73%
of accounting firms lack a Written Information Security Plan
$3.8M
average cost of a data breach at a CPA firm
58/100
average Cyber Insurance Readiness Score for accounting firms
52%
of CPA firm applications require remediation before binding
Top Risks
Critical cyber risks for accounting firms
Tax season phishing campaigns targeting client PII and financial data
Wire fraud through compromised email accounts impersonating CPAs
Failure to comply with IRS Publication 4557 and FTC Safeguards Rule
Unsecured client portals exposing Social Security numbers and tax returns
Third-party software vulnerabilities in tax preparation and accounting platforms
Underwriting Failures
Why accounting firms get denied
These are the most common reasons cyber insurance carriers decline or require remediation from accounting firms before binding coverage.
No MFA on email, client portals, or cloud accounting platforms
Missing Written Information Security Plan (WISP) required by IRS and FTC
No encrypted backup solution or tested restoration procedures
Lack of security awareness training documentation for staff handling tax data
Benchmark Scores
Accounting Firms readiness by category
Email Authentication (SPF/DKIM/DMARC)
TLS/SSL Configuration
Security Headers
DNS Security
Open Ports & Services
Overall Readiness
FAQ
Frequently asked questions
Why do accounting firms score so low on cyber insurance readiness?
Accounting firms handle the most sensitive financial data — Social Security numbers, bank accounts, tax returns, and payroll records — yet many operate without basic controls like MFA, email authentication, or a formal Written Information Security Plan. The combination of high-value data and weak security posture makes them among the hardest professional services firms to insure.
What is the FTC Safeguards Rule and how does it affect cyber insurance?
The FTC Safeguards Rule requires financial institutions, including CPA firms and tax preparers, to develop, implement, and maintain a comprehensive information security program. Carriers increasingly ask about Safeguards Rule compliance on applications. Firms without a compliant program face higher premiums or outright denial.
What controls should a CPA firm implement first?
Priority one is MFA on all email and client portal access. Priority two is implementing a Written Information Security Plan (WISP) per IRS Publication 4557. Priority three is configuring SPF, DKIM, and DMARC to prevent email spoofing. These three steps address the most common underwriting failures and regulatory gaps simultaneously.
How does IRS Publication 4557 relate to cyber insurance?
IRS Publication 4557 outlines minimum security requirements for tax professionals including encryption, MFA, WISP documentation, and employee training. Carriers view IRS 4557 compliance as a baseline — firms that cannot demonstrate adherence are considered higher risk. Many cyber insurance applications now include specific questions about WISP and IRS compliance.
Check your readiness in 60 seconds.
100 tools. No installation. No credit card. Real evidence carriers trust.