Cybersecurity Awareness Month 2025: For Accountants

Q: Does Cybersecurity Awareness Month matter for small CPA firms?

Yes. Solo and boutique practices are actively targeted. Insurers and regulators look for proof of controls—like MFA, backups, and staff training—regardless of firm size.

Q: What are the biggest cyber risks for Tennessee accountants in 2025?

Phishing and business email compromise, ransomware on unsupported Windows 10 devices, weak or partial MFA coverage, and untested backups that fail during recovery.

Q: How does Windows 10 end of support affect compliance?

After October 14, 2025, Windows 10 no longer receives free security updates. Unsupported endpoints raise audit risk under IRS Pub 4557 and FTC Safeguards and can trigger insurance exclusions.

Q: What’s the simplest step my firm can take this month?

Enable MFA everywhere (email, portals, remote access) and perform a documented test restore of critical systems. These two actions sharply reduce breach and downtime risk.

Cybersecurity Awareness Month: What Nashville & Clarksville Accounting Firms Must Know in 2025

October is Cybersecurity Awareness Month, and for CPA firms, bookkeepers, and tax preparers in Nashville, Clarksville, Franklin, Hendersonville, Gallatin, and nearby Kentucky markets, this isn’t just a national campaign—it’s a survival guide.

Cyberattacks targeting accounting firms are rising, insurance requirements are tightening, and regulatory frameworks like IRS Pub 4557 and the FTC Safeguards Rule now demand proof, not promises. Let’s break down the five cybersecurity priorities every firm should tackle this October.

1) Phishing: Tennessee’s #1 Cyber Threat

The FTC reported over $157 million in fraud losses in Tennessee last year, a 38% increase from the year before. Many of these stemmed from phishing and impersonation scams. For firms handling tax data, even one mistaken click can jeopardize client trust and cause an insurance denial.

Action Steps for Accountants:

Run a phishing simulation this month to test staff awareness.
Train employees to spot red flags (hover to verify, don’t click suspicious links).
Enable SPF, DKIM, and DMARC in Microsoft 365 to block spoofed emails.

2) Multi-Factor Authentication (MFA) Is Non-Negotiable

Cyber insurance carriers now require MFA for all email, portals, and remote access apps. Firms that skip this step risk coverage exclusions after a breach.

Action Steps for CPA Firms:

Confirm 100% MFA coverage across Microsoft 365, RDS/AVD, and portals like SmartVault or TaxDome.
Deploy Conditional Access to block logins from outside TN/KY.
Educate staff about MFA fatigue—attackers exploit users who auto-approve push requests.

3) Windows 10 End of Life: October 14, 2025

Microsoft will end free support for Windows 10 on October 14, 2025. Unsupported devices won’t receive security patches, making them a liability for IRS and FTC compliance and often uninsurable.

Action Steps for Nashville & Clarksville Firms:

Inventory devices now—replace or upgrade before busy season.
For scanners or legacy apps, consider Extended Security Updates (ESU) or network isolation.
Document your migration plan for insurance evidence packs.

4) Backups & Tested Restores: Proof Over Promises

Nashville recently saw an NES outage that cut power to 1,600+ customers, a reminder that storms and outages can hit at any time. For firms, downtime during tax season means lost billable hours.

Action Steps:

Test a restore this October and document the result.
Follow the 3-2-1 rule: 3 copies, 2 media, 1 immutable or offline.
Protect Microsoft 365, RDS servers, and client portals with verified backups.

5) Local Awareness: Tennessee Firms Are Prime Targets

Nashville’s growth, Clarksville’s military presence, and cross-border clients in Kentucky make this region especially attractive to attackers. That’s why Cybersecurity Awareness Month is the perfect time to show staff and clients you take security seriously.

Action Steps:

Share a weekly cyber tip on LinkedIn throughout October.
Host a 15-minute staff training: “Top 3 scams hitting Tennessee CPAs.”
Refresh your Written Information Security Program (WISP) and include updated FTC/TIPA privacy requirements.

Closing Thought

Cybersecurity Awareness Month isn’t about fear—it’s about trust and readiness. By addressing these five areas, your firm can head into tax season confident, compliant, and prepared.

Let’s make April boring—in the best way possible.

Does Cybersecurity Awareness Month matter for small CPA firms?

Yes. Even solo and boutique practices are being targeted. Insurance carriers don’t care about size—only proof of compliance.

What are the biggest cyber risks for Tennessee accountants in 2025?

Phishing, ransomware on unsupported Windows 10 systems, weak MFA enforcement, and untested backups.

How does Windows 10 end of support affect compliance?

Unsupported systems are flagged as high-risk by insurers and may cause audit failures under IRS 4557 and FTC Safeguards.

What’s the simplest step my firm can take this month?

Enable MFA everywhere and schedule a test restore—two low-cost moves that dramatically reduce both risk and insurance exposure.