applies to you, before any insurer asks
These aren't insurance requirements. They're obligations that exist whether you buy a policy or not, and the paperwork they call for is most of what an application wants to see.
FTC Safeguards Rule (under the Gramm-Leach-Bliley Act)
The rule reaches further than most practices expect, because the definition of a financial institution includes many tax preparers and accounting firms. Where it applies, you need a written information security program, a named person accountable for it, a risk assessment, and specific safeguards including multi-factor authentication and encryption. Check applicability with your own advisor, because it turns on what services you provide.
State breach-notification laws
You hold personal data for clients in whatever states they operate in, so a single incident can trigger several notification regimes at once, each with its own clock. Tax and payroll records usually contain exactly the identifiers that make notification mandatory rather than discretionary, which is why the question of what was in a compromised mailbox matters so much.
General information, not legal advice. Whether a rule applies to your business turns on facts we don't know about it, so confirm with your own advisor.
The questions carriers weight hardest here
Every application covers the same ten control areas. All of them are written out here. These are the ones an underwriter reads twice for accounting and bookkeeping practices.
What protections sit in front of your business email?
Why it's weighted here: Client tax documents arrive and leave by email, which makes the mailbox both the crown jewels and the front door.
If the answer is no: Move email to Microsoft 365 or Google Workspace if self-hosted; enable their anti-phishing protections and SPF/DKIM/DMARC.
Your written evidence: Email Security Policy §3 Technical protections (enabled and verified)
Is multi-factor authentication (MFA) required on all business email accounts?
Why it's weighted here: One phished credential exposes every client file in that mailbox, which is why carriers treat partial MFA as a no.
If the answer is no: Enable enforced MFA in Microsoft 365 / Google Workspace today. Built-in, free, typically an afternoon including user comms.
Your written evidence: Password & Multi-Factor Authentication Policy §3 Multi-factor authentication (MFA)
How often do employees receive security awareness training?
Why it's weighted here: Filing season is when a rushed staffer approves something they'd normally question, and documented training is the control carriers can verify.
If the answer is no: Start simple: a 30-minute session this month using ready-made materials, an attendance sheet, and a calendar reminder for next quarter.
Your written evidence: Security Awareness Training Policy §4 Documentation (the part underwriters ask about)
Before changing bank details or sending an unusual payment, do you verify by phone using a known number?
Why it's weighted here: Practices that run client payroll or move funds get the payment-verification questions that bookkeeping exposure invites.
If the answer is no: Institute the call-back rule today and tell every person who can move money. It's free and it prevents the most frequent claim type outright.
Your written evidence: Funds-Transfer & Payment Verification Procedure, The verification steps
Evidence to have ready
- Your written information security program and the name of the person accountable for it, if the Safeguards Rule applies to you
- Your most recent documented risk assessment, with a date on it
- Evidence that client data at rest is encrypted, including on laptops that leave the office
The written half of that list is what the Readiness Pack is: Data Protection & Classification Policy, Email Security Policy, Password & Multi-Factor Authentication Policy, Security Awareness Training Policy, each personalized to your business and mapped to the question it answers.
Common questions
Does the FTC Safeguards Rule really apply to a small bookkeeping practice?+
It can, and many practices are surprised by that. The rule's definition of a financial institution is broader than banks, and it has been read to cover tax preparation and similar services. Whether it covers you depends on what you actually do, so confirm it with your own advisor. If it does apply, the written program it requires is largely the same paperwork a cyber application asks for.
We use a portal for client documents. Is that enough?+
A portal is a real improvement over email attachments, and worth saying on the application. It doesn't answer the other questions: whether MFA is enforced on staff accounts, whether the portal's admin accounts are protected, what happens when a seasonal preparer leaves, and whether anyone has tested a restore of the data behind it.
We use contract or offshore preparers. What does the application ask?+
It asks whether third parties with access to your data are vetted and whether their access is controlled, and the honest answer needs a list. Write down every contractor and outsourced team, what system each one reaches, and when their access ends. If the Safeguards Rule applies to you, overseeing service providers is an explicit requirement, so the same list serves both purposes.
What should we do before filing season, not after?+
Three things, in this order. Enforce MFA on every mailbox. Run one training session with a dated attendance record, aimed specifically at seasonal pressure and fake client emails. Write the payment call-back rule down and have staff acknowledge it. All three are free, and all three are questions on the form.
Sources
See where your practice stands, free
Sixteen questions, five minutes, a score across the ten control areas underwriters probe, and your three biggest gaps with the fix for each. No email needed for the score.