The No. 1 cybersecurity tip for sole practitioners
Editor’s note: Small firms frequently turn to Stephanie Otero, CPA, the AICPA’s small firm advocate, with questions. In this column, she shares practical guidance on multifactor authentication and improving client service without adding staff.
Q: What is the most important cybersecurity step every sole practitioner should take?
A: Unfortunately, cyber threats continue to grow in sophistication, and small firms are not immune. In fact, cybercriminals often view smaller firms as attractive targets. They assume that smaller firms have fewer security resources while maintaining access to highly sensitive client information such as tax returns, payroll records, and financial data.
Sole practitioners face a unique challenge in that they are responsible for serving clients, running their practice, managing operations, and overseeing technology decisions, often without the support of an information technology (IT) department. But there are practical steps sole practitioners and small firms can take to strengthen their defenses.
Although cybersecurity requires a layered approach, if I had to prioritize one action for sole practitioners, it would be implementing multifactor authentication (MFA) on every business-critical system.
One of the most common ways attackers gain access to a firm’s system is through compromised credentials. Passwords can be stolen through phishing or exposed in data breaches. Weak passwords, especially if they are used on multiple accounts, compound the risk. Once cybercriminals obtain login credentials, they may be able to access email accounts, cloud applications, client portals, and firm data.
MFA provides an additional layer of security by requiring a second form of verification beyond a password. Even if a password is compromised, an attacker typically cannot gain access without that second verification factor. For a relatively small investment of time, MFA can dramatically reduce risk and provide one of the strongest returns on any cybersecurity investment.
Of course, cybersecurity doesn’t stop there. It is built on a series of fundamental habits and safeguards that work together to protect the firm. (Also see, “7 Steps to Boost Your Small Firm’s Cybersecurity,” AICPA & CIMA Professional Insights, July 13, 2026.)
After implementing MFA, sole practitioners should focus on additional foundational practices, which don’t necessarily require a large budget or dedicated technology staff. Many of the most impactful safeguards are affordable, practical, and accessible to firms of every size.
Small steps taken today can significantly reduce risk tomorrow:
- Keep software, operating systems, and applications updated.
- Use strong, unique passwords and consider a password manager.
- Back up firm data regularly and verify that backups can be restored.
- Stay alert to phishing attempts and suspicious emails.
- Establish clear policies regarding the use of AI tools and client data. (Also see, “Drafting an AI Policy That Actually Works,” JofA, July 1, 2026.)
- Review cyber liability insurance coverage and understand what protections are included in the event of a costly data security breach. (Also see, “Are You Prepared for the Cost of a Data Security Incident?” JofA, Oct. 1, 2025.)
- Think about cybersecurity as a client trust issue rather than simply a technology issue. Clients entrust firms with some of their most personal and sensitive information. Protecting that information is not just about compliance or risk management, it is about maintaining the trust that forms the foundation of every client relationship.
Cyber threats will continue to evolve, but sole practitioners who establish strong cybersecurity habits now will be far better positioned to protect their clients, their reputations, and their businesses in the years ahead.
Q: How can small firms improve the client experience without adding staff?
A: Delivering a great client experience is about making it easier to do business with your firm.
One of the biggest misconceptions small firms often have about improving the client experience is that it means doing more for clients. In reality, firms that consistently and effectively deliver exceptional client experiences are not necessarily providing more touches, more meetings, or more services. They are providing greater clarity, consistency, and intentionality.
Client experience is shaped not only by what firms do, but also by how clients feel throughout their interactions with firms. (To learn more, see, “Enhance the Client Experience with Two Simple Shifts,” AICPA & CIMA Professional Insights, June 8, 2026.) Do clients feel informed? Do they know what to expect next? Do they feel valued and confident that their needs are being addressed? When firms begin looking at their processes through that lens, opportunities for improvement often become much easier to identify.
The first place I encourage firms to focus on is communication. Usually, client frustrations aren’t the result of poor service but rather a lack of clear communication. Clients want to know where their project stands, what happens next, and when they can expect to hear from you. A simple status update, a clearly communicated timeline, or an acknowledgment that information has been received can significantly improve the client’s experience without adding complexity or time to your day.
Technology can help support these efforts. Automated appointment scheduling, document request reminders, client portals, workflow notifications, and automated email confirmations can keep clients informed while reducing administrative work. The goal isn’t necessarily to communicate more frequently but to communicate more intentionally.
Consistency is another area where small firms can make substantial improvements. Clients appreciate a predictable experience regardless of who serves them. Standardizing onboarding procedures, engagement timelines, document request checklists, and communication templates helps ensure every client receives the same level of service. These systems also improve efficiency by reducing rework and minimizing the need to recreate processes for each engagement.
I also encourage firms to identify and eliminate points of friction. Put yourself in your clients’ shoes and examine each step of the relationship. Is it easy to upload documents? Is your engagement process clear? Do clients understand your deadlines and expectations? Small adjustments that reduce frustration and confusion can have a positive impact on how clients perceive their experience with the firm.
Another effective strategy is to proactively manage expectations. Many client issues arise when assumptions are made on either side of the relationship. Clearly outlining responsibilities, timelines, deliverables, and communication preferences at the beginning of an engagement can prevent misunderstandings later.
Finally, ask your clients directly. Some of the most valuable insights come from simple conversations. Ask what they value most about working with your firm, where they experience challenges, and what could be improved. Their feedback often reveals opportunities that may not be visible from inside the organization.
The firms creating exceptional client experiences today aren’t necessarily adding staff or working longer hours. They’re intentionally designing client interactions, improving communication, creating consistency, and reducing friction. Often, the most meaningful improvements come from making it easier for clients to do business with your firm — and that’s something every small firm can accomplish.
About the author
Stephanie Otero, CPA, is vice president—Small Firm Advocate at the AICPA. She can be reached at SmallFirms@aicpa-cima.com. To comment on this article or to suggest an idea for another article, contact Jeff Drew at Jeff.Drew@aicpa-cima.com.
LEARNING RESOURCES
Stay ahead on issues shaping small CPA firms. This webcast offers insights on staffing, technology, compliance, and practice management, equipping firms with strategies to thrive.
2–3 p.m. ET, Oct. 22 and Dec. 17
WEBCAST
Join CPA.com in San Diego and online from Dec. 6–9 to discover emerging technologies, unlock actionable strategies, and collaborate with peers who are designing a new era of accounting.
CONFERENCE
Firm practice management will be on the agenda at the biggest event in the accounting profession.
June 7–10, 2027
CONFERENCE
For more information or to make a purchase, go to aicpa-cima.com/cpe-learning or call 888-777-7077.
MEMBER RESOURCES
Engage365 communities
AICPA Private Companies Practice Section (PCPS) community
PCPS members are invited to join the PCPS Engage365 Community. Whether you’re navigating firm management, exploring new technologies, or supporting your team’s development, this is your place to connect and grow together.
Article
“AI-Powered Hacking in Accounting: ‘No One Is Safe,'” JofA, Oct. 1, 2025
Podcast
“What Small Firms Are Getting Right About Tech and Why They’re Not Alone,” JofA, April 8, 2026
