What Should the First 90 Days of Reducing Cyber Liability Look Like for an Accounting Firm?

Step 1: Identify What the Business Depends On

Begin with the business.

Not the firewall.

For an accounting or tax firm, identify the systems and services that would create real disruption if they became unavailable.

Examples might include:

• Tax preparation software
• Accounting applications
• Microsoft 365
• Email
• Client portals
• File storage
• Payroll systems
• Internet connectivity
• Remote access
• Phone systems
• Critical cloud services
• Third-party vendors

Then ask:

"How long could we realistically operate without each one?"

Not every system deserves the same recovery priority.

That matters later.

Step 3: Define Ownership

One of the most common causes of hidden risk is unclear responsibility.

Leadership assumes:

"The IT company handles that."

The IT provider assumes:

"The client owns that."

A vendor assumes:

"The MSP handles that."

Nobody is intentionally ignoring the issue.

Ownership was simply never made clear.

For every meaningful responsibility, identify:

Owner

Who is responsible for making sure it happens?

Implementer

Who performs the work?

Verifier

Who confirms it actually occurred?

Decision Maker

Who decides what happens when a gap is identified?

Those roles may be different.

That is okay.

The important thing is that they are visible.

Step 5: Apply the Four Areas of Cyber Liability

Do not leave findings in technical language.

Translate them.

For each significant issue, consider:

Business & Operational Risk

Could this prevent the firm from operating or serving clients?

Legal Risk

Could this create responsibilities requiring qualified professional guidance?

Regulatory Risk

Could this affect responsibilities expected of the firm?

Reputational Risk

Could this damage client or stakeholder trust?

A vulnerability means more when leadership understands what it could mean to the business.

See the Whole Risk.

Step 6: Choose the Top Three Priorities

Do not attempt to address every finding.

Start with three.

Ask:

Which issue could create the greatest business disruption?

Which assumption is most important to verify?

Which improvement could meaningfully reduce risk now?

The exact priorities will differ by firm.

For one organization, they might be:

1. Verify recovery capability.
2. Correct privileged-access problems.
3. Remove unmanaged or unnecessary vendor access.

For another:

1. Expand MFA.
2. Improve employee onboarding and offboarding.
3. Correct backup coverage.

The number is intentional.

Three priorities are manageable.

Thirty usually are not.

Step 7: Verify the Critical Safeguards

Pick the safeguards leadership depends on most.

Then ask:

"Can we prove these are working?"

Examples include:

Multifactor Authentication

Where is it enabled?

Where isn't it?

What exceptions remain?

Endpoint Protection

Which systems are actively reporting?

Are any devices missing?

Backup

What is being protected?

Recovery

What has actually been restored in a test?

Employee Access

Does every employee have only the access they need?

Former Employee Access

Can the organization prove access was removed?

Vendor Access

Who still has access and why?

This is the difference between:

Having controls

and

having confidence in controls.

Step 8: Fix the High-Value Gaps

The first improvements should focus on meaningful risk reduction.

A useful question is:

"Which action gives us the most meaningful reduction in exposure relative to the time, cost, and disruption involved?"

That prevents security work from becoming a competition to see who can buy the most tools.

Sometimes a relatively small change produces significant value.

Examples might include:

• Removing an unnecessary administrator account
• Enabling MFA on a critical system
• Correcting an exposed service
• Removing dormant vendor access
• Fixing a failed backup process
• Updating an outdated system
• Improving employee offboarding

Specificity matters.

Step 9: Document Every Leadership Decision

Not every recommendation will be approved.

That is normal.

Leadership may choose:

Accept

Proceed now.

Defer

Acknowledge the issue but intentionally schedule it later.

Decline

Understand the recommendation but consciously choose not to proceed.

Investigate

Gather more evidence before deciding.

The important thing is that the issue does not disappear.

For significant decisions, document:

• What was identified
• What evidence exists
• Why it matters
• What was recommended
• What leadership decided
• Who owns the next step
• When it will be reviewed again

Documentation is protection.

Step 11: Improve Employee Understanding

Security training should not simply produce a certificate.

It should change behavior.

During Days 31-60, focus education on issues employees are likely to face.

For accounting and tax firms, examples might include:

• Suspicious client attachments
• Fake tax documents
• Credential theft
• MFA fatigue
• Urgent payment-change requests
• Fake messages from firm leadership
• Improper use of personal storage
• AI tools receiving sensitive client information
• Requests to bypass approved processes

Employees do not need to become cybersecurity professionals.

They need enough understanding to recognize when they should stop and ask.

That is Teach Before We Act applied internally.

What Should Exist by Day 60?

By the end of the second month, leadership should be able to point to tangible improvement.

Examples include:

• Priority technical gaps corrected
• Important safeguards verified
• Unnecessary access removed
• Leadership decisions documented
• Responsibilities clarified
• Employee education reinforced
• Open issues assigned to owners
• Deferred issues given review dates

The organization should be able to say:

"We know more than we knew 30 days ago, and several meaningful risks are now lower."

That is progress.

What Should Leadership Measure?

Do not measure progress only by the number of security products installed.

Look for outcomes.

For example:

Fewer Unknowns

Leadership can answer questions it could not answer 90 days earlier.

Clearer Ownership

Important responsibilities have named owners.

Better Evidence

Critical controls can be demonstrated.

Lower Priority Risk

Meaningful exposures have been corrected or reduced.

Better Recovery Understanding

Leadership knows what recovery looks like.

Documented Decisions

Accepted, deferred, declined, and investigated risks have records.

Better Roadmap Visibility

Leadership knows what is coming next.

Those are meaningful indicators of maturity.

An Illustrative 30-Person Accounting Firm

Consider a 30-person accounting firm starting with reasonable protections.

It has:

• Managed IT
• MFA
• Endpoint protection
• Backups
• Security awareness training
• A written information-security plan

Leadership still has several questions.

Month 1

An Independent Cyber Risk Assessment and internal review identify three priorities:

1. Vendor access needs review.
2. Recovery expectations have never been tested.
3. One important cloud service needs additional verification.

Leadership does not buy another product.

It assigns ownership and gathers evidence.

Month 2

The firm:

• Removes several unnecessary vendor accounts
• Verifies the cloud configuration
• Documents the outstanding recovery question
• Reinforces employee access procedures

Month 3

The firm performs a recovery exercise.

The recovery works, but takes six hours instead of leadership's assumed two.

That result is not a failure.

It is evidence.

Leadership can now decide whether six hours is acceptable or whether additional investment is justified.

At Day 90, the firm still has Cyber Liability.

But its leadership understands that liability much better.

That is the objective.