Last updated: October 2026. Written by Athar Ahmad, Certified Bubble.io Developer and Tech Architect, Simple Automation Solutions.

Small professional firms hold exactly what attackers want: client identities, financial details, privileged communications and access to bank accounts and systems. They are also less likely to have a dedicated security team. The good news is that most successful attacks exploit basic gaps, and basic habits close most of them.

This checklist covers twenty cybersecurity basics for small law, accounting and consulting firms. It is general guidance, not a substitute for professional security advice or your regulator’s requirements.

The 20-point checklist

People and access

1. Multi-factor authentication everywhere it is offered, especially email, cloud storage and financial systems.
2. A password manager for staff, with unique strong passwords for every account.
3. Least privilege. Give people access only to what they need, and review it regularly.
4. Prompt offboarding. Remove access the day someone leaves.
5. Separate admin accounts from everyday accounts.

Devices and software

1. Keep everything updated. Operating systems, browsers and applications should receive security updates promptly.
2. Antimalware or endpoint protection on all computers.
3. Encrypt laptops and phones, so a lost device does not mean a data breach.
4. Screen locks and automatic timeouts.
5. Control which software people can install.

Email and phishing

1. Staff awareness training on phishing, with realistic examples.
2. A clear way to report suspicious messages, and a culture of no blame.
3. Email authentication. SPF, DKIM and DMARC protect your domain from being spoofed.
4. Verification for payment changes. Confirm new bank details by phone using a known number before paying.

Data and backups

1. Backups that are tested, with at least one copy kept separate from your main systems. A common approach is three copies, on two types of storage, with one offsite.
2. Know where client data lives, and keep it in approved, access-controlled systems.
3. Secure file sharing. Use a portal or encrypted sharing, not plain email attachments.
4. Retention and secure disposal of data and old devices.

Network and suppliers

1. Secure Wi-Fi and a separate guest network.
2. Review suppliers and cloud services. Check their security, data location and breach notification terms.

Preparedness

1. An incident response plan. Know who does what, who to call and what to report, and to whom, if something happens. Practise it.

How to prioritise

What frameworks can guide you?

Recognised frameworks give structure. In the UK, the National Cyber Security Centre’s Cyber Essentials scheme sets out basic controls, and in the US, the NIST Cybersecurity Framework is widely used. Your regulator or insurer may also set expectations, so check what applies to you.

What should you do if something goes wrong?

1. Isolate affected devices, but do not switch off or wipe them without advice.
2. Change passwords and revoke access for affected accounts.
3. Contact your incident lead, your IT or security adviser and, where relevant, your insurer.
4. Work out what data may be affected.
5. Meet your legal and regulatory duties on notification, which often have strict deadlines.
6. Record what happened and learn from it.

How does this apply to the software you use or build?

The same principles apply to custom systems: enforce roles and privacy rules, keep keys private, log activity, test with multiple accounts and plan for backups. See our Bubble.io security guide and what to cut before you build. Our Discovery Sprint includes security requirements in the plan: $345, delivered in 24 hours and credited toward a build starting at $3,500.

Frequently asked questions

What are the most important cybersecurity steps for a small firm?

Multi-factor authentication, prompt updates, a password manager, tested backups and staff training on phishing cover the most common risks.

What is the 3-2-1 backup rule?

Keep three copies of your data, on two different types of storage, with one copy offsite or offline.

Do small firms need an incident response plan?

Yes. Knowing who does what and whom to notify saves time and reduces damage when something happens.

How often should we train staff?

At least annually, with shorter reminders and realistic phishing examples through the year.

Is cloud software less secure than on-premise?

Not necessarily. Security depends on the provider, configuration and your habits. Review providers and use strong access controls.