Does ICAEW or ACCA require Cyber Essentials?

Neither institute mandates CE outright, but both have shifted technical guidance towards demonstrable controls. CE is the most efficient evidence base in the UK.

Do I need CE for every client tenant I administer?

No – your CE covers your firm's controls. But your firm's controls must include MFA and access management on those tenants, because you administer them.

Can I include receipt-capture apps in scope?

You should – Dext, AutoEntry and Hubdoc handle client financial data and need MFA and proper user management like any other in-scope SaaS.

What's the best time of year for an accountancy practice to do CE?

April–June or November. Avoid January (self-assessment), March (year-end) and August–October (audit season).

Is CE enough if we hold client money?

It's a strong foundation. Once you hold client money or take on audit work, CE Plus becomes the pragmatic next step.

Cyber Essentials for UK Accountants

Why this matters for accountants

You hold full financial profiles for every client – the highest-leverage data a fraudster can get. ICAEW guidance on technology and ethics points squarely at evidence of controls, and HMRC's MTD direction increases the volume of digital interactions with client data. CE quietly closes the most common attack surface.

Scope for a cloud-first practice

Practice laptops and mobile devices.
Practice management (Xero Practice Manager, IRIS, AccountancyManager, BrightManager).
Client accounting software admin (Xero, QuickBooks, FreeAgent, Sage tenants you administer).
Bookkeeping and bank-feed integrations.
Email tenant and client-portal admin.

Five things CE assessors look for in accountancy submissions

MFA on every client tenant you administer. Not just yours.
Receipt-capture apps (Dext, AutoEntry, Hubdoc) treated as in-scope SaaS with MFA.
Client portal accounts with strong-password and lockout policies.
Leavers process that includes removing access from every client tenant – often missed.
Patching evidence for staff laptops, particularly for tax-software updates that lag OS patching.

Common pitfalls

One Xero login shared by two seniors. Every user needs their own account.
A junior left, but their access to four client tenants wasn't removed.
Bank-feed credentials stored in spreadsheets rather than a secrets manager.
Personal mobiles used for Authenticator with no policy backing.

Timing matters

Avoid the obvious peaks – self-assessment Jan, year-end March, audit Aug–Oct. Most practices schedule CE in April–June or November. A two-to-four-week window is realistic for a clean prep.

CE vs CE Plus

Standard CE is the right starting point. Move to CE Plus when you take on audit work, hold client money, or large-firm referrals start asking for it. See when to upgrade.

What CE costs an accountancy practice

Most independent practices fit the IASME small or medium band: £400–£600 + VAT. Add an MDM tool if you have above 10 staff devices, and budget around 12 hours of prep time. Full breakdown in our 2026 cost article.

Ready to start? Head to Cyber Essentials or look at Fully Managed if you'd rather hand off the prep.