Professional services firms get IT security wrong in five ways, assuming they are too small to target, mistaking compliance for security, trusting Microsoft to back up their data, treating any MFA as finished, and assuming a breach would be obvious.
Nobody calls me about security.
They call about a printer. A password that stopped working. Outlook doing something strange, or a folder that was there Friday and is not there Monday. Those are the calls. I have been on the other end of that phone for close to two decades and the pattern has barely shifted. Security comes up later, usually about twenty minutes into a screen share, when I notice a mailbox rule nobody set on purpose or a machine that has not taken an update since the spring.
So this is not a threat lecture. It is the five things I hear most often from accounting practices, insurance agencies, and consulting firms across Rockland, Westchester, and Bergen, and why each one falls apart with a little pressure on it. The service side of this lives on our managed IT for professional services page. What follows is the thinking behind it. Which matters more, honestly, because a firm that has the reasoning straight will pick sensible controls with or without somebody advising them, and a firm that does not will keep spending in the wrong places no matter how good its vendor happens to be.
The Firm-Size Argument Falls Apart First
“We’re twelve people. Who would bother with us?”
Nobody is bothering with you specifically. Which is the problem, not the reassurance owners hear in it. Most of what reaches a small firm was never aimed at that firm, it was aimed at everybody with a mail server, and small offices are simply where more of it lands. Verizon’s 2025 Data Breach Investigations Report found ransomware present in 88% of breaches at small and medium businesses, against 39% at large organizations. Same weather. Very different roof.
The gap is not sophistication. Large companies employ people whose entire job is watching. A twelve-person firm has an office manager who also knows the Wi-Fi password.
And a professional services firm is an odd target in one specific way that owners rarely think through. You do not hold much of your own money. You hold everyone else’s paperwork. Returns, payroll files, Social Security numbers, bank routing details, the closing file for somebody’s building. Measured per gigabyte, that is denser and more useful than what plenty of far larger companies keep on hand. Concentrated, and portable.
Compliance Is the Floor. Firms Keep Reading It as the Ceiling.
The FTC Safeguards Rule is the federal data security regulation covering businesses that handle customer financial information, and it reaches many more professional services firms than realize it. Tax preparation firms are named in the text. It requires a written security program, a designated Qualified Individual, multi-factor authentication, encryption, staff training, and oversight of the vendors you hand data to.
Two things trip firms up here, and they are different mistakes.
Scope is the first. Plenty of accounting practices assume the Safeguards Rule is a bank rule that has nothing to do with them. The FTC’s own guidance lists tax preparation firms as covered financial institutions, right there alongside investment advisors and non-federally insured credit unions. Prepare returns for a fee and you are inside it. The IRS arrives at the same place from the other direction and publishes a fill-in Written Information Security Plan template in Publication 5708 precisely because so many practices did not know they needed one.
The small-firm carve-out is the second, and it gets misread constantly. Under 16 CFR 314.6, a firm holding customer information on fewer than 5,000 consumers is excused from exactly four sub-paragraphs. The written risk assessment documentation. The continuous monitoring or penetration-testing-plus-vulnerability-assessment schedule. The written incident response plan. The annual written report to the board or governing body. Four items. That is the complete list.
Everything else stands. Qualified Individual, MFA, encryption, access controls, training, service provider oversight, all of it.
Read that carve-out again and notice what it actually did. It removed four pieces of paperwork. It did not remove a single control. Not one.
Then there is the bigger issue underneath, which is that a firm can satisfy every line of that rule and still be trivially easy to get into. Regulations describe categories of control. They do not grade the implementation. MFA is required and nobody specifies which kind. Encryption is required and nobody inspects how you handle the keys. I have watched firms clear a client’s security questionnaire on Tuesday with nothing but a password and a text message standing between a stranger and the entire mailbox. Compliance is a floor to stand on. It was never a roof, and the firms that treat a passed questionnaire as the finish line are usually the same ones running the weakest version of every control the questionnaire happened to ask about.
Microsoft Is Not Backing Up Your Data
This one produces the longest silence on a call.
Microsoft 365 keeps your data available. Available and recoverable are not the same thing, and the gap between them is where firms get hurt. Permanently deleted mail lands in the Recoverable Items folder and sits there for 14 days by default, extendable to a maximum of 30. SharePoint and OneDrive hold deleted items across two recycle bins for 93 days. Those are retention windows. Not backups. A backup is an independent copy, held where the primary system cannot reach it, restorable to a point in time you choose.
The distinction stops being academic in the exact scenario people buy backup for. Files get encrypted on a laptop, the sync client dutifully uploads the encrypted versions, and now the cloud copy matches. Version history helps within its own limits. Somebody leaving on bad terms who deletes deliberately and then empties the recycle bin is a different problem, and a 93-day clock does not solve it if nobody notices for four months. Which happens. Departures are messy.
Firms are not being careless about this. They are reading the shared responsibility model backwards. Microsoft owns the platform, the uptime, the infrastructure. You own the data you put into it. That division is published, it is not buried, and hardly anybody reads it until the week they need it. Which is the entire reason backup and disaster recovery stays its own line item on every proposal we write instead of being folded into the cloud line.
You Turned MFA On. Which Kind?
Every firm says yes to MFA now. Genuine progress. Five years ago that answer was rare enough to be worth noting, and I want to give credit for it before I take a little of it back.
Then I ask which method. Text messages, usually.
CISA is blunt about the hierarchy. Any MFA beats no MFA. But text-message codes and plain approve-or-deny push prompts sit at the weak end, because both can be defeated without ever breaking the second factor. Push bombing just sends approval requests until somebody taps yes to make the buzzing stop. A SIM swap moves the phone number. A convincing fake login page collects the code alongside the password in real time, while the user is still typing it, and the attacker is inside before the page finishes loading. None of that touches the second factor. It routes around it.
Number matching closes most of the push-bombing gap, and it is a setting, not a project. Phishing-resistant methods close the rest. FIDO security keys and passkeys will not authenticate to a domain that is not the real one, which means the fake login page collects nothing usable. CISA describes FIDO as the only widely available phishing-resistant authentication, and for a firm holding client financial records that is worth the small amount of friction it adds.
Two things get skipped almost every time. Legacy authentication protocols, which bypass MFA entirely if they are still enabled on your tenant. And service accounts and shared mailboxes, which is exactly where somebody looks once the human accounts stop cooperating. There is a longer treatment of that in our piece on why MFA alone is not an identity strategy. Your insurance carrier has started asking these same questions on renewal applications, and answering them loosely is one of the ways claims get denied.
Assuming You Would Notice
Ask an owner how long somebody could be inside their network before anyone spotted it. Most say a day. Maybe two. They are guessing.
Mandiant’s M-Trends 2026 report, built on frontline incident response work through 2025, puts the global median dwell time at 14 days, up from 11 the year before. Median. Half of the intrusions in that data ran longer than two weeks before anyone caught them, at organizations that mostly do have security staff and logging budgets. Those same organizations spotted the activity themselves 52% of the time, which is the polite way of saying just under half of them found out because somebody outside called to tell them.
A twenty-person firm has none of that. No log retention worth the name, no alerting on a sign-in from two countries in an hour, and nothing at all watching for the forwarding rule that quietly copies every invoice to an outside address so that a payment instruction can be edited before the client ever reads it. Quiet is not the same as clean. Usually it means nobody is looking.
That is the uncomfortable version of the fifth belief. Not that something is happening. Just that if it were, the environment as it stands today has no mechanism that would raise a hand, and the confidence owners feel about this is built entirely on the absence of bad news rather than on the presence of anything watching.
The Five Beliefs, Side by Side
| What the firm believes | What is actually true | The move |
|---|---|---|
| We’re too small to be a target | Ransomware was present in 88% of SMB breaches in the 2025 DBIR, against 39% at large organizations | Stop budgeting for attention you are not getting and start budgeting for volume |
| We’re compliant, so we’re covered | The under-5,000-consumer carve-out drops four sub-paragraphs of paperwork and zero controls | Name a Qualified Individual, write the WISP, then keep going past it |
| Microsoft backs up our email and files | 14 days for deleted mail by default, 93 days for SharePoint and OneDrive, then gone | Add a third-party backup with its own retention and restore testing |
| We have MFA turned on | Text codes and plain push prompts fall to phishing pages, SIM swaps, and push bombing | Number matching everywhere, FIDO keys or passkeys for anyone touching money |
| We’d know if something happened | Global median dwell time is 14 days and rising, at organizations with real logging | Retain logs, alert on impossible-travel sign-ins and new mailbox forwarding rules |
If You Only Do Four Things This Quarter
Ranked by how much risk they remove per dollar, roughly. All four are achievable inside a month, none of them require a new vendor relationship or a capital purchase, and three of them are configuration changes you are already paying for inside licenses your firm already holds today.
- Turn on number matching, then move the partners and anyone with wire or payroll authority to FIDO keys or passkeys. Start with the accounts that can move money, not the ones that generate the most tickets.
- Disable legacy authentication on your Microsoft tenant. Check first for the old scanner or the line-of-business application that still uses it, because something usually does and finding out on a Monday morning is unpleasant for everyone.
- Put an independent backup in front of Microsoft 365 and then actually restore something from it. A backup nobody has tested is a receipt, not a recovery plan.
- Write the WISP. Publication 5708 is a fill-in template and a motivated office manager can get a real draft done in an afternoon. The document matters less than the fact that somebody had to sit down and inventory where client data actually lives.
Past that, the honest next step is finding out what you have rather than guessing, which is what a security risk and vulnerability assessment is for. The broader picture of how VJNetworks approaches this sits on our cybersecurity services page. For the ground-level version instead, the ordinary day-to-day complaints rather than the posture behind them, there is a companion piece on the IT problems Westchester professional services firms call about first.
What Firm Owners Actually Ask Us
Does the Safeguards Rule really reach a five-person accounting practice?
We have run eighteen clean years, so surely that counts for something?
How much of this can we handle ourselves without hiring anybody?
Our insurance renewal asked whether we have MFA and we answered yes, was that wrong?
What does fixing all of this actually cost?
If something does look wrong on a Tuesday afternoon, how fast do you respond?
A free IT assessment checks your MFA methods, your Microsoft 365 retention, your backup restores, and your legacy authentication settings, and tells you where you actually stand. You keep the findings whatever you decide to do next.