12 cyber security tips your practice should deploy

Adam Turner

The article is relevant to members in Australia and New Zealand and was current at the time of publication.

1. Undertake cyber security education

Cyber security threats often target human frailties rather than technological weaknesses, says Tyler Wise FCPA, Principal at Wise Forensics. 

“Cyber security awareness training develops a healthy scepticism, encouraging your people to slow down and think twice rather than taking every incoming email at face value,” he says.

“Employees at accounting firms should also be trained to always protect client privacy and security by not sending sensitive information like Tax File Numbers via email.”

2. Beware of Business Email Compromise scams

A form of targeted phishing, Business Email Compromise (BEC) scams are most common when attackers impersonate senior management via email, instructing employees to unwittingly transfer funds to the wrong bank account or hand over sensitive business information.

Attackers often create a false sense of urgency and strike when they know it will be difficult for targeted employees to confirm the authenticity of the request.

The best defence is to establish strict policies when it comes to verifying the authenticity of sensitive requests, Wise says.

“Accounting firms are key BEC targets because they are party to large financial transactions and they handle a lot of sensitive client information.”

“It is critical that all employees understand the nature of BEC scams and are trained to follow strict security procedures under pressure,” Wise says.

3. Develop a response plan

A Cyber Security Incident Response Plan includes internal and external communication processes in the event of an incident, as well as the roles, responsibilities, accountabilities and authorities of personnel and teams.

4. Restrict administrative privileges

“Most employees don’t need full administrative privileges on their computer to perform day-to-day tasks,” Wise says. 

“By granting employees only the minimum permissions required to do their job, it limits the damage that malicious software can inflict if it slips past your defences.”

5. Audit access to key business systems

Businesses frequently forget to revoke employee access to IT systems when they change roles or leave the business. It is important to regularly audit privileges and automatically revoke access as part of employee offboarding processes.

6. Crack down on Shadow IT

In the pursuit of productivity or convenience, employees can be tempted to use software, hardware or cloud services without the IT department’s knowledge or approval, potentially compromising security.

7. Review legacy hardware and software

Outdated hardware and software that no longer receives the latest security updates can put the business at risk through unknown or unpatched vulnerabilities, Wise says. 

“For example, Microsoft ended mainstream support for most versions of Windows 10 in October 2025, so if your computers are too old to upgrade to Windows 11, it’s time for new hardware.”

8. Back up your backups

Accounting firms should adopt a “3-2-1” backup strategy, Wise says.

“This means ensuring there are three copies of important data, stored on two different media types, with one copy kept offsite. Plus, you need to regularly test all those backups.”

9. Offboard legacy data

Retaining sensitive data unnecessarily can put accounting firms and their clients at greater risk in the event of a cyber breach. Formal processes are required for identifying and managing legacy data through secure archiving or destruction (including backups).

10. Embrace password managers

Password managers reduce the temptation for employees to rely on weak passwords that are simple to remember but easy to hack.

11. Adopt multi-factor authentication

Multi-factor authentication helps keep attackers at bay by requiring users to enter an extra form of identification, along with their login and password. 

This can be a one-time code sent via SMS or generated by a mobile app, or hardware authentication such as a Yubico USB security key.

12. AI Agents: handle with care

Agentic AI has amazing uses but there’s also a dark side. The Australian Signals Directorate warns that it can be used by hackers to discover and exploit vulnerabilities in websites, targeting many victims simultaneously. 

An attack can move from a compromise situation to data theft or extortion. Here’s some guidance.