An accounting firm should secure remote and hybrid employees by protecting six areas: identity, computers, access, client data, network connections, and ongoing monitoring.
For a 5 to 25 employee accounting firm, remote security should not depend on whether an employee is working from the office, home, a client location, or somewhere else. The same basic security controls should follow the employee and the firm's data wherever work occurs.
At minimum, firms should use multi-factor authentication, managed business computers, endpoint security, controlled access to applications and data, secure file-sharing methods, and centralized monitoring and support.
The goal is not to recreate the office network inside every employee's home. It is to make the employee's identity, device, applications, and data secure regardless of location.
1. Start With the Employee's Identity
For remote employees, identity becomes one of the most important security boundaries. Strong password management and identity security help protect accounts when employees access business systems from outside the firm's physical network. employee working outside the office may access Microsoft 365, tax applications, document-management systems, client portals, cloud accounting applications, and other business systems without ever connecting to the firm's physical network. That makes a stolen password particularly valuable to an attacker.
Accounting firms should protect remote access with controls such as:
- Multi-factor authentication
- Unique user accounts
- Strong password practices
- Appropriate account permissions
- Prompt account changes when employees join, leave, or change roles
- Monitoring for suspicious authentication activity
MFA is particularly important, but firms should not assume that MFA makes an account impossible to compromise. Employees also need to recognize unexpected authentication requests. If an employee receives an MFA prompt they did not initiate, they should know not to approve it and how to report it. The same reporting process should apply when an employee believes they clicked a phishing email or disclosed credentials while working remotely.
2. Use Managed Business Computers for Remote Work
Employees should ideally perform accounting-firm work from firm-managed computers, not whatever personal computer happens to be available at home. A managed computer allows the firm's IT provider to apply and verify consistent cybersecurity controls for the accounting firm, regardless of whether the device is being used in the office or remotely. Depending on the environment, those standards may include:
- Endpoint protection
- Operating-system updates
- Application patching
- Disk encryption
- Screen-lock policies
- Approved software
- Security monitoring
- Remote support and management
This becomes especially important when employees handle tax documents, financial records, payroll information, or other sensitive client data. A personal computer may be shared with family members, run unsupported software, lack appropriate security controls, or fall outside the firm's normal monitoring.
The question should therefore be: Can the firm verify that the computer accessing its data meets its security requirements? If the answer is no, the firm has created a security blind spot.
3. Control How Employees Access Business Systems
Remote work does not automatically mean every employee needs a VPN. The appropriate access method depends on where the firm's applications and data reside. For example, an employee using Microsoft 365 and cloud-based accounting applications may have different access requirements from an employee who needs to connect to an application running on a server inside the office. Proper Microsoft 365 security for an accounting firm becomes especially important when employees regularly access email, files, and collaboration tools from outside the office. The firm should identify:
- What applications the employee needs
- Where those applications are hosted
- What information the employee needs to access
- What authentication is required
- Whether additional secure remote-access technology is necessary
If a VPN, remote desktop environment, or other remote-access system is required, it should be centrally managed rather than configured informally by individual employees.
The principle is controlled access, not simply "remote access." Employees should receive access to the systems required for their jobs without unnecessarily exposing additional systems or information.
4. Keep Client Data Inside Approved Systems
One of the easiest ways for remote work to create risk is for employees to develop their own workarounds. An employee may email a document to a personal account, save files to a home computer, use a personal cloud-storage service, or transfer information through an unapproved application because it is convenient. Those shortcuts can move client information outside the firm's managed environment. Accounting firms should establish approved methods for:
- File storage
- File sharing
- Client document exchange
- Electronic signatures
- Internal collaboration
- Remote access to business applications
Employees should know where client information is allowed to be stored and how it should be shared. This is both a technology and process issue. Providing secure tools is not enough if employees do not understand when and how to use them.
5. Treat the Home Network as an Untrusted Environment
An accounting firm's IT provider usually does not manage every device connected to an employee's home network. There may be televisions, personal computers, gaming systems, smart-home devices, phones, tablets, and equipment belonging to other household members. That is one reason the firm's security strategy should not depend entirely on trusting the network where the employee happens to be working.
Instead, protection should remain centered on the managed computer, employee identity, authentication, application access, and data. Employees should still follow reasonable practices at home, including securing their Wi-Fi and avoiding unnecessary use of unknown or unsecured networks.
Public locations introduce additional considerations. An employee working from a hotel, airport, coffee shop, or shared workspace should also consider the physical exposure of the screen, conversations, printed documents, and equipment.
Remote security is not limited to cybersecurity software. Sometimes the risk is simply another person being able to see or hear confidential client information.
6. Make Remote Employees Part of Normal IT Operations
Remote employees should not become invisible to the firm's IT processes. Their computers still need:
- Security updates
- Endpoint monitoring
- Hardware lifecycle management
- Application support
- Backup consideration where applicable
- Security awareness training
- Access reviews
- Technical support
Remote computers should also remain part of the firm's normal computer replacement and hardware lifecycle planning. A laptop does not become less important to manage simply because it spends most of its time outside the office.
The firm should also know which employees work remotely, what equipment they have, and what systems they can access. This becomes particularly important when an employee leaves.
A defined IT onboarding and offboarding process becomes particularly important for remote employees. Remote offboarding should include the same urgency as office offboarding: disable access, revoke sessions where appropriate, recover company equipment, address company data, and verify that the former employee no longer has access to business systems.
A laptop sitting in an employee's home is still part of the accounting firm's production environment.
Example: A 15-Person Accounting Firm Adds Hybrid Work
Consider a hypothetical 15-person accounting firm that previously had most employees working in the office. The firm decides that six employees can begin working from home two days each week. A weak approach would be to tell those employees to take their laptops home and assume that because they already have passwords and antivirus software, nothing else needs to change.
A better approach is to review the remote-work environment before the policy expands. The firm's IT provider might verify:
- All six employees have managed business laptops
- MFA is enabled for applicable accounts
- Devices are encrypted and centrally monitored
- Employees have only the access required for their roles
- Approved methods exist for storing and sharing client documents
- Remote access to any office-based applications is properly secured
- Employees know how to report suspicious emails or MFA requests
- Support procedures work when employees are outside the office
The firm has not created a completely separate security program for six people. It has extended its existing IT and cybersecurity standards to employees working somewhere else.
What About Employees Who Only Work From Home Occasionally?
Occasional remote work still needs controls. An employee who works from home only one day per month may access the same sensitive information as an employee who works remotely three days per week. The frequency of remote work can affect operational decisions, but it does not eliminate the underlying security requirements.
A useful rule is: If an employee can access business-critical systems or sensitive client information remotely, the firm's security controls should account for that access.
Should an Accounting Firm Allow Employees to Use Personal Computers?
For regular remote work involving sensitive accounting or client information, a firm-managed business computer generally provides much better control. Allowing personal computers creates questions the firm may not be able to answer:
- Is the operating system supported and patched?
- Is the device encrypted?
- Who else uses it?
- What security software is installed?
- Is client information being stored locally?
- Can the IT provider monitor or support it?
- What happens to firm data when the employee leaves?
There may be environments where carefully designed bring-your-own-device arrangements are appropriate, particularly when access is isolated through controlled technologies. But BYOD should be a deliberate security decision with defined controls, not something that happens simply because an employee wants to work from home.
A Simple Remote-Work Security Checklist
For a small accounting firm, the framework does not need to be complicated. Before employees routinely work outside the office, leadership should be able to answer yes to questions such as:
- Are employees using approved computers?
- Is MFA enabled where appropriate?
- Are devices patched, encrypted, and monitored?
- Is endpoint security installed and functioning?
- Do employees have only the access they need?
- Are approved file-sharing and storage methods defined?
- Is remote access centrally managed?
- Do employees know how to report a security incident?
- Can the IT provider support and monitor devices outside the office?
- Is remote access removed promptly when an employee leaves?
A "no" does not automatically mean remote work must stop. It identifies an area that should be addressed.
How Everleap IT Helps Accounting Firms Secure Hybrid Work
Remote work changes where employees operate, but it should not change the firm's expectations for security, reliability, and support.
Everleap IT helps accounting firms approach remote and hybrid technology as part of the same production environment used inside the office. That means managing identities, computers, applications, access, cybersecurity, and support consistently regardless of where employees are working.
Everleap IT helps accounting firms throughout C alifornia's Inland Empire, including Rancho Cucamonga, Upland, Ontario, Chino, Claremont, and nearby communities, operate business-critical technology through proactive IT management, cybersecurity, recovery readiness, and Production Readiness.
The objective is straightforward: employees should be able to work productively outside the office without putting the firm's systems or client information outside its control.
Talk with Everleap IT about your firm's remote and hybrid work environment to identify security or management gaps and determine whether employees have the appropriate protections wherever they work.
