Cyber Essentials and Microsoft 365 for accountants and financial services
ICAEW guidance, the FCA's incident reporting rules from March 2027, and invoice and payment fraud. Neither body requires Cyber Essentials, but clients and tenders ask for it.
The rules, and where they come from
Accountancy practices and small financial advice firms hold clients' bank details, tax records and payroll data, and some make payments on clients' behalf. We found no rule from the Institute of Chartered Accountants in England and Wales (ICAEW) or the Financial Conduct Authority (FCA) that makes Cyber Essentials compulsory. But ICAEW says it is now a feature of many procurement processes, and from 18 March 2027 almost every FCA-regulated firm comes under new incident reporting rules.
| What | Status | Source |
|---|---|---|
| Process personal data securely, with "appropriate technical and organisational measures" | Required by law for every firm | ICO guide to data security |
| Report a personal data breach to the ICO within 72 hours, where feasible, unless unlikely to risk people's rights | Required by law | UK GDPR Article 33 |
| Follow ICAEW's 10 steps, which leave firms "well placed to adopt the Cyber Essentials certification" | Recommended by ICAEW | ICAEW cyber security guide |
| Cyber Essentials or Plus from clients and in tenders | Common, per ICAEW | ICAEW Insights, 31 October 2025 |
| "Organise and control its affairs responsibly and effectively, with adequate risk management systems" | Required of every FCA-authorised firm | FCA Principle 3 |
| Tell the FCA about material operational incidents, such as unauthorised access to your systems | Required now under Principle 11 | FCA: reporting operational incidents |
| New operational incident reporting rules | Required from 18 March 2027 for all firms with a Part 4A permission, payment service providers and others | FCA PS26/2 |
| Cyber Essentials | Not named by the FCA | Our search of FCA pages |
The ICO calls Cyber Essentials "a good starting point" for meeting the security principle, and adds that you may need to go further depending on the data you hold. ICAEW's guide says Cyber Essentials "is now a feature of many procurement processes"; one accountancy firm told ICAEW that some of its clients will not engage without Plus. In ICAEW's 2025 monitoring of 121 larger firms, 54% had completed Cyber Essentials and 29% Cyber Essentials Plus (ICAEW Practice Assurance monitoring report 2026).
Phishing is by far the most common attack. In the government's 2025/2026 Cyber Security Breaches Survey, 43% of UK businesses identified a breach or attack in the last 12 months, and 38% had experienced phishing (DSIT, 30 April 2026). ICAEW warned in April 2025 that fraudsters can now generate convincing fake invoices, receipts and payment confirmations with AI, and told members to check with vendors and stick to their controls (ICAEW Insights).
How we deliver it
- Managed, £35 per user a month: computers patched and monitored with NinjaOne, Huntress Managed EDR watched 24/7, Defender for Business, MFA and conditional access where your plan allows, SPF, DKIM and DMARC, Microsoft 365 backup, and unlimited remote fixes during support hours.
- Secure, £55: adds 24/7 monitoring of Microsoft 365 sign-ins, phishing tests and security awareness training, Intune on Business Premium, a monthly report mapped to Cyber Essentials controls and the yearly Microsoft 365 audit. It suits firms that must show their controls to clients or a regulator.
- Cyber Essentials or Plus: on Managed or Secure we fill in the answers from the setup we manage. Cyber Essentials is then £795 a year for up to 9 people and £995 for 10 to 19, and Plus is £2,195 and £2,595. Every band is on the Cyber Essentials and Cyber Essentials Plus pages.
- Cyber insurance: IASME's cyber liability insurance comes with the certificate for UK organisations with turnover under £20m that certify the whole organisation and opt in. It covers incident response up to a £25,000 limit, underwritten by AIG UK. It does not cover money stolen by electronic means or cyber fraud, so check your own cover too.
Example at our prices
Example only, not a quote
An 8-person accountancy practice on Microsoft 365 Business Premium, on our Managed plan, certifying to Cyber Essentials.
- Licences: 8 × £24.60 = £196.80 a month
- Managed support: 8 × £35 = £280 a month, above the £250 monthly minimum
- Together: £196.80 + £280 = £476.80 a month, or £5,721.60 a year
- Cyber Essentials, support-client price for 1 to 9 people: £795 a year
- Year one: £5,721.60 + £795 = £6,516.60, excluding VAT
On Secure instead, support is 8 × £55 = £440 a month, the monthly total is £636.80, and year one is £7,641.60 + £795 = £8,436.60.
Common questions
Does ICAEW require Cyber Essentials?
We found no ICAEW requirement. ICAEW recommends steps that prepare a firm for Cyber Essentials and notes that it features in many procurement processes. Your clients may require it: one accountancy firm told ICAEW that some of its clients will not engage without Plus.
Does the FCA require Cyber Essentials?
We found no FCA rule that names it. The FCA requires adequate risk management systems under Principle 3 and incident reporting under Principle 11. From 18 March 2027, new incident reporting rules apply to all firms with a Part 4A permission.
Is IASME's cyber insurance with Cyber Essentials enough?
It covers incident response up to £25,000 for eligible organisations, and it does not cover money lost to cyber fraud. Whether that is enough depends on your risk and your professional indemnity cover. Speak to your broker.