How CPAs can help with clients’ cybersecurity needs

The cybersecurity market is
expected to grow to $248 billion
by 2023.⁷ Boards of directors and audit committees want greater assurance and transparency that the companies they serve are establishing effective cybersecurity risk management programs. Regardless of your firm’s cybersecurity expertise, you can play a role in protecting your clients from cybersecurity threats.Firms with limited
cybersecurity knowledge
If your practice is not yet ready to make cybersecurity a key practice area, you can still show concern for your clients by asking about what kinds of protections they have in place, staff training programs, privacy and security policies, response plans and other controls that help mitigate risks. You can also connect them with experts who can help them put together an effective cybersecurity risk management program. If your firm is looking to grow its knowledge of cybersecurity, consider upskilling staff or partnering with a firm that has this expertise.Firms with knowledge and experience in cybersecurity
If your firm specializes in information technology, you may be well-equipped to step in and provide advisory services including:

Readiness assessments and gap analysis

Cybersecurity or information security risk assessments

Vulnerability assessments and penetration testing

Application security and database security assessments

Information security policy development

Data classification process design and consulting

User life cycle management consulting

Social engineering and awareness training

Security incident response program development and testing

Disaster recovery plan consulting

Cybersecurity Assurance Services
If your firm is already offering advisory services or other third-party reporting examinations, offering SOC for cybersecurity examination services would be a next step.Using the AICPA’s SOC for Cybersecurity framework, you can provide assurance over the effectiveness of controls over an organization’s cybersecurity risk management program, helping build trust and transparency for customers, investors and leadership.

Benefits of a SOC for cybersecurity examination include that it:

Provides an independent, entity-wide assessment of an organization’s cybersecurity risk management program

Helps reduce uncertainty and build resilient organizations by evaluating the effectiveness of existing cybersecurity processes and controls

Permits flexibility by not constraining management to a particular security management framework or control framework

Results in general use report

Strong cybersecurity and transparency about how data is used go a long way toward customer loyalty and trust. CPAs can help their organizations and clients get their cybersecurity on track for a more secure future. For more resources to help you get started on the path to learning all things cybersecurity, check out the resources and tools on the next page.

How-to Guide ▶

The benefits of SOC for cybersecurity