Accountancy

Tax season is phishing season. Be ready for both.

fromIT helps accountancy, bookkeeping and payroll practices protect client records, stop the scams that spike around every deadline, and prove it all with Cyber Essentials.

  • Cyber Essentials certified
  • ISO 27001 practitioner
  • Fixed, published prices
Questions on your desk this year
“How do you keep client records secure?”AML
“How do you protect client data?”ICO
“Is multi-factor on every account?”Insurer
“Do you hold Cyber Essentials?”Clients
“Who do we call if it goes wrong?”You

fromIT helps you answer every one of these, with evidence.

Where attacks land

Four ways criminals target accountancy firms.

Practices hold the keys to their clients' finances. Criminals know it, and they know your calendar too.

  1. Fake HMRC emails

    Convincing messages about refunds, penalties or agent account changes, timed for the busiest weeks of the year.

  2. Payment diversion

    A criminal inside a mailbox changes the bank details on an invoice, or tells a client to pay their tax bill into the wrong account.

  3. Stolen logins

    Passwords for accounting software, payroll and your HMRC agent services account are worth a lot to the wrong person.

  4. Client records exposed

    Passports, bank statements, payslips and tax references. Everything an identity fraudster needs, in one place.

What's expected of you

Who asks, what they want, and how fromIT helps.

No professional body hands you a security checklist. They expect client information kept confidential and secure, and proof you've done it.

WhoWhat they expectHow fromIT helps
AML supervisorThe Money Laundering Regulations mean you keep ID and due diligence records for at least five years after a client leaves, and those records need protecting.Controls and written policies that keep those records safe, with a record of who has read them.
ICOAppropriate security for personal data under UK GDPR, and a report within 72 hours of a breach that puts people at risk.Controls that protect client files, and incident response that helps you decide what to report, and when.
HMRCYour agent services account sits behind 2-step verification, and access to client tax affairs must stay with the right people.Multi-factor everywhere, shared logins removed, and staff training on the HMRC scams that actually land.
InsurersMulti-factor authentication, backups, patching and staff training, asked on every renewal form.Every control in place and documented, so the form becomes a set of honest yeses.

HMRC will never email you for your password. Criminals will, every January.

FAQ

Accountancy questions

Does our professional body require Cyber Essentials?

Not as a rule. ICAEW, ACCA and the other bodies expect you to keep client information confidential and secure, but they don't name a certificate. Cyber Essentials is the simplest way to show you have the basics right, and clients and insurers recognise it.

When are accountancy firms most at risk?

Around deadlines. The run up to 31 January is when fake HMRC emails peak and everyone is at their busiest, which is exactly why criminals pick it. Training your team in the autumn pays off in January.

We're a small practice. Is this for us?

Yes. The Cyber Essentials Micro package is £595 for organisations with up to nine staff, and monthly services are priced per person, so you only pay for the team you have.

Can fromIT work with our existing IT provider?

Yes. fromIT focuses purely on security and works alongside whoever looks after your IT today. If you don't have an IT provider, fromIT recommends Adkinsio for everyday IT support.

How much does it cost?

Cyber Essentials starts at £595 as a fixed-price package, plus the IASME assessment fee. Monthly services start from £2 per person. Cyber incident response starts with a fixed £795 first response. Every price is on the site.

Protect your clients' records.
And your practice's name.

Book a 30 minute call. fromIT will look at where your practice stands today and give you a clear, fixed-price plan. No obligation, no sales script.