Cyber Cover for Accounting Firms: What It Does and Doesn't Do

Accounting firms hold exactly the information attackers value most. Tax file numbers, identity documents, bank details, payroll data, the financial workings of every client on the books. That is simply the nature of the work, and it is why cyber risk has become a standing item for practices of every size, not just the big ones.

The good news is that this is a manageable risk, and part of managing it is understanding what cyber insurance actually does. Cyber cover is one of the least understood policies a firm can hold, partly because many practitioners assume their PI policy already handles it. As we covered in our plain-English guide to what PI insurance actually covers, it generally does not. PI responds when a client alleges your professional work caused them a loss. A cyber incident is a different kind of event, and it needs its own cover. So here is what cyber insurance is for, and just as importantly, where it stops.

The situations cyber cover exists for

Rather than define cyber risk in the abstract, it is easier to look at the patterns that actually affect accounting firms. These are common incident types across the profession, not stories about any particular firm.

A payment redirected through a compromised email thread. An attacker gains access to an email account, watches the correspondence, then sends a convincing message redirecting a genuine payment to their own account. Accounting firms sit in the middle of exactly these payment conversations, which is what makes business email compromise the pattern practices most need to understand.

Ransomware locking the practice out of its own files. Client records, work in progress and correspondence become inaccessible until a ransom is demanded. Even when data is recoverable from backups, the firm faces days of disruption, recovery costs, and hard questions about what the attackers saw.

A breach exposing client identity data. If tax file numbers or identity documents are accessed, the firm faces the practical work of containing the breach, understanding what was taken, and meeting its notification obligations. Australian privacy law includes mandatory notification requirements for certain data breaches, so this is a legal process as well as a technical one.

What cyber cover typically does

Policies differ, so treat this as the general shape and check any specific policy's wording. A cyber policy is best understood as incident response plus financial protection.

On the response side, cover typically pays for the specialists a firm suddenly needs and rarely has: IT forensics to work out what happened and shut it down, legal advice on notification obligations, and support communicating with affected clients. For a small practice this response capability is arguably the most valuable part of the policy, because the first 48 hours of an incident are not the time to be searching for a forensics provider.

On the financial side, cyber policies typically cover costs of restoring data and systems, business interruption losses while the practice cannot operate normally, and claims from third parties, such as clients, affected by the breach. Some policies extend to cyber extortion costs and certain types of funds-transfer fraud, and this is precisely where wording varies most between insurers, so it deserves careful reading rather than assumption.

What cyber cover doesn't do

Cyber insurance does not replace basic security practice. Multi-factor authentication, staff awareness of phishing, tested backups and sensible access controls remain your first line, and insurers increasingly expect to see them in place. A policy is the net underneath good habits rather than a substitute for them.

It also does not cover professional negligence. If a client alleges your advice or your work caused them a loss, that is PI territory, and we have walked through what actually happens when a PI claim is made separately. The two policies are neighbours, not substitutes. A single incident can even touch both, which is one reason it helps to hold them with a provider who understands how they fit together.

And no policy can undo an incident. Cover can fund the response, the recovery and the client communication, but the calmer path is the one where strong basics mean the policy is rarely needed.

How PI and cyber fit together

Think of it this way. PI protects the firm when the alleged problem is the quality of your professional work. Cyber protects the firm when the problem is an attack on your systems or your data. An accounting practice carries both kinds of exposure by default, which is why many firms now consider the two covers together rather than treating cyber as an optional extra. Reviewing them side by side also keeps the admin simpler, with one renewal conversation instead of two.

A sensible next step

If your firm holds PI cover but has never seriously looked at cyber, or holds a cyber policy no one has read since it was taken out, a short conversation resolves it. The team at Abacus can talk through what cyber cover for accounting firms typically includes and provide a quote for your practice, with no pressure and no commitment.