What IT does a small accountancy practice need? A checklist

A small accountancy practice needs less IT than most suppliers will try to sell it. But the pieces it does need have to be done properly, because a practice holds what criminals want most: clients’ tax records, bank details and identity documents.

This is the checklist we work from, in plain terms, with the minimum for each item.

The checklist at a glance

1. Business email and files on Microsoft 365 or Google Workspace
2. One account per person, with multi-factor authentication on everything
3. A business password manager
4. Work devices that are supported, encrypted and managed
5. Security updates installed within 14 days
6. Email that criminals can’t fake
7. A secure way to exchange documents with clients
8. A backup that’s separate from Microsoft or Google
9. Records kept for as long as the rules require, and no longer
10. Practice software that’s licensed, supported and ready for Making Tax Digital
11. Cyber Essentials
12. A joiners and leavers process, and a plan for when things go wrong
13. A short policy on using AI

Accounts and access

1. Business email and files on one platform. Use a business plan of Microsoft 365 or Google Workspace, on your own domain, rather than free accounts, personal Dropbox folders or a server under a desk. Keep files in OneDrive and SharePoint, or Google Drive, so there’s one place that controls who can see client data, and one place to switch off when someone leaves.

2. One account per person, with multi-factor authentication. No shared logins: everyone signs in as themselves, so you know who did what. Turn on multi-factor authentication (MFA) for every account and every cloud service that offers it, practice software included. It’s the single most effective protection against a stolen password, and under Cyber Essentials a cloud service without it, where MFA is available, now fails the assessment outright. Keep administrator accounts separate from the ones people use for email and browsing.

3. A business password manager. For the passwords that remain, including shared logins to portals and suppliers, a business password manager lets people use long, unique passwords without writing them down, and lets you remove someone’s access in one place. Our guide to password security covers what to look for.

Devices

4. Work devices that are supported, encrypted and managed. Every laptop and desktop should run an operating system its maker still supports. Windows 10 reached the end of support in October 2025, so any machine still on it needs upgrading or an Extended Security Updates subscription. Turn on disk encryption (BitLocker on Windows, FileVault on a Mac), so a lost laptop doesn’t mean lost client data. And manage devices centrally, so you can enforce a screen lock, check they’re up to date and wipe one remotely if it goes missing. If people read work email on their own phones, manage the work apps on those phones too.

5. Security updates within 14 days. Turn on automatic updates for operating systems and applications, and check they’re actually installing. Critical and high-risk updates should be in within 14 days of release. That’s the Cyber Essentials standard, and the gap between a fix being published and attackers using the flaw keeps shrinking.

Email and client documents

6. Email that criminals can’t fake. Set up SPF, DKIM and DMARC on your email domain. They’re three records that tell the world which servers may send email as your practice, and what to do with anything else. Without them, it’s easy for a criminal to send a client an email that appears to come from you, asking them to pay a tax bill into a new account. Add good filtering for incoming phishing, and make it easy and blame-free for staff to report anything suspicious. The NCSC’s small organisations guide is good on why punishing people for clicking only stops them reporting.

7. A secure way to exchange documents with clients. Email attachments are the weak point in most practices: sent to the wrong address, kept for ever in inboxes and impossible to audit. A client portal or secure, expiring links fix that. Our post on what makes a great client portal sets out what to look for.

Data: backup and retention

8. A backup that’s separate from Microsoft or Google. Microsoft and Google keep your data available, but that isn’t the same as a backup you control. Deleted files and mailboxes can only be recovered for a limited time, and if ransomware or a compromised account damages your files, the damage syncs everywhere. Keep a separate backup of email and files, held apart from the originals as the NCSC recommends, and test a restore now and then. If your practice software runs on a local machine rather than in the cloud, back that up too.

9. Records kept for as long as the rules require, and no longer. Under the Money Laundering Regulations, customer due diligence records must be kept for five years after a client relationship ends, and the personal data deleted after that unless another rule requires it. Tax records have their own periods. Write down how long you keep each kind of record, and set your systems to apply it automatically where they can, rather than relying on someone remembering to tidy up.

Software

10. Practice software that’s licensed, supported and ready for Making Tax Digital. Your practice software (CCH, IRIS, TaxCalc, Xero or similar) needs to be properly licensed, on a supported version, and kept up to date. From April 2026, Making Tax Digital for Income Tax requires some sole traders and landlords to use compatible software, so check your software and your clients’ are ready. Make one person responsible for licences, renewals and updates, so nothing lapses in January.

Standards and people

11. Cyber Essentials. The scheme’s five controls cover much of this list, and certification proves it to clients, insurers and tenders. If your practice turns over less than £20m and certifies the whole organisation, it also comes with cyber liability insurance. Our Cyber Essentials page explains how it works, and our post on what changed in 2026 covers the current rules.

12. A joiners and leavers process, and a plan for when things go wrong. When someone joins, they get the access their role needs and no more. When they leave, their accounts are disabled on their last day and their devices come back. And everyone knows what to do if a laptop is lost, an account is compromised or a client’s data goes to the wrong person: who to call, how to lock things down, and whether to report it to the ICO, which for a notifiable breach means within 72 hours.

13. A short policy on using AI. Your team is probably using AI tools already. A one-page policy saying which tools are approved, on which accounts, and what client data can go into them prevents the most common problem: client data in personal accounts. Our post on using ChatGPT, Copilot and Claude with client data includes a template.

What you probably don’t need

Just as useful is what to leave out:

• A server in the office, for most practices. Cloud platforms do the same job with less to maintain, patch and lose.
• Extra security products on top of what your platform includes, until someone has checked that the built-in protection is switched on and configured. It often isn’t.
• A long contract before anyone has looked at your setup. A short review first tells you what’s missing and what’s worth paying for.

Where to start

If you’re not sure which of these you already have, start with the three that stop most attacks: multi-factor authentication on everything (2), security updates within 14 days (5), and email that can’t be faked (6). Then work through the rest.

This is close to the list we build every client’s setup to; what’s covered shows it item by item. If you’d like someone to check which boxes your practice ticks, a Technology Review goes through each one.