Polish accounting firm cybersecurity rests on six foundations: MFA on every e-Tax Office (eUS), KSeF, and ERP account (Comarch Optima, Enova365, Symfonia); offline-capable backup of the client database; network segmentation; routine patching; BEC- and phishing-focused team training; and one external vulnerability assessment per year - preferably outside tax season. 43% of breaches target firms under 1,000 staff (Verizon DBIR 2024), and Polish accounting firms are especially exposed due to the client-multiplier effect.
1. Why accounting firms are targeted
Client multiplier. One breach into the firm = access to financial data for 20-200 clients. Attackers prefer targets that open many books in one move. From the attacker’s economic perspective, an accounting firm is a “collector node” worth multiples of an individual SMB.
Seasonality. Polish statutory deadlines (VAT 25th of each month, PIT 30 April, CIT 31 March, JPK, KSeF) create pressure windows. An attack at the end of March = the accountant under deadline pressure will sign almost anything. Attackers know this and time accordingly.
BEC is unusually effective. Accountants authorize client transfers every day. One spoofed “client CEO” email asking for an urgent wire to a new supplier account = real money lost. FBI IC3 reported USD 2.9B in global BEC losses for 2023; Polish accounting firms are over-represented in that statistic.
The multiplier nature of risk means an accounting firm should run higher cyber hygiene than its average client. The client has one bank account - the firm has fifty.
2. Three defence layers - applied to the accounting firm
Layer 1 - Access to fiscal systems
MFA on eUS and KSeF (highest priority - holds JPK, tax declarations, client proxies). MFA on Comarch Optima, Enova365, Symfonia. Separate logins for each accountant and clerk - no shared “accountant@firm.pl”. Audit log in the ERP shows who authorized every document. Vendor patches: Comarch typically mid-month; Symfonia (Sage) similar - test on a backup copy, deploy outside business hours.
Layer 2 - Client data
3-2-1 backup of ERP databases, JPK archive, PDF document archive, client correspondence. Local NAS + immutable cloud (S3 Object Lock) + offline rotating copy. RPO ≤24h, RTO ≤48h. Monthly restore test for one client database. BitLocker at rest on every workstation. Database encryption in the ERP where the vendor supports it. Segmented client VPN access - one compromised client cannot reach another.
Layer 3 - BEC and phishing defence
SPF + DKIM + DMARC on the firm domain (p=none → p=reject over 4-8 weeks). Written second-channel verification procedure for any supplier-account change, urgent transfer, or “from CEO” instruction. 3-hour annual team training covering BEC recognition, eUS/KSeF/ZUS phishing patterns, password and MFA hygiene, post-incident steps, plus a final simulated phishing test. Monthly phishing simulations with a <5% click-rate goal over 12 months. In 2026: AI voice deepfakes targeting the receptionist - defence is the same as for email (second-channel verification, pre-agreed passphrase).
3. Compliance specifics
Dual GDPR role. The firm is simultaneously controller (own staff data, sales contacts) and processor (client data under Article 28 DPA). Two parallel data-protection regimes under one roof.
Article 28 DPAs with every client. Purpose and scope, categories of subjects, technical measures, sub-processing, audit rights, retention, breach-notification timing.
Polish accountant professional secrecy. SKwP (Polish Accountants Association) Code of Ethics imposes a separate confidentiality duty - parallel to GDPR.
Retention rules. Tax Ordinance: 5 years for accounting records; Labour Code: 10 years for personnel files (50 years for some pre-2019 employees). Deletion policies must respect both - too early breaks tax law, too late breaks GDPR.
NIS2 - usually not applicable. Bookkeeping is not in UKSC Annex I or II. Exception: if you are a critical ICT provider for an essential entity, the client may impose contractual cyber clauses. Scope test in the NIS2/UKSC pillar.
4. Vendor stack: Comarch, Enova, Symfonia
Comarch Optima / ERP XL - most common Polish accounting platform. MFA in Optima 2023+. Monthly patches; subscribe to vendor CVE alerts. Risk: legacy XL installs on outdated Windows Server.
Enova365 (Soneta) - second most common. Cloud-native option (Enova Cloud) with built-in MFA; optional MFA on-premise.
Symfonia (Sage) - third place. Three tiers (ERP, Mała Księgowość, Premium). MFA available; Sage maintenance schedule.
Insert, iFirma, InfaktPro - smaller-segment / SaaS for micro-firms. MFA built in; risk shifts to the cloud DPA under Article 28.
Regardless of choice: MFA on the main account + MFA per proxy user, scheduled updates, audit log enabled, strong-password policy.
5. Budget
Annual ranges, 5-25 person firm, 20-100 clients, 2026 PLN, gross:
- 0-1K: free MFA, SPF/DKIM/DMARC, BitLocker, written policy.
- 1-5K: Microsoft 365 Business Premium with EDR, 4-bay NAS one-time, immutable cloud backup, managed DMARC.
- 5-15K: annual CyberAudyt CyberCerber (see pricing), professional phishing simulator, cyber insurance 3-10K.
- 15-30K: retained SOC, annual penetration test, DPO outsourcing 800-2,500 PLN/month, ISO 27001 if corporate clients require it.
One successful BEC at a mid-portfolio firm: PLN 50-300K plus reputation damage. First implementation wave (Weeks 1-12): PLN 5-15K.
6. 30-60-90 day plan - tax-season-aware
Weeks 1-2 (outside tax season - June/July/August/October): Account inventory, MFA on eUS, KSeF, ZUS PUE, ERP, banking. Avoid March, April, January, and days 23-25 of any month.
Weeks 3-4: 3-2-1 backup of ERP database, JPK archive, PDFs. Restore test. BitLocker. Firm password manager (Bitwarden Teams).
Weeks 5-8: SPF + DKIM + DMARC to p=reject. Written transfer-verification procedure. 3-hour team training. Baseline phishing simulation.
Weeks 9-12: External vulnerability assessment (CyberAudyt CyberCerber). Remediation of critical findings in 7 days. Annual audit on the calendar.
7. CyberCerber for accounting firms
Fixed-price external vulnerability assessment for Polish SMB accounting firms. Polish-language report - readable by the firm owner and head accountant. Scheduling outside tax season. Three products: PreScan (free diagnostic in 24h), CyberAudyt (full vulnerability assessment, report in 5 business days), Pentest (for firms with corporate-client or regulatory requirements). Guarantee on CyberAudyt: if the report does not surface at least three actionable findings, full refund.
Free PreScan · Pricing · Services for accounting firms.
8. FAQ
(See faq field in frontmatter - 12 Q/A pairs.)