When it comes to accounting security, firms have found themselves squarely in the crosshairs of cybercriminals. And it’s no wonder why. Accountants are a treasure trove of the personally identifiable information (PII) and financial data their clients entrust them with.
And while you may think larger firms are the preferred target for these cybercriminals, medium and smaller firms are often at higher risk.
These firms usually don’t have the accounting security defenses, cybertraining or technical resources to protect their firm from hackers. All it takes is one employee making a small mistake, like inadvertently clicking on a compromised link in a phishing email or text message, for your firm to find itself with a considerable cybersecurity problem.
To help boost data security and be prepared in the event of a cyberattack, we’ve outlined the critical components firms need for a cybersecurity incident response plan.
Get our cybersecurity checklist to help guide your accounting security planning.
Accounting security relies on having a cybersecurity incident response policy
A written incident response policy is an invaluable asset for any accounting firm. This document serves not only as your firm’s blueprint to prevent cybersecurity threats, but as a playbook for how to respond if one does occur.
This document should include the following key information:
- The members of an incident response team. They’re responsible for implementing cybersecurity measures, and they’ll respond when an event occurs. This team could include firm owners, IT staff and key vendors, as well as external teams with experience in cybersecurity.
- A detailed list of common threats to look out for. It’s important to identify potential threats and report them to the incident response team.
- An incident response plan. This allows you to control a data breach, minimize damage to affected systems and communicate the incident to the public.
- A rating system. This indicates the severity of common cyberthreats and identifies which ones should be prioritized for resolution.
- A post-mortem examination protocol. This determines how well the threat was contained and how to prevent the threat in the future.
In addition, your firm’s incident response policy may require other essential materials that are particularly relevant to your firm. This is an excellent topic for your incident response team to discuss as you determine how best to protect your firm.
The incident response cycle of a cybersecurity incident response plan
As you can probably deduce, an incident response cycle is the step-by-step process of how to deal with a cyberthreat at your accounting firm, as outlined by The Health Sector Cybersecurity Coordination Center (HC3). While the incident response cycle was written from the perspective of the health industry, the process can be applied universally to any profession, including accounting.
In other words, it details the execution of your cybersecurity incident response plan from beginning to end. So let’s cover each key stage.
Preparation and planning
This portion of the cybersecurity incident response plan should occur well before any sort of cyberthreat takes place at your firm. In fact, this is often the stage where your firm should be creating its policy in the first place.
This is the time to take stock of your firm’s hardware, software and networking capabilities—and to determine what measures should be taken to protect them. Your firm should also consider what is needed to address a cyber incident should it occur. Consider a “jump kit” that contains essentials to restore order, such as clean computer systems, access to critical files, and a tested and clean backup that will help you avoid ransomware attacks.
Preparation should also include employee training programs. After all, the employees at your firm are usually the first line of defense. If they can identify cyberthreats and prevent anyone from gaining access to your data, many security incidents can be avoided altogether.
Detection and analysis
Security incidents can come from a variety of different sources. Each requires a game plan to both prevent and deal with cyberattacks, in case one manages to get through. Here are just a handful of common cyberthreat sources your firm may encounter:
- External/removable media
- Web applications
- Emails
- Theft of equipment
- Impersonation
Your incident response team should be prepared for any cybersecurity threats that can potentially affect your data and the firm.
Containment, eradication and recovery
In this phase, the incident response plan is put into full action.
Your first step will be to determine how to contain the incident and prevent it from spreading to other critical files and causing further damage to your accounting firm. This may include temporarily shutting down access to your services and documenting any damage caused thus far.
Once contained, your firm will need to begin eradicating the threat, removing it from your networks and ensuring that any trace of it is gone. Make sure it doesn’t have a chance to continue to access your firm and cause damage.
Next comes recovery. This is where you can begin rebooting your systems, restoring access and implementing processes to ensure the threat doesn’t return. This might include resetting passwords, installing updates to your machines or servers, and restoring computers to an uninfected state.
Post-incident activities
Your firm’s post-incident activities are perhaps the most important phase of the incident response cycle. As such, you should focus on a total evaluation of the security incident:
- How did it happen?
- What steps did you take to address it?
- How quickly did you address the threat?
- What can you do in the future to ensure it doesn’t happen again?
As these discussions occur, your incident response team should revisit the preparing and planning phase. This allows you to implement new ideas to address the vulnerabilities that led to the incident.
Communication about security incidents
The final phase of the incident response plan is to communicate the breach information publicly. You’ll need to do this in a coordinated, measured way so it’s obvious that the firm has taken control of the situation.
Being truthful and accurate in communicating breach information is important to sustain trust with employees and clients throughout the event. Mention the steps that were taken to remedy the security incident. And include any steps your clients need to take to help ensure the problem is addressed on their end as well.
It’s wise to appoint a member of your incident response team to draft and/or deliver the message. The team should agree on how to deliver this message so everyone is on the same page before it’s made public.
Prepare for a cyberattack
No one wants to be hacked. But the reality is it’s more likely a matter of “when” rather than “if” your firm will encounter a cyberattack.
Having a qualified team in place, either independently identified or organized through your cyber insurance carrier, ensures you can respond quickly and prevent data and financial losses.
Preparing for such an accounting security breach event with a written incident response plan will minimize the financial and reputational damage a firm will experience.
Learn more about how to prevent security incidents from affecting your firm with these six steps.