Cyber Essentials is the UK government-backed baseline for cyber security, run by the NCSC with IASME. It is not compulsory for accountants, but it proves a practice has five controls in place: firewalls, secure configuration, security updates, user access control and malware protection. Self-assessed certification starts at £320 plus VAT and lasts 12 months.
Key takeaways
- Cyber Essentials is voluntary for accountancy practices but increasingly requested by clients, insurers and partners.
- Version 3.3 of the requirements has applied since 27 April 2026; missing multi-factor authentication on cloud services where it is available is a fail.
- Critical and high-risk security updates must be applied within 14 days of release.
- The NCSC lists certification from £320 plus VAT, and small organisations certifying their whole organisation get cyber liability insurance.
- Most practice risk sits in how client documents arrive and are stored, not in the office firewall.
What is Cyber Essentials, and does an accountancy practice need it?
Cyber Essentials is the minimum cyber security standard the UK government recommends for organisations of every size. The National Cyber Security Centre designed it and IASME delivers it as the official partner, through a network of certification bodies. It aims to stop the common, untargeted attacks that cause most small-business incidents.
There is no law that says an accountancy practice must hold it. The pressure comes from elsewhere. Public-sector and larger clients often ask suppliers for a certificate, insurers ask about the same controls on proposal forms, and a practice holds exactly the data criminals want: bank details, National Insurance numbers, payroll records and HMRC access.
For a practice that already runs reasonable IT, certification is mostly a matter of checking, fixing a few gaps and writing down what you do. For one that does not, it is a useful structure for fixing the gaps before a client finds them.
What do the five controls mean in a small practice?
The five technical controls are written for every kind of organisation. This table translates them into the situations a six- to ten-person practice actually has.
| Control | What it means in a practice | Typical gap |
|---|---|---|
| Firewalls | Office router and laptop firewalls switched on; default router password changed | Laptops used on home and café Wi-Fi with the firewall turned off |
| Secure configuration | Unused software and accounts removed; auto-run disabled; screen locks on | An old admin account for a former IT contractor still active |
| Security update management | Operating systems, browsers, PDF readers and accounting software patched promptly | One unsupported laptop kept “just for the old payroll software” |
| User access control | Each person has their own login; admin rights only where needed; leavers removed the same day | Shared logins to cloud accounting or email |
| Malware protection | Anti-malware active on every device; only approved apps installed | Personal phones receiving client documents with no protection |
The scope covers every device and cloud service that touches client data, including staff phones used for work email. That is usually where small practices find their biggest surprises.
What changed in Cyber Essentials v3.3?
The NCSC’s resources page confirms that version 3.3 of the requirements has been in force since 27 April 2026. The changes most relevant to practices are about cloud services and authentication rather than new controls.
- Cloud services are firmly in scope. Microsoft 365, Google Workspace, cloud accounting, payroll and document tools all count, and the practice, not the provider, is responsible for configuring them securely.
- Multi-factor authentication is a pass-or-fail item. Where a cloud service offers MFA, it must be switched on for users. Leaving it off is an automatic fail.
- The 14-day rule for updates. Critical and high-risk security updates must be installed within 14 days of release, and unsupported software must be removed or isolated.
The exact wording is in the NCSC’s Requirements for IT Infrastructure document. If your practice certified before April 2026, read it before renewal rather than assuming last year’s answers still pass.
Where does client data actually flow in a practice?
Most guides start with the firewall. In an accountancy practice the bigger risk is the route client documents take on their way in and where they end up. Map it before you answer a single assessment question.
- Arrival: how do bank statements, P60s, ID documents and payroll files reach you? Email attachments, WhatsApp photos, USB sticks and post all count.
- Storage: where do they live afterwards? Shared drives, personal desktops, email folders and download folders on laptops are common answers.
- Access: who can open them, including former staff and outside bookkeepers?
- Sending out: how do finished accounts and returns go back to clients for approval?
- Deletion: when are records removed, and from where?
Each answer points to a control. Documents arriving on a personal phone bring that phone into scope. Accounts emailed as attachments sit in mailboxes indefinitely. A single route in, such as a secure portal, and a single place to store files shrink the scope you have to defend and make the assessment much simpler.
The same map supports your data protection records and your AML file handling; our guide to AML client due diligence for accountants covers the identity documents side.
How much does Cyber Essentials cost for a small practice?
The NCSC lists self-assessed Cyber Essentials from £320 plus VAT, priced by organisation size; Cyber Essentials Plus, which adds hands-on technical testing, is quoted individually. There are two routes: register directly with IASME and complete the self-assessment yourself, or use a licensed certification body for support.
The NCSC also lists free help: a Readiness Tool that builds an action plan, a free 30-minute session with an NCSC-assured Cyber Advisor for small and medium organisations, and automatic cyber liability insurance for UK organisations with turnover under £20m that certify their whole organisation.
Worked example with illustrative figures
An eight-person practice budgets for certification. The assessment fee is £320 plus VAT. An IT contractor spends six hours replacing one unsupported laptop’s operating system, removing old accounts and turning on MFA across Microsoft 365 and the accounting software, at £75 an hour: £450. A replacement laptop costs £700. Total first-year cost: about £1,470 plus VAT, much of it work that should be done anyway. Prices vary widely, so get quotes.
Which security questions will clients and insurers ask?
Even if you never apply for the certificate, you will be asked about the same controls. Supplier questionnaires from larger clients, cyber insurance proposal forms and some lenders’ due diligence packs all cover similar ground. Having the answers written down once saves hours each time.
- Do all staff use multi-factor authentication for email and remote access? Insurers increasingly treat a “no” here as a reason to decline or load the premium.
- How quickly are security updates applied? “Within 14 days for critical updates” is the answer Cyber Essentials expects, and it is a sensible internal standard regardless.
- Are backups taken, kept separately and tested? Cyber Essentials does not assess backups, but insurers and clients often ask. Until you have restored a file from it, you do not know whether your backup works.
- How do clients send you documents, and how do you send them back? Email attachments are the answer most practices give and the one that worries reviewers most.
- Who has administrator rights, and how are leavers removed? A named person and a same-day leaver checklist is a strong answer.
- Do you train staff to spot phishing? Fake HMRC and fake client emails are the most common route into practices.
Keep a one-page security summary with these answers, the date of your last review and, if you have it, your certificate number. Update it at each renewal and attach it to tenders and insurance renewals.
A 30-day plan to certify before the January rush
The weeks before 31 January are the worst time to change IT. Aim to finish in November or early December.
| Days | Task | Output |
|---|---|---|
| 1–3 | List every device, user and cloud service; map client data flows | Asset and scope list |
| 4–7 | Run the NCSC Readiness Tool; book a Cyber Advisor session if needed | Gap list |
| 8–15 | Switch on MFA everywhere; remove shared logins and old accounts | Access register |
| 16–22 | Patch or replace unsupported devices; check anti-malware and firewalls | Update log |
| 23–27 | Move client document intake to one secure route; tidy storage | Written procedure |
| 28–30 | Complete and submit the self-assessment; board-level sign-off | Certificate |
Put the renewal date in the diary immediately. The certificate lasts 12 months, and the requirements can change between versions.
What should a practice do if a breach happens anyway?
Certification reduces risk; it does not remove it. Decide in advance who does what, because the first hours matter.
- Disconnect affected devices and reset passwords for affected accounts.
- Call your IT support and, if you have it, the incident line on your cyber insurance.
- Work out whether personal data was affected. Under UK GDPR, a personal data breach that is likely to risk people’s rights must be reported to the ICO within 72 hours of becoming aware of it; the ICO breach reporting page explains the test.
- Tell affected clients clearly what happened and what they should watch for, such as fake HMRC or bank messages.
- Record what happened and what you changed, and review it at your next renewal.
Your engagement letters should already explain how you communicate with clients and share documents; see our UK engagement letter checklist for the wording.
How Zaquil handles secure client document handling for practices
Zaquil is not a Cyber Essentials certificate and does not certify your practice. What it can do is shrink the problem the assessment examines: the scattered routes by which client data comes in, sits around and goes out.
One route in. Instead of email attachments and WhatsApp photos, the client is sent a named request in the branded secure client portal: “2025/26 P60”, “bank statements April to March”, “passport for ID check”. They upload against each item and can see what is still outstanding.
One place to store. Files land on the client record, and the practice’s own policies and templates sit in the firm-only area of the Documents hub, so nothing needs to live in personal download folders or mailboxes.
One route out. Finished accounts and returns go back through the portal for the client to approve and e-sign, with a signed PDF certificate kept on file, rather than being emailed as attachments.
One inbox. Email, chat, SMS and WhatsApp from clients arrive in a shared unified inbox, which reduces the temptation to use personal phones for client conversations, and automations chase missing documents without anyone forwarding files around.
See the accounting and tax practice setup or compare plans, each with a 14-day free trial and no card required.
Frequently asked questions
Is Cyber Essentials mandatory for accountants?
No. There is no legal requirement for UK accountancy practices to hold Cyber Essentials. It is mandatory for some central government contracts, and clients, insurers and lenders increasingly ask for it. Many practices certify because it is a recognised way to show that basic security controls are in place.
How much does Cyber Essentials cost?
The NCSC lists self-assessed Cyber Essentials from £320 plus VAT, priced by organisation size. Cyber Essentials Plus, which includes technical testing by an assessor, is quoted individually. Practices often also pay for IT time or new equipment to close gaps before submitting the assessment.
What are the five Cyber Essentials controls?
The five technical controls are firewalls, secure configuration, security update management, user access control and malware protection. Together they defend against the most common internet-based attacks, such as phishing, password guessing and exploitation of unpatched software. The NCSC sets out the detailed requirements for each control in its Requirements for IT Infrastructure document.
What changed in Cyber Essentials v3.3?
Version 3.3 has applied since 27 April 2026. It defines cloud services more clearly, makes the organisation responsible for configuring them, and treats missing multi-factor authentication on cloud services that offer it as an automatic fail. The 14-day deadline for critical and high-risk updates remains.
How long does a Cyber Essentials certificate last?
A Cyber Essentials certificate is valid for 12 months from issue. To keep it, the practice must reassess against the requirements in force at renewal, which may be a newer version than the one used last time. Diary the renewal date as soon as the certificate arrives.
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Both cover the same five controls. Cyber Essentials is a verified self-assessment signed off by a senior person and marked by an assessor. Cyber Essentials Plus adds hands-on technical testing of your systems by the certification body, so it gives higher assurance and costs more.
Do staff mobile phones count for Cyber Essentials?
Phones and tablets used to access organisational data or services, such as work email or client documents, are generally in scope, including personally owned devices. They need screen locks, supported operating systems and timely updates. Reducing what is done on phones can make the assessment simpler.
Does Cyber Essentials include insurance?
According to the NCSC, UK organisations with turnover under £20m that certify their whole organisation are automatically entitled to cyber liability insurance arranged by IASME, including incident response support. Check the current terms and how they sit alongside any policy you already hold.
How long does it take to get Cyber Essentials?
For a small practice with reasonably managed IT, preparation often takes a few weeks and the assessment itself can be marked quickly once submitted. Practices with unsupported devices, shared logins or no MFA should allow more time to fix those gaps first.
Is multi-factor authentication required for Microsoft 365?
Under version 3.3 of the requirements, multi-factor authentication must be enabled on cloud services where it is available, and Microsoft 365 offers it. Leaving MFA off for users is an automatic fail. The practice is responsible for turning it on, not Microsoft.
Does Cyber Essentials make us GDPR compliant?
No. Cyber Essentials covers technical security controls, which help with UK GDPR’s security principle, but data protection law also covers lawful basis, retention, transparency and individuals’ rights. Treat certification as one part of your data protection approach, not the whole of it.
When must a practice report a data breach to the ICO?
A personal data breach must be reported to the ICO within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people’s rights and freedoms. The ICO website has a self-assessment tool to help decide. Keep a record of every breach, reported or not.
Run this part of your business in one place
Zaquil puts every email, document, approval, invoice, call and automation for your accounting and tax practice setup in a single workspace — set up for UK practices on day one.
- Client portal with document requests, organisers, e-signatures and online payment
- Jobs with templates, checklists and recurring work; invoices and unbilled time
- One inbox for email, chat, SMS, WhatsApp and calls across every brand