Incident response
- 24/7 reporting line
- Forensic investigation
- Recovery and restart
Cyber insurance for accountants
For an accountancy firm, the moment of the outage determines the size of the loss: the same ransomware costs many times more during the tax return and annual accounts peak than in a quiet month.
- several insurers compared objectively
- 9.5 customer rating for a new policy
- AFM licence 12016589
- Personal 072 - 509 24 56, weekdays 9–17
This page in another language: Nederlands
Work out for yourself what it would cost.
Enter your details; you will receive a proposal within one working day.
- We compare the offerings of several insurers
- An adviser checks whether the cover suits your activities
- We arrange the switch, including cancellation
A premium indication, not personal advice. Prefer to talk it through? Call 072 - 509 24 56.
- Independent advice
- Several insurers
- Switching arranged
- Help with claims
In brief
An accountancy firm keeps not only its own records but those of dozens or hundreds of clients. Those files contain tax data, draft annual accounts, payroll data with citizen service numbers and the identity documents you have to record and retain under the Wwft (the Dutch anti-money laundering act). You are therefore not allowed to throw those documents away to reduce your risk. If they leak, the duty to report to the Autoriteit Persoonsgegevens (the Dutch data protection authority) within 72 hours applies, alongside your own professional duty of confidentiality towards the client.
The cover falls into three items. Restoring your systems and retrieving or reconstructing client records. The business interruption, which at a firm is measured in non-chargeable hours rather than lost sales. And liability towards clients whose data has come out, together with the costs of forensic investigation and informing those concerned.
Note the boundary with your professional indemnity insurance. A tax return that goes out late because your systems were down leads to an additional assessment or tax interest for the client. That is pure financial loss arising from a professional error and belongs with the BAV, not with cyber. The cyber policy pays for the recovery and the interruption. The claim that follows from the delay is assessed on the other policy. Make sure the two covers join up and do not both leave a gap.
Independent, personal, sorted quickly
We compare your cyber insurance across dozens of insurers, explain where the real differences lie, and arrange the switch from start to finish — without you having to chase it yourself.
Cyber insurancePhoto coming soon
ComparePhoto coming soon
Get coveredPhoto coming soon
What does cyber insurance for accountants cover?
The structure of the cover in three parts, with an overview per situation below.
Own damage
What the incident costs you yourself.
- Data recovery and reconstruction
- Business downtime
- Ransom under consideration
Liability
Claims from customers and data subjects.
- Claims after a data breach
- GDPR notification costs
- Legal assistance
What is covered
| Situation | Cyber | AVB | BAV |
|---|---|---|---|
| Ransomware brings your systems down | Yes | No | No |
| Data breach involving personal data | Yes | No | Sometimes |
| Costs of notification and informing those affected | Yes | No | No |
| Fraud through a falsified payment instruction | Sometimes | No | No |
| Administrative fine from the regulator | No | No | No |
| Hardware that is physically damaged | No | No | No |
This overview is general in nature and is not personal advice. What is actually covered, including exclusions, limits and the excess, is set out in the policy conditions and the insurance card (verzekeringskaart) of the insurer; you receive both before you take out cover. Taking out cover without advice? Then read what execution only means for you.
What does your premium depend on?
- Turnover and number of FTEs. Fee income is the basis for calculation. The number of staff also helps determine the attack surface.
- Number of client files. More files means that after a breach there are more people you have to identify and inform.
- Wwft documents in storage. Copies of identity documents and UBO data weigh more heavily than accounting data alone.
- Cloud package or your own server. Your own file server with a local back-up is assessed differently from a hosted accounting environment.
- Waiting period for the downtime cover. The number of hours before cover starts is the most expensive dial to turn where there are seasonal peaks.
- Earlier phishing or fraud attempts. An earlier successful attempt on a mailbox almost always leads to additional requirements in advance.
Insurers weigh these details differently. That is where your saving is.
How we arrange it
- You request a quoteWe take stock of your situation, your risk and your wishes.
- We compareseveral insurers, on premium as well as conditions.
- You receive a proposalWith an explanation of the differences and the exclusions.
- We arrange the switchIncluding cancellation, so there is no gap in cover.
Why arrange it through Finass Verzekert?
We look at the terms as well as the premium, and stay your point of contact when there is a claim.
Independent
We are not tied to one insurer and compare on the basis of an objective analysis of several companies.
One fixed adviser
You call or email someone who knows your file. No menu options, no changing call centres.
Switching without hassle
We cancel your old policy and align the start date, so you are never a day without cover.
Help with claims
We report the claim and monitor how it is handled. In urgent cases you can reach us on the emergency line.
9.5New policy
9.8Claims handling
Customers rate our service on four aspects: personal service, service delivery, availability and the outcome. The reviews are collected and published by NH1816 and come from customers who have actually taken out a policy with Finass Advies B.V. or reported a claim.
Where things go wrong in practice
Four points that make the difference between a policy that pays out and one that does not.
Reconstruction is labour, not file recovery
If ledgers have been encrypted or destroyed and the back-up is older than the last processing round, the records have to be rebuilt from bank transactions, invoices and tax returns. That is manual work by your own people or by staff brought in. Ask explicitly whether those hours fall under the data recovery item or only the technical restore. Insurers deal with that differently and at a firm the difference is large.
You measure interruption in chargeable hours
The interruption cover only starts after a waiting period of a number of hours and then runs for an agreed period. For a firm that earns its turnover in March and April, that waiting period matters more than the limit: work left undone in the peak is rarely caught up in the summer. Discuss whether the payout is calculated on an annual average or on the actual period of the outage.
The client is often the controller and you the processor
For payroll administration and parts of the financial records you work to instructions. The data processing agreement then contains a period for reporting to your client that is shorter than the 72 hours of the GDPR, sometimes 24 hours. That contractual deadline determines how quickly the incident response team has to establish which files have been affected. Set your current data processing agreements alongside the policy before you sign.
What falls outside the cover
Not covered are administrative fines of a punitive nature, the additional assessment and tax interest your client incurs, structural improvements to your security afterwards, and damaged equipment or servers, which fall under the business contents insurance. Intent and wilful recklessness remain outside the cover under Article 7:952 of the Dutch Civil Code, as does a breach arising from a vulnerability you knew about and left in place.
Frequently asked questions
This is what people ask us most.
An attack makes us miss a client's filing deadline. Who pays the additional assessment?
That question is assessed on the professional indemnity insurance (BAV), not on the cyber policy. The client suffers financial loss because you did not carry out the work on time. That is a professional error, even if the cause lay outside you. The cyber cover does pay for restoring your systems, the investigation and your own interruption during that period.
We work entirely in an online accounting package. Are we still at risk?
Yes. The main risk then shifts from your server to your employees' accounts. If a mailbox or a package account is taken over, the same files are exposed and you remain responsible towards your clients and the Autoriteit Persoonsgegevens. You also carry the risk that the supplier itself is offline for days.
Does the insurer pay for rebuilding a set of records?
Only if the data recovery item also covers labour and is not limited to the technical restore of a back-up. Have that put in writing before you sign. Expect the insurer to ask how recent your last usable back-up was. The bigger the gap, the more hours involved and the sharper the discussion about the size of the loss.
Do we also have to report a data breach to our clients?
If you act as a processor for a client, you report the breach to that client and the client reports it to the Autoriteit Persoonsgegevens where necessary. The period in your data processing agreement is usually shorter than 72 hours. For data you record as controller, such as your own client relationship management, you report it yourself.
Every situation is different. For these situations we have a separate page.
- Compare business cyber insuranceThe main page
- Cyber insurance for solicitorsConfidentiality, case files, professional secrecy
- Cyber insurance for self-employed professionalsCustomer data, incident response, small business
- Cyber insurance for bookkeeping firmsPayroll data, payments, client data
- Cyber insurance for pharmaciesMedication records, downtime, supply chain
- Cyber insurance for insurance brokersClient files, policies, duty of care
- Cyber insurance for physiotherapistsPatient records, small practice, duty to report
- Cyber insurance for the hospitality sectorPayment systems, reservations, customer data
- Cyber insurance for mortgage advisersClient files, identity fraud, duty of care
Ready to compare?
Request a quote without obligation. We will look at which insurer best matches your activities and your risk.
Prefer to call? 072 - 509 24 56, weekdays 09:00–17:00.
Claim on the road? Emergency line 06 - 55 20 40 72.
About our service
Finass Verzekert is a trading name of Finass Advies B.V. We advise on and arrange non-life insurance on the basis of an objective analysis of several insurers, and receive commission for this from the insurer, which is included in the premium. You pay no separate advice fee. Before you take out cover, we establish your wishes and needs.
You will find our licence, KvK and Kifid details and our complaints procedure at the foot of every page.
This page was compiled by Finass Verzekert (LinkedIn). Last updated on .
The information on this page is general in nature and is not personal advice.