There is no single cyber liability insurance amount that is appropriate for every accounting firm. A 5-person CPA firm with primarily cloud-based applications may have a very different exposure than a 25-person firm with larger clients, more sensitive data, higher revenue, and greater dependence on technology.
Rather than choosing coverage based only on employee count, an accounting firm should evaluate at least five factors: the information it holds, potential business interruption, incident response costs, contractual requirements, and the cybersecurity controls required by the insurer.
The firm's insurance broker or carrier should ultimately help determine appropriate coverage limits and policy terms. The IT provider's role is different. It should help the firm understand its technology environment, cybersecurity controls, recovery capabilities, and the operational impact a cyber incident could create.
Why Do Accounting Firms Need Cyber Liability Insurance?
Accounting firms can hold information that is valuable to cybercriminals, including financial records, tax information, employee information, client documents, and account credentials. And they also depend heavily on technology. Email, Microsoft 365, tax applications, document management, client portals, file storage, payroll applications, and other systems may be required throughout the workday.
A cyber incident can therefore create costs in two ways. There is the security incident itself, which may require investigation, containment, legal guidance, notification, recovery, and other response activities. Then there is the business interruption, when employees cannot access the systems or information required to work.
Cyber liability insurance can help transfer some of that financial risk, subject to the specific policy's coverage, limits, exclusions, deductibles, and other terms. The important question for leadership is not simply: "Do we have cyber insurance?" It is: "Does our coverage reasonably reflect the risks our accounting firm actually faces?"
What Determines How Much Cyber Insurance an Accounting Firm Should Carry?
A practical starting point is to evaluate five areas.
1. What Sensitive Information Does the Firm Hold?
Start with the information the firm stores or can access. Consider:
- Tax records
- Personally identifiable information
- Financial information
- Payroll information
- Employee records
- Client documents
- Banking-related information
- Microsoft 365 email and files
- Information stored in accounting and tax applications
The volume and sensitivity of that information can affect the consequences of a security incident. Firms should also understand how applicable IT compliance requirements for California accounting firms may affect the way sensitive information needs to be protected, retained, accessed, or handled. A firm should also understand where the information resides. Some may be stored locally. Some may be in Microsoft 365. Other information may reside in cloud applications or third-party platforms. Using a cloud service does not eliminate the firm's cyber risk.
2. What Would a Serious Cyber Incident Cost the Business?
Leadership should consider more than the cost of replacing a compromised computer. A significant incident could involve:
- Cybersecurity investigation
- Legal assistance
- Incident response
- Data restoration
- Business interruption
- Client notification
- Additional technical resources
- Lost employee productivity
- Recovery of systems and applications
The impact will depend heavily on the incident. For an accounting firm, timing matters too. Losing access to important systems for a day during a relatively quiet period may have a different business impact than experiencing the same outage during a major filing deadline. This is why cyber insurance discussions should consider business impact, not simply company size.
3. What Do Clients, Contracts, or Other Parties Require?
An accounting firm may not make the coverage decision entirely on its own. Clients, contracts, lenders, business partners, or other parties may establish insurance requirements. A firm working with larger organizations, for example, may encounter minimum cyber liability coverage requirements as part of a contract or vendor-management process. Those requirements should be reviewed with the firm's insurance professional. Technology leadership should also know when contractual commitments create cybersecurity requirements that the IT environment is expected to support.
4. What Cybersecurity Controls Does the Insurance Carrier Require?
This is where the IT provider becomes especially relevant. Cyber insurance requirements for small businesses can include specific questions about the organization's security practices, and those requirements may vary by insurer and policy. Depending on the insurer and policy, questions may address controls such as:
- Multi-Factor Authentication
- Endpoint security
- Email security
- Backup
- Security monitoring
- Patch management
- Administrative access
- Employee security awareness
- Incident response
- Remote access
For accounting firms that depend heavily on Microsoft 365, Microsoft 365 security should also be reviewed to understand how MFA, identity, administrative access, email security, sharing, and other protections are actually configured.
The exact requirements vary by insurer and policy. An accounting firm should not assume that having a cybersecurity product means it can answer yes to a related insurance question. For example, MFA may exist for some employees but not for every account or system contemplated by the application. The firm should understand what is actually deployed before responding.
Insurance applications should be answered accurately.
If the accounting firm is unsure about a technical question, its IT provider can help document the existing configuration, while the insurance professional can explain what the application or policy requires.
5. What Would the Firm Need to Recover?
Cyber insurance and disaster recovery solve different problems. Insurance can help address covered financial consequences of an incident. It does not restore a server, recover Microsoft 365 data, rebuild an application, or return employees to productive work. The firm still needs appropriate cybersecurity, backup, recovery, and incident-response capabilities. A documented cybersecurity incident response plan can establish who takes action, who should be contacted, how the incident is escalated, and how technical recovery and insurance-related responsibilities are coordinated. Leadership should understand:
- Which systems are business critical
- How much data could be lost
- How quickly systems need to return
- Whether recovery has been tested
- Who will coordinate the technical response
- Who should be contacted under the cyber insurance policy
Simply having backups is not enough. Periodic backup and disaster recovery testing helps determine whether critical systems and information can actually be recovered within the timeframe the accounting firm expects.
These areas should work together. Cybersecurity reduces risk. Incident response provides a process when something happens. Backup and disaster recovery help restore operations. Cyber insurance helps transfer certain financial risks according to the policy. None replaces the others.
Is $1 Million of Cyber Liability Coverage Enough for an Accounting Firm?
It may be, or it may not be. A round number such as $1 million should not be treated as a universal recommendation simply because the firm is small. Two accounting firms with 15 employees could have substantially different risk profiles. One may have relatively simple operations and smaller clients. Another may process considerably more sensitive information, serve larger organizations with contractual insurance requirements, and have substantially greater revenue exposed to an extended interruption.
Employee count is useful context, but it does not determine the potential financial impact of a cyber incident. Rather than asking whether a particular round number is "enough," leadership should ask: What credible cyber events could affect our firm, what could the financial impact be, and how much of that risk are we prepared to retain versus insure? That discussion belongs with a qualified cyber insurance professional.
Example: Two 15-Person Accounting Firms Can Have Different Needs
Consider two hypothetical accounting firms, each with 15 employees.
Firm A primarily serves small local businesses. Most of its applications are cloud based, it maintains established cybersecurity controls, and leadership has documented recovery procedures.
Firm B also has 15 employees but serves larger clients, holds a greater volume of sensitive information, has contractual insurance requirements, and depends on several systems where an extended interruption could significantly affect operations.
The two firms have the same employee count. That does not mean they should automatically purchase the same cyber liability coverage. Their data exposure, contractual obligations, operational dependencies, potential interruption costs, security controls, and risk tolerance may be different. That is why cyber liability insurance should be evaluated as a business-risk decision, not purchased from a simple employee-count formula.
What Should an Accounting Firm Review With Its IT Provider Before Applying for Cyber Insurance?
Before completing or renewing a cyber insurance application, the firm can review the technical questions with its IT provider. A practical review should verify:
- Whether MFA is deployed where required
- How endpoints are protected
- How email is secured
- How administrative privileges are controlled
- How systems are patched and monitored
- What information is backed up
- Whether recovery has been tested
- Whether an incident response process exists
- How remote access is secured
- Whether answers about the technology environment can be supported by the actual configuration
This is not about finding a way to answer the application favorably. It is about answering it accurately. If the review identifies a gap, leadership can determine with its IT and insurance professionals what should happen next.
Cyber Insurance Should Be Part of a Broader Risk Strategy
An accounting firm should not view cyber liability insurance as a substitute for cybersecurity. The stronger approach is layered, starting with core cybersecurity controls for the accounting firm that reduce the likelihood or potential impact of an incident. The firm attempts to prevent incidents through appropriate cybersecurity controls. It attempts to detect and contain incidents through monitoring and incident-response procedures. It prepares to recover through backup and disaster recovery. And it uses cyber insurance to address certain financial risks that remain.
For a 5 to 25 employee accounting firm, those disciplines do not need to become unnecessarily complicated. But they should be deliberate, documented, and periodically reviewed.
How Everleap IT Helps Accounting Firms Prepare
Everleap IT does not determine how much cyber insurance an accounting firm should purchase. That decision should be made by firm leadership with a qualified insurance professional who understands the policy, coverage, exclusions, and the firm's business risks.
Our role is on the technology side.
Everleap IT helps accounting firms evaluate and operate areas such as cybersecurity controls, Microsoft 365 security, identity and access, endpoint protection, backup and recovery, incident response readiness, documentation, and Production Readiness.
We can also help firms understand the technical questions that appear on cyber insurance applications so that leadership has better visibility into what is actually implemented.
Everleap IT helps accounting firms throughout California's Inland Empire, including Rancho Cucamonga, Upland, Ontario, Chino, Claremont, and nearby communities, operate business-critical technology with a proactive approach to security, recovery, lifecycle management, and technology planning.
The goal is not simply to qualify for insurance. It is to build an IT environment where the firm's cybersecurity controls, recovery capabilities, insurance coverage, and actual business risks are better understood before an incident occurs. If your accounting firm is preparing to apply for or renew cyber liability insurance and needs help understanding the technical controls currently in place, contact us to review your IT environment and cybersecurity posture.
