Cloud Accounting: Security Considerations for Small Businesses
Cloud computing has changed how businesses of all sizes perform many tasks, and that includes managing their books.
Cloud accounting software provides real-time access to financial data, automatic updates, easier collaboration with your accountant and less reliance on on-premises servers.
This has been transformational for many businesses, but there is a downside. When your general ledger, payroll records, bank connections and customer information live on someone else’s servers, security becomes a shared responsibility … and one you can’t take for granted.
Before you commit to a cloud accounting provider, here’s what you should evaluate.
The Shared Responsibility Model
Most reputable providers operate under a framework known as a shared responsibility model.
The provider secures its infrastructure, including data centers, servers and the software itself. Your business is responsible for how the team uses the platform: who has access, how passwords are managed and whether available security features are actually turned on.
Even the best provider can’t protect you from a weak password or an employee who falls victim to an AI scam. Knowing where the provider’s job ends and yours begins is the foundation for everything else.
Encryption
Encryption scrambles your data so it’s unreadable to anyone without the proper key. You’ll want to look for two types:
- Encryption in transit protects data as it moves between your device and the provider’s servers, typically through transport layer security (TLS), the protocol behind the padlock icon in your browser.
- Encryption at rest protects data stored on the provider’s servers. That way, even if someone gained unauthorized access to the storage, the files would be unusable. Strong providers use industry-standard methods such as AES-256 for stored data. Ask whether backups are encrypted, too, and who holds the encryption keys.
Access Controls
Many breaches begin with stolen or compromised credentials rather than sophisticated hacking, which makes access controls one of your best lines of defense. Look for these features:
- Multifactor authentication (MFA): Require a second verification step, such as a code from an authenticator app, for every user.
- Role-based permissions: Give employees access only to what they need. Your bookkeeper will likely need to enter transactions, but they probably shouldn’t be able to change bank account details or delete records.
- Audit trails: Choose a platform that logs who accessed what (and changed what), when. These logs can help you catch suspicious activity early and are invaluable if you ever need to investigate an issue.
- Prompt deprovisioning: You should be able to immediately revoke access when an employee leaves or changes roles.
Backup and Recovery Protocols
“It’s in the cloud” doesn’t necessarily mean “it’s backed up.” Ask providers …
- How often data is backed up
- Where backups are stored (ideally in geographically separate locations)
- How long they’re retained
- How quickly your data can be restored after an outage, human error or ransomware attack
Also, find out what happens if you cancel service. Can you export your data in a usable format? Some businesses schedule periodic exports of key financial records as an extra safeguard, which is a reasonable layer of protection.
Certifications / Track Record
Marketing claims aren’t necessarily trustworthy. Get independent verification where you can.
Look for providers that undergo third-party audits, such as a SOC 2 report, which evaluates a service organization’s controls related to security, availability and confidentiality, among other criteria. Several accounting platforms, including QuickBooks, Xero and FreshBooks, have SOC 2 certifications. Ask whether any potential providers will share their most recent report or a summary of it.
Also pore into the provider’s history. Is it transparent about past incidents? How has it handled them? How quickly does it patch vulnerabilities? Clear, timely communication is an important signal of how a vendor will behave when something goes wrong.
Questions to Ask Before You Sign
When you’re comparing providers, use this checklist to keep the conversation focused:
- Is data encrypted?
- In transit and at rest?
- Does the platform support MFA and role-based permissions?
- How often is data backed up?
- What’s the typical recovery time?
- Can you export all of your data if you leave?
- Does the provider have a current independent security audit (e.g., SOC 2)?
- What is the incident response process?
- How will we be notified of a breach?
- Where is our data stored?
- Who at the provider can access it?
Don’t Forget the Human Element
Even the most secure platform can be undermined by everyday habits. Thus, employee training is a vital component of cloud security.
Train your workforce to recognize phishing attempts, use a password manager, avoid accessing financial systems over public Wi-Fi and keep their devices updated. Review user access at least quarterly so former employees, outdated permissions and unused accounts don’t linger.
A few simple (written!) policies can go a long way toward keeping your data safe.
Move to the Cloud With Confidence
Cloud accounting can make your business more efficient, but only when the platform you choose and the way you use it are built with cybersecurity in mind. Taking the time to vet providers now can save you from costly disruptions down the road.
McManamon & Co. is an accounting, tax, fraud, forensic and consulting firm that serves small and midsize businesses. Our experienced accounting team is well-versed in all small-business accounting software, including QuickBooks and Sage 50, and we can help you and your accounting staff evaluate, implement and use these and other programs.
Call us at 440.892.8900 or contact us online today to learn how we can help you make your next move.
Tags: accounting, cybersecurity, fraud, McManamon, McManamon & Co., small business, small business accountant, small business accounting | Posted in accounting, Fraud