How a Hull accountancy firm achieved Cyber Essentials, and peace of mind
360 Accountants, a well-established chartered accountancy firm in Hull, wanted to be certain their clients' data was secure and to show, credibly, that they take cyber security seriously in a digital age. As their managed IT partner, we recommended Cyber Essentials during an account review, then guided them to a first-time pass over two months, treating it as a genuine security uplift rather than a box to tick.
360 Accountants had been a managed services client of ours for several years. During a routine account review, we flagged that, given the sensitive client data an accountancy firm handles, they would benefit from Cyber Essentials certification and a stronger security posture overall. Rather than wait for a problem, they agreed, and we set to work.
The challenge
Accountancy firms hold some of the most sensitive data their clients possess: financial records, personal details, payroll, tax information. For a modern, digital-first practice, protecting that data is not just good practice, it is central to client trust and professional reputation.
- A firm handling highly sensitive client financial data, wanting certainty it was secure
- A need to demonstrate, visibly and credibly, that cyber and data protection were taken seriously
- Legacy elements in the setup, including an on-site application and remote desktop access, that no longer reflected best practice
- A desire to go beyond a certificate and genuinely strengthen day-to-day security
What we did
We began with a consultation on the firm's current security position, then spent the next two months guiding them step by step towards Cyber Essentials certification. This was deliberately not a paperwork exercise; we used the certification as the framework for a real improvement in security.
The work included:
- Moving an on-site application to a secure cloud-based system, bringing it under modern controls such as multi-factor authentication.
- Retiring remote desktop access, removing a well-known security exposure rather than simply a piece of software.
- Deploying Microsoft Intune across every laptop, giving the firm central management of its devices and enabling a full security suite spanning endpoint detection and response (EDR), managed detection and response (MDR) and identity threat detection and response (ITDR).
- Tightening everyday fundamentals, from password management and encryption to the full set of controls Cyber Essentials requires.
We also worked through a number of internal security matters directly with the firm. Under our guidance they met every requirement and achieved Cyber Essentials certification.
The relationship has not stopped there. 360 Accountants now works with us on an ongoing basis to maintain that posture, including staff cyber-awareness training and regular phishing testing, because good security is a habit, not a one-off.
Want the detail behind the acronyms? Our guide, EDR, MDR, ITDR and SIEM explained: why antivirus is no longer enough, sets out what each of these layers does and why they matter.
The results
Delivered over two months as a genuine security uplift, not a paperwork exercise, and maintained with ongoing staff awareness training and phishing testing.
We take our clients' data extremely seriously, and we wanted to prove it. What stood out about PrimaryTech was that they didn't just hand us a certificate. They guided us through every step and gave us honest, serious advice about our security, so we came out of it genuinely confident that we have the right protections in place, not just a badge on the wall. It has given us real peace of mind.
Sophie Holmes - Managing Director · 360 Chartered AccountantsFrequently asked questions.
What is Cyber Essentials?
Cyber Essentials is a UK government-backed certification scheme that helps organisations protect themselves against the most common cyber threats. It covers five technical control areas: firewalls, secure configuration, user access control, malware protection and security update management.
Why does an accountancy firm need it?
Accountancy firms hold highly sensitive financial and personal data on behalf of their clients. Cyber Essentials provides an independently assessed baseline of protection and, just as importantly, gives clients visible assurance that the firm takes data security seriously.
Is Cyber Essentials just a tick-box exercise?
It does not have to be, and it should not be. We use the certification as a framework to make real improvements, from device management and multi-factor authentication to retiring insecure legacy services, so the business is genuinely more secure, not just certified.
Does certification mean we are secure forever?
No. Threats evolve and so should your defences. That is why certification is best paired with an ongoing programme, such as staff cyber-awareness training and phishing testing, to keep protection current.
Could this be your story?
Start with a free health check. We'll show you what's possible, and exactly how we'd get you there.