Cyber Insurance for Accounting Firms: What Underwriters Ask at Renewal

Accounting Firms Already Have a Security Mandate

Under the Gramm-Leach-Bliley Act, tax and accounting firms are treated as financial institutions for data security purposes. IRS Publication 4557, Safeguarding Taxpayer Data, states that under the FTC Safeguards Rule, tax return preparers must create and enact security plans to protect client data, and that failing to do so can lead to an FTC investigation. The IRS points firms to Publication 5708 for building a written information security plan, or WISP; its August 2024 update reflects the rule’s multi-factor authentication requirement and its obligation to report certain breaches to the FTC.

That matters at renewal. Most of what a cyber insurer asks about is something the Safeguards Rule already expects an accounting firm to have in writing.

What Underwriters Ask Now

Questions vary by carrier, but most applications return to the same themes:

• MFA: is it enforced on every account, including email, remote access, and administrator accounts?
• Endpoint detection and response: does every device run it, and is someone monitoring alerts around the clock?
• Backups: are they immutable, stored separately from the network, and tested with documented restores?
• Incident response: is there a written plan with named roles, and has it been exercised?
• Email and wire fraud controls: is there a written policy requiring out-of-band verification of any payment or wire instruction change?
• Privileged access: are administrator accounts separate from everyday accounts?
• Training: is there security awareness training with phishing simulation and completion records?

Every question maps to a control. The firms that renew smoothly can answer each one in writing, with a screenshot, report, or policy to back it up.

MFA and Endpoint Coverage Come First

MFA and endpoint protection are usually the first things an underwriter checks, and partial coverage is the most common problem. The gaps tend to hide in predictable places: a partner’s home laptop, seasonal tax staff, a shared scanning mailbox, or an old administrator account nobody uses. Closing them means enforcing MFA through Conditional Access for every account, deploying endpoint detection and response on every device the firm manages, and exporting the reports that prove it. Our managed cybersecurity service runs both controls with 24/7 monitoring.

Backups, Restores, and Incident Response

“We have backups” is no longer enough. Underwriters want to know whether backups of the tax application, document management system, and Microsoft 365 are immutable, kept off the main network, and restored successfully on a schedule. A restore log is the evidence.

The incident response plan gets similar scrutiny: a written plan naming who does what, how to reach the carrier’s breach hotline, when to call outside counsel, and when the plan was last exercised. The Safeguards Rule separately expects a written incident response plan as part of the security program, so the same document serves both purposes.

Show Progress With a Secure Score Trend

Microsoft Secure Score grades a Microsoft 365 tenant against identity, device, and data controls. A current score with a trend line over the last several months is a compact way to show an underwriter that controls are in place and improving. Our Microsoft Secure Score review shows where a firm stands and which changes move the number most. For a parallel look at how carriers evaluate another professional services segment, see our guide to cyber insurance for law firms.

How VirtuWorks Prepares Firms for Renewal

Every VirtuWorks managed plan includes enforced MFA and Conditional Access, Microsoft Defender on every managed device monitored by our in-house Security Operations Center, documented incident response playbooks, backup monitoring with quarterly restoration testing, and 365-day sign-in log retention. Our team completes cyber insurance questionnaires for clients with evidence already on file.

Firms that want formal compliance evidence add the Compliance and AI Readiness Add-On, $59.99 per user per month on any managed plan. It adds compliance management mapped to GLBA and other frameworks, security awareness training with phishing simulation for firms of 25 or more users, Privileged Identity Management for time-limited administrator access, and vulnerability remediation tracked to closure. See how this fits tax-season workflows on our accounting IT support page.

Where to Start

Pull last year’s application and mark every question you could not answer with evidence. That list is your renewal plan. Schedule a Call and we will review your application against your current environment and map what to close before your renewal date.