Cyber Security for Accountants: The Essential Eight

Cyber security for accountants starts with named access, multi-factor sign-in and a safe way to receive client documents. Use this checklist to assign the work, protect ATO access and keep TFNs out of staff inboxes.

The Checklist at a Glance

Print this list and write a staff name beside each owner. The checking intervals below are a practical starting schedule for a small practice.

Client Data

1. Turn on multi-factor authentication for every service holding client data, including email, document storage and your tax software. Owner: IT provider. Check monthly and whenever you add a service.
2. Restrict client folders and TFNs to staff who need them. Owner: practice manager. Check monthly and when someone changes roles.
3. Replace document attachments with an approved portal or secure file link. Owner: practice manager. Check each new-client request.
4. Keep a retention register and arrange secure disposal when lawful retention and use end. Owner: principal. Check annually and before disposing of devices.

ATO Access

5. Give each authorised staff member their own myID and business authorisation. Owner: principal. Check monthly and remove leavers on their last day.
6. Confirm refund bank changes through a number already on file and record approval. Owner: practice manager. Check every change.
7. Review unexpected lodgements and bank changes against the job record. Owner: practice manager. Check each working day.

Devices

8. Keep supported software updated and check that device protection is running. Owner: IT provider. Monitor continuously and report exceptions weekly.
9. Require encrypted devices, screen locks and separate administrator accounts. Owner: IT provider. Check monthly and before issuing a device.
10. Back up client records and test restoring a usable file. Owner: IT provider. Check backup results daily and test recovery quarterly.

Email

11. Require mailbox multi-factor sign-in and investigate unexpected forwarding rules. Owner: IT provider. Check monthly and after a suspicious sign-in.
12. Set up SPF, DKIM and DMARC for the practice domain, plus external-sender warnings. Owner: IT provider. Check after configuration changes and review reports monthly.

Staff

13. Teach staff to report suspicious messages to the practice manager without opening links or attachments. Owner: practice manager. Cover induction and refresh before tax season.
14. Run a phishing simulation and discuss what staff noticed. Owner: practice manager. Repeat quarterly and keep attendance and outcomes.

Written Policies

15. Approve acceptable use rules and have staff sign them. Owner: principal. Check at induction and review annually.
16. Keep incident contacts and escalation instructions available outside the affected computer. Owner: practice manager. Check quarterly and whenever a contact changes.

For the first week, finish items 1, 5, 3, 6 and 10 in that order. Confirm sign-in protection works, obsolete access is removed and the secure document link reaches the intended client. Ask the IT provider to demonstrate a restored file you can open. Record unfinished work with an owner and completion target.

What Your Duties Require You to Protect

Your confidentiality duties cover client information wherever the practice holds or shares it. Under Code item 6 in section 30-10 of the Tax Agent Services Act, disclosure needs client permission or a legal duty. The TPB’s confidentiality guidance includes cloud storage and outsourced services in this responsibility.

Weak security can therefore become a professional conduct matter. The TPB’s guidance on TFNs in email explains that failing to take reasonable protective steps can have Code consequences. A breach does not automatically prove a Code breach. The circumstances and precautions matter.

The OAIC’s TFN Rule guidance requires reasonable safeguards against misuse, loss and unauthorised access, modification or disclosure. Limit TFN access to people who need it for an authorised purpose. Securely destroy or permanently de-identify TFN information when lawful retention and permitted need end. Check retention duties before deleting records.

Criminals value TFNs, identity documents, bank details, ATO access and business records. Together, these can support identity theft and refund fraud. Stolen agent access can let a criminal lodge returns or redirect refunds through the practice’s access. Protect the authority to act as carefully as the documents supporting it.

Protecting ATO Online Services Access and Client Refunds

Each staff member who needs ATO access must use their own myID and their own authorisation to act for the practice. Never share the principal’s identity or approve a sign-in request somebody else initiated. Relationship Authorisation Manager (RAM) manages business authorisations. ATO Access Manager sets the permissions needed for individual duties.

Use Standard or Strong myID for ordinary staff access. Strong identity strength is needed for a principal authority linking a business online in RAM. An assisted route exists where Strong is unavailable. A Basic identity has a separate restricted access process. These are different requirements from a taxpayer’s access through myGov.

Keep the RAM authorisation guide beside your access register. Review authorisations and ATO permissions monthly. Remove a leaver’s access on their last day, including document storage and mailboxes. A role change also needs a review of permissions.

Never change a client’s refund bank details on an email request alone. Call a number already in the client record, establish who you are speaking with and confirm the request. Record the conversation, the approved account and the staff member who approves the change. Use a second staff check before updating the record.

Watch for lodgements nobody prepared, refund account changes nobody approved and clients unexpectedly leaving the agent list. Treat an unexplained event as a suspected incident. The principal must contact the ATO through its registered agent support channel and follow its data breach guidance for tax professionals. Notify the practice’s incident lead immediately. Use the incident response plan for technical escalation and recovery.

Place the Mitigation Plan Within Your Duties

The Australian Signals Directorate’s Essential Eight is one model for reducing cyber risks within your wider client-information responsibilities. Its maturity model says additional measures can be needed for the organisation’s environment. Applying it does not remove confidentiality, safe document handling or staff responsibilities.

Private tax practices do not become subject to government security policy simply by being registered agents. A contract or another applicable requirement can set a specific security standard. Record that requirement separately from the practice’s chosen mitigation target.

Give your principal and IT provider the dedicated Essential Eight checklist for maturity targets, assigned settings and assessment evidence. Keep this practice checklist for responsibilities across client records, ATO access and staff behaviour.

ASD has announced a proposed evolution into an Essentials series. Its published consultation explanation describes Essentials for enterprise IT as the first chapter, with alignment to existing Essential Eight investments. That is a proposed expansion of the guidance. The announcement does not establish that an implemented practice plan is obsolete.

Ask your IT provider to compare revised guidance with your existing settings, identify affected systems and record what changes. Keep protective measures running while the provider assesses any transition. Review the resulting actions and evidence before closing the work.

Email Security and Sending Client Information

Keep TFNs, identity documents and bank details out of plain email. A taken-over mailbox exposes stored attachments, conversation history and future messages. Criminals can also impersonate staff from the compromised account.

Email encryption can mean different things. Transport encryption protects a connection between mail systems while a message travels. Message encryption protects the message content, with access depending on the chosen method. Transport encryption alone leaves a readable attachment in the recipient’s mailbox. It does not protect that document from someone who takes over the account.

Prefer a portal or secure file-sharing service with named access and an expiry setting. Use email for the notification and messages without identity or tax numbers. The TPB’s TFN guidance also describes encrypted or password-protected attachments where email is necessary. Confirm the recipient and send any password through a separate channel.

Compare secure email providers by multi-factor sign-in, message encryption, administrator permissions, audit logs and recovery arrangements. Ask where messages, backups and support access are located. An Australian-hosted provider is an option for a practice that requires Australian storage. Confirm the actual service locations in its written terms. Hosting location alone does not establish the most secure email service.

Ask your IT provider to apply ASD’s advice on preventing fake emails. SPF identifies authorised sending systems, DKIM signs outgoing mail and DMARC tells receiving systems how to handle failed checks. Start with an inventory of legitimate senders before enforcing rejection. Add external-sender warnings and monitor mailbox forwarding rules. These settings do not stop a criminal sending from a genuinely compromised account.

Phishing Training for Practice Staff

Phishing training must teach staff how to recognise a request and how to report it. For a small team, start with a short induction session. Refresh it before tax season, then run simulated messages followed by a debrief.

Use examples of fake ATO or TPB notices, client document links, refund bank changes and access-reset requests. Include a message that pressures staff to approve a sign-in request. Teach staff to open the saved official service address independently when a message asks them to sign in.

Set one reporting instruction. Staff must avoid links and attachments and report the message to the practice manager. The manager logs it and involves IT when needed. Delete it only after the practice records the evidence and the incident lead permits deletion. If someone has already clicked or approved access, they must report that immediately.

Keep a training register with the staff member, session, completion date and any follow-up learning. Record simulation outcomes and the debrief action. This shows what the practice taught and what it changed after a missed warning.

Training Format	What the Practice Arranges	What to Record
Free ACSC material	The manager leads a discussion using official examples and staff activities	Attendance and the reporting action staff practised
Phriendly Phishing training	Short online courses, quizzes and simulated messages within the selected content package	Course completion and campaign results
IT or email provider modules	The provider assigns the modules included in your service and explains its reporting button	Completion records and how reports reach the practice manager

Phriendly Phishing’s training combines courses with phishing simulations and follow-up microlessons. Ask for a format that the whole team can complete and a report the manager can retain. For paid training, compare administration work, simulations and completion reporting. A low subscription cost cannot compensate for a programme nobody completes.

Use the ACSC small-business guide for free staff discussion material. Keep payment redirection procedures in the business email compromise guide.

Acceptable Use and a Cyber Security Policy Template

An acceptable use policy tells staff which devices and services they can use for practice work. Require approved devices and prohibit personal email or personal cloud storage for client files. Set rules for USB storage, working from home and public wifi. Staff need a clear approval route when the usual method cannot be used.

Include AI use in those rules. Name the approved services and the information staff can enter. Require approval before client information goes to a new service, including any client permission needed for disclosure. A personal AI account must not become an unrecorded destination for client documents.

Use this outline for a policy of a few pages. Under each heading, write the practice’s actual instruction and responsible role.

1. Scope: identify the staff, contractors, devices and services covered.
2. Roles: name the principal, practice manager, IT contact and incident lead.
3. Access control: require named accounts, multi-factor sign-in and prompt removal of access.
4. Data handling and TFN rules: specify approved storage, authorised sharing and retention review.
5. Email: state the document-sharing method, recipient checks and suspicious-message reporting route.
6. Devices: set approval, updating, encryption, USB and remote-working rules.
7. Backups: name what is protected, who checks failures and who confirms recovery.
8. Incident reporting: identify the trigger and link to the practice’s response instructions.
9. Review date: record the next review and what changes require an earlier review.

Have each staff member sign the policy at induction. Review it annually and when the practice changes a service or discovers a failed safeguard. Link the incident section to your data breach response plan. Keep breach assessment and notification instructions there.

Collecting New-Client Details Without Exposing Them

New-client collection brings TFNs, identity documents and bank details together. Asking for attachments puts those details in staff inboxes and makes later copies harder to track. Give the client one approved form or portal request and collect documents there.

Tax Genie collects client answers in a guided form and checks the details. TFNs are encrypted before storage and stay hidden until a staff member reveals them. Each reveal is logged. TFNs stay out of emails, exports and generated documents.

Tax Genie removes every TFN before AI reviews the answers. When staff correct an answer, the history records who changed what and when. Read how Tax Genie handles TFNs when setting the practice’s collection rules.

For example, an anonymous fictional company client can upload its requested documents through the form. Staff receive an alert and review the record instead of downloading identity attachments from an email. The manager assigns access to the staff doing that client’s work and records any approved disclosure to another provider.

Requirements to Give an Accounting Practice’s IT Provider

Give your IT provider a written brief covering named access, multi-factor sign-in, protected devices, backups, recovery tests and incident contacts. List the services that hold client information, including your tax software and cloud document storage. Assign the practice manager responsibility for confirming the provider’s work.

Record who holds administrator credentials, who can access client files and how that access is approved and logged. Set an urgent incident contact and escalation route. Require the provider to remove its access and hand over administration when the arrangement ends. The principal must also address client permission for provider access.

Support Arrangement	Staff Access and Service Scope	Recovery and Escalation Duties
Managed IT support	Agreed ongoing device, account and security administration	Name who monitors failures, runs recovery tests and handles urgent incidents
Incident-only assistance	Access granted for a defined problem, then removed	Agree the call-out route and separately assign routine backup and updating duties
Hosted desktop service	Staff use a remotely hosted working environment with defined access	Identify who restores files, the desktop and connected services, plus the provider’s escalation route

A hosted desktop does not automatically include every backup or secure every mailbox. A managed service also needs a written scope. Compare proposals by the responsibilities covered and the evidence supplied, including access reports and recovery results.

Before accepting a closed ticket, the practice manager must open the restored client file and confirm staff access works as intended. Record any missing data or permissions and return the ticket for correction. The principal signs off unresolved risks and the next review, so a completed support job has a confirmed client-record result.