Compliance
What cyber insurance for CPA and tax firms actually covers in 2026, the underwriting questionnaire controls that move premiums, and how to pass the application without overspending.
Accounting firms have become a high-value target for ransomware operators, BEC crews, and tax-refund redirect scammers. CPA and tax firms hold concentrated client financial data — SSNs, bank routing details, prior-year returns, K-1s, active wire instructions — in environments small enough for defenses to be inconsistent. Downtime hurts because IRS deadlines do not move.
Cyber insurance sits next to accountants professional liability on the renewal checklist. What has changed in 2026 is not whether a firm needs it, but what carriers will underwrite, at what price, and which questionnaire answers quietly turn into coverage conditions on the day a claim is filed.
This article is for managing partners, firm administrators, and IT-responsible CPAs filling out a renewal application. Obsidian Ridge does not sell insurance. We help firms pass underwriting honestly and operate the controls behind the answers.
Many partners assume their existing policies cover cyber events. They do not. Accountants professional liability — E&O — responds to errors and omissions in accounting and tax: a missed Section 754 election, an incorrect depreciation schedule, alleged audit negligence. General liability covers slip-and-fall. Neither responds to forensics, ransomware, an FTC inquiry, or a wire redirected by a compromised vendor email.
A cyber liability policy is a separate contract. In 2026, coverage parts on a typical accounting policy include forensics and IR retainer, breach coach and legal counsel, breach notification with credit monitoring, regulatory defense (FTC Safeguards Rule, IRS tax preparer breach inquiries, state AG actions), business interruption, cyber extortion and ransom where legal under OFAC, data restoration, and a crime or social-engineering rider for wire fraud and BEC. Some carriers bundle. Some sell endorsements. Read the declarations and schedule of endorsements, not the brochure.
Limits in this segment have stabilized after the 2022-2023 hard market:
The aggregate is half the conversation. Sublimits decide what the firm actually collects: the ransomware sublimit is often 50 percent of the aggregate, the regulatory defense sublimit may be lower than the headline, the social-engineering and crime sublimit is frequently $25,000 to $250,000, and BI waiting periods are typically 8 to 12 hours. For a firm that processes client refunds, manages payroll, or holds funds in trust, the crime sublimit may be the single most important number on the page.
The controls below appear on virtually every accounting firm carrier's 2026 application. They move premium roughly 20 to 40 percent and decide whether the carrier offers terms at all.
This is the actual scoring rubric most carriers apply, and it lines up closely with the IRS Security Six.
The most common cyber loss in accounting is not ransomware. It is wire fraud through BEC. An attacker compromises an email account — the firm's, a vendor's, or a client's — and inserts altered payment instructions into a routine transaction. FBI IC3 reporting continues to show BEC driving the largest dollar losses in cybercrime, and tax-season patterns intensify the exposure.
Exposures by service line:
The base cyber policy generally does not cover the loss. The crime or social-engineering rider does. Two things to verify:
A rider that covers only direct funds-transfer fraud is nearly useless for the accounting BEC pattern. Insist on social-engineering language.
Many 2026 policies apply co-insurance to ransomware claims if the named controls were not in place at the time of loss. A typical clause: if the insured cannot demonstrate MFA, EDR or MDR, immutable backups, and a tested IR plan were operating at the time of loss, the insured shall bear 50 percent of the loss — ransom, restoration, and business interruption.
A $1,000,000 ransom sublimit becomes $500,000, with the firm on the hook for the rest. Coveware's quarterly reporting consistently shows small professional services firms among the highest-frequency victims, and Sophos State of Ransomware data shows average recovery cost still exceeds the ransom itself. If the policy includes a controls warranty, every answer on the application is a coverage condition.
After the 2023 Lloyd's war exclusion guidance, most cyber policies exclude nation-state attacks. Wording varies.
For accounting firms, watch the supply-chain language. If a breach travels through the tax software vendor, document portal, e-signature platform, or RMM, some policies treat that as a systemic event and exclude it. Ask whether the policy responds if a tax software vendor breach affects this firm, and whether there is a separate sublimit for systemic events. Get it in writing.
Prior-acts matters too. If a tax-season incident happened in the prior policy period and was never disclosed at renewal, the carrier can deny on the next policy. Disclose known incidents.
Many carriers now ask whether the firm has cybersecurity gaps during tax season — specifically, whether seasonal contractors and per-diem preparers are brought into the same control set as full-time staff. The honest answer is often "no." A firm that runs tight MFA, MDR, and offboarding for full-time staff often loosens all three when it brings on seasonal preparers from January through April. Be ready to answer how seasonal staff are onboarded and offboarded, whether they use firm-managed or personal devices, whether MFA is enforced on day one, and whether MDR coverage extends to seasonal endpoints.
Things that look like security but do not move underwriting in 2026: a fancier next-generation firewall by itself, stacking two or three antivirus products on the same machine, "we have a great IT guy" without 24/7 monitoring behind it, a WISP PDF from 2019 nobody has read, a one-time pentest with no controls behind it, a SOC 2 from a vendor that does not touch client data. Carriers score operating controls and evidence, not invoices.
The sequence that works, in order of premium impact and cost-effectiveness:
Enable MFA on Microsoft 365 or Google Workspace, on Lacerte, Drake, UltraTax, ProSeries, or CCH Axcess admin accounts, and on every RDP, VPN, and RMM path. The cheapest move, and it materially lowers premium.
A managed detection and response service with a real 24/7 SOC checks the EDR and 24/7 monitoring boxes at once. Identity threat detection on top covers the cloud productivity suite controls and MFA-bypass detection. Our Managed Detection and Response and Managed ITDR services are designed against this control set.
Pick a product that supports immutability natively, include tax software databases and the document management system in the test scope, schedule a monthly restore, and keep the log.
A WISP satisfying IRS Publication 4557 and the FTC Safeguards Rule, paired with a one-page IR plan naming who calls the carrier hotline, who declares an incident, who notifies the IRS Stakeholder Liaison, and who handles client communication. A 60-minute tabletop with managing partner, administrator, and IT vendor satisfies the tabletop requirement.
Refund-redirect emails, vendor banking changes, IRS-impersonation lures, payroll change requests. Our Managed Security Awareness Training handles the cadence and tunes simulations to the tax calendar.
That covers roughly 80 percent of the premium-moving controls on a 2026 questionnaire.
Underwriters now share loss intelligence on the accounting vertical. Two-strike firms — those with claims in consecutive renewal periods — frequently face non-renewal and have to shop E&S markets to find terms. Even top-100 firms with sophisticated programs face surcharges after an incident, regardless of how much the program improved post-event. The IBM Cost of a Data Breach 2024 report put average breach cost in financial services well into the seven figures, and carriers price toward that.
If a claim was paid in a prior period, expect the next application to ask what changed. "We are more careful now" does not pass. "We moved to a 24/7 MDR provider, added MFA on the tax software admin accounts, rewrote the WISP to meet the Safeguards Rule amendments, and ran a tabletop in March" does.
Misrepresentation is a coverage defense. If the questionnaire said MFA was enabled and forensics shows it was not, the carrier may rescind. Answer honestly. If a control is partial, say so.
A partner cannot use cyber insurance to "transfer" the obligation to safeguard client data. AICPA SSTS Section 1.3 addresses use and protection of client information, and Code of Professional Conduct provisions on confidentiality and due care apply regardless of what the policy pays. Insurance covers financial consequences. It does not cover a state board finding that controls were unreasonable, an IRS EFIN suspension, or a Safeguards Rule enforcement action. The firm remains the data steward; the carrier is a backstop.
We are not an insurance broker. We do not sell policies and we do not collect commissions. We help firms operate the controls underwriters score and produce the evidence the application asks for.
The control set that moves the most premium in 2026 — 24/7 MDR, identity threat detection, MFA enforcement, and workforce training — lines up with our Foundation and Protected tiers. Foundation covers endpoint and MDR. Protected adds ITDR and SAT, addressing the four heaviest premium-moving controls on most questionnaires. The accounting industry page lays out the mapping.
For firms renewing in the next 90 days, the two-week Cyber Insurance Readiness sprint maps each questionnaire control to evidence the carrier will accept, identifies gaps most likely to block underwriting, and produces a clean evidence package. The Obsidian Ridge Briefing walks through how the program fits together.
Cyber insurance is not a substitute for controls. It is a backstop for residual risk. Firms that treat the policy as the plan tend to learn the expensive way that the controls warranty is doing more work than the declarations page.
If the questionnaire is making you nervous, that is the right instinct. The fix is operational. Start with MFA on email and tax software, a real 24/7 MDR layer, an immutable backup with a tested restore, and a WISP that meets both Publication 4557 and the Safeguards Rule.
Ready to map your firm's controls to the carrier questionnaire? Start the Cyber Insurance Readiness sprint.
Last updated
May 16, 2026. We refresh this content as the threat landscape and tools evolve.
FAQ
Yes. Accountants professional liability (E&O) responds to errors and omissions in tax and accounting work — a missed election, an incorrect basis calculation, alleged negligence in audit work. It does not respond to forensics, breach notification, ransomware, FTC Safeguards regulatory defense, or wire fraud. Those losses sit on a standalone cyber liability policy. Most carriers and the AICPA now treat cyber as a separate, expected line of coverage for CPA and tax firms.
Solo and 1-to-3 partner firms commonly carry $250,000 to $1 million in aggregate limits. Firms in the 4-to-15 partner range typically carry $1 million to $3 million. Firms with 15 or more partners carry $3 million to $10 million, often with a separate excess tower. Sublimits — particularly for ransomware and wire fraud — frequently move at a different rate than the headline aggregate, so the declarations page is only half the story.
Yes, and you need to read it carefully. The base cyber policy generally does not cover wire fraud. The crime or social-engineering rider does, but only if the wording covers social engineering fraud — where a staff member was tricked into authorizing the transfer — and not only direct computer-funds-transfer fraud. For firms that hold client funds, process refunds, or handle payroll on behalf of clients, this rider is often the most important coverage in the policy.
2026 questionnaires now ask about MFA on the tax preparation platform itself, whether the platform is cloud-hosted or on-premises, who has admin access, and whether the firm has a documented vendor inventory that includes the tax software publisher. Carriers also ask whether IRS e-filing credentials and EFINs are protected with MFA and whether the firm has procedures for the IRS Security Six required by Publication 4557.
Yes. After the 2023 FTC Safeguards Rule amendments and the 2024 breach notification rule for tax preparers, virtually every 2026 cyber application for accounting firms asks whether the firm has a written information security program meeting Safeguards Rule requirements, has designated a qualified individual, and has a documented incident response plan. A missing or out-of-date WISP is now a frequent reason for declined terms.
Ransom payment is generally covered when it is legal under OFAC sanctions rules and the carrier's incident response panel approves the payment in advance. Many 2026 policies now apply 50 percent co-insurance to the ransomware loss if the firm cannot demonstrate that the named controls — MFA, EDR or MDR, immutable backups, and an incident response plan — were operating at the time of loss. Read the ransomware endorsement, not just the declarations page.
Most policies require notice as soon as reasonably practicable, with a hard window — commonly 30 to 60 days — for written notice. Late notification is one of the most common reasons coverage is denied even when the underlying loss is otherwise covered. Build the carrier hotline into the firm's incident response plan, and remember that the IRS now requires tax preparers to report data theft incidents within specific timeframes that may be shorter than the carrier window.
Carriers now share loss intelligence on the accounting vertical, and firms that suffered a covered loss without subsequent program improvement frequently see non-renewal or 30 to 60 percent surcharges at renewal. Two-strike firms — those with claims in consecutive renewal periods — face the hardest market and may need to shop excess and surplus markets. The fix is operational evidence: documented MDR, MFA, tested backups, WISP, and a tabletop completed since the incident.
Related reading
A CISSP-led walkthrough of cyber insurance for first-time SMB buyers in 2026 — what the policy covers, what the questionnaire asks, the four controls that move premiums the most, and how to pass the application without overspending.
Read articleThe 22 cyber-insurance underwriting controls that move premiums in 2026 — what each one asks, why carriers care, and how to answer without overcommitting your stack.
Read articleWhat IRS Publication 4557, IRS Publication 5708, the FTC Safeguards Rule, AICPA SSTS Section 1.3, and the state breach laws actually require of CPA firms in 2026 — the technical safeguards, the documented program, and where most firms get it wrong.
Read article