Cyber Essentials for accountancy and financial advisers
Who asks accountancy and financial advisers for the certificate, which level to choose, what to gather first, the scope problems the sector brings and the questions it commonly fails.
- Mandated by
- No formal mandate; customer and funder requirements
- Common fails
- A7.17AUTO-FAILA6.2A7.3
- Typical scope
- Desktop tax software on old machines, Home-based bookkeepers, Client portals, Cloud accounting platforms
- Cyber Essentials
- From £1,500, 1 to 2 weeks, IASME fee included
- Cyber Essentials Plus
- From £3,000, 2 to 5 weeks
No professional body or regulator mandates Cyber Essentials for accountancy practices, but clients and insurers ask for it, and HMRC now requires multi-factor authentication on agent online services. Scope for a practice is the tax and accounts software, client portals, email and every device used by staff and home-based bookkeepers.
Do accountants and financial advisers need Cyber Essentials?
Not formally. No mandate from ICAEW, ACCA, the FCA or HMRC. Demand comes from clients, from professional indemnity and cyber insurers, and from central government or NHS contracts where PPN 014 applies.
Whatever the source, the contract, grant or tender is what binds you. Read it for the level it names, the scope it expects and the date the certificate must be in place, and record the reason at A1.10 when you apply.
Do accountants and financial advisers need Cyber Essentials or Cyber Essentials Plus?
Cyber Essentials is usually enough for client and insurer questionnaires. Plus is worth considering if a large client or a public sector contract names it.
Both levels use the same five controls and the same question set. Plus adds an independent audit of a sample of devices and cloud accounts, on the same scope as a valid Cyber Essentials certificate. Compare the two levels.
What should accountants and financial advisers gather before starting?
Most of the self-assessment is describing your estate accurately. Have these to hand before you open the question set and the answers take hours, not weeks.
- Every cloud platform that holds client data: Xero, QuickBooks, Sage, payroll bureaux, document portals, e-signature tools and HMRC online services (A2.9).
- Confirmation that MFA is switched on for every user of each of those platforms, with a list of any that offer no MFA at all for A7.15.
- Desktop tax and payroll software versions, and the operating system each runs on (A6.1, A6.2).
- The subcontracted or home-based bookkeepers who access client files, and the devices they use (A2.4.1, A2.6).
- Your leaver process, including how seasonal staff accounts are disabled after busy periods (A7.3).
What scope problems do accountants and financial advisers bring?
Scope must cover every device and cloud service that reaches organisational data, or a sub-set segregated by a firewall or VLAN that you can justify. These are the boundaries this sector tends to get wrong.
Desktop tax software on old machines
Legacy tax and payroll applications sometimes only run on unsupported Windows versions. The software and the operating system must both be supported.
Home-based bookkeepers
Bookkeepers using their own laptops are in scope if they access the practice's data or services.
Client portals
Document-exchange portals the practice hosts are external services that need MFA or throttling.
Cloud accounting platforms
Xero, QuickBooks, Sage and HMRC online services are cloud services in scope and need MFA for every user.
Which questions do accountants and financial advisers commonly fail?
Questions accountants and financial advisers commonly fail include A7.17AUTO-FAIL, A6.2 and A7.3. This is a typical pattern from assessor experience, not a statistic, but it is worth planning around.
| Question | Why it fails | Fix |
|---|---|---|
| A7.17AUTO-FAILHas MFA been applied to all users of your cloud services, excluding any listed in A7.15 that do not provide it? | Practices often have MFA on Microsoft 365 but not on the accounting and payroll platforms listed in A2.9. | Turn on MFA in every cloud platform that offers it, and list in A7.15 only the services that offer no MFA option at all. |
| A6.2Is all the software on your devices supported by a supplier that produces regular vulnerability fixes for any security problems? | Unsupported desktop applications that still open client files are a recurring finding. | Upgrade to the supported version or the vendor's cloud edition, or remove the application. |
| A7.3How do you ensure you have deleted, or disabled, any accounts for staff who are no longer with your organisation? | Seasonal and leaver accounts are left active in the tenant after busy periods. | Write a leaver checklist that disables the account on the last day, and review accounts each quarter. |
Frequently asked questions
Yes. Cloud accounting platforms store client data, so they are cloud services that cannot be excluded under v3.3. List each one in A2.9 and enforce MFA for every user and administrator under A7.16 and A7.17. Only a service that genuinely offers no MFA option can go in A7.15.
No. HMRC does not require the certificate. It does now require multi-factor authentication on agent online services: after the Government Gateway user ID and password, the agent enters a one-time access code. List HMRC online services in A2.9 like any other cloud service.
It covers every device, network, user account and cloud service that accesses your organisation's data or services, including staff-owned phones and laptops under BYOD. You can certify part of the organisation if the excluded networks are segregated by a firewall or VLAN (A2.1, A2.2.2), but the certificate then reads 'Partial Organisation', which a buyer may question.
Twelve months from certification, and buyers under PPN 014 expect it renewed every year of the contract. Renewal is a fresh self-assessment against the question set current at the time, so a certificate first issued under an older version is reassessed against v3.3 and the Danzell question set when it renews.
Related pages
- Microsoft 365 and Entra ID setupMFA for every user and admin
- Microsoft Office support statusOffice 2016, 2019 and 2021 end-of-support dates
- Windows 11 setupFirewall, locking and update settings
- Who needs Cyber Essentials?Government, MoD, NHS and other mandates.
- Scope: what is in and outBYOD, home working, cloud and sub-sets.
- How much does it cost?Fixed prices and IASME fee bands.
- Check your readinessFree check against the 2026 question set.
- Cyber Essentials for healthcare and care providers
- Cyber Essentials for construction and contractors
- Cyber Essentials for manufacturing
Get certified at a fixed price
Precursor is an IASME Certification Body: Cyber Essentials from £1,500 and Cyber Essentials Plus from £3,000, with the IASME fee included, a free re-test if gaps are found and a written fixed price after a 20-minute scoping call.
- IASME Certification Body
- CREST accredited
- UK offices in Leeds, Newcastle, London and Edinburgh