Virtual bookkeeping is fast and flexible—until a weak password, overshared access, or a bad app connection turns convenience into chaos. Here’s a pragmatic security baseline any owner can implement without hiring a CISO.
Why cybersecurity matters more when your books are virtual
A modern finance stack touches a lot of doors: QuickBooks Online (QBO), bank and credit-card portals, payroll systems, receipt capture (e.g., DEXT), file storage (Google Drive/OneDrive/Dropbox), e-signature, and sometimes AI helpers. Every door is another way data can leak or accounts can be taken over.
You don’t need enterprise-grade everything. You need consistent, minimal friction controls that prevent the big, common failures: reused passwords, over-permissioned users, missing 2FA, insecure file sharing, and no plan for “what if.”
This guide gives you a practical baseline you can roll out in days, not months.
The new risk surface: cloud apps, file sharing, and AI agents
Remote books expand your “attack surface” in three ways:
- More apps. Each connection (payroll, receipt capture, vendors that link to QBO) carries its own login, data storage rules, and permissions.
- More sharing. Vendors, contractors, and clients upload files; staff download bank statements; auditors request exports.
- More automation/AI. Tools suggest categorizations, fetch statements, or sync data behind the scenes. Helpful—until they’re misconfigured.
Your aim: reduce how many people and apps can touch sensitive data, and increase your ability to see and undo mistakes.
Minimum foundation for the team
- Business email on a modern provider (Microsoft 365 or Google Workspace)
- A password manager (1Password/Bitwarden/LastPass Business) for unique, 20+ character passwords
- Device encryption on laptops + automatic OS updates
- A living access inventory (who has what, last reviewed date)
- Clear “never do this” rules (no sending W-9s or bank details via email; no personal email for business logins)
QBO roles & permissions: least-privilege done right
QuickBooks makes it easy to over-grant access. Least privilege means each person gets only what they need to do their job—and nothing more.
Suggested QBO role plan
- Owner/Admin (1–2 max): True administrators. Use sparingly and avoid daily activity with these logins.
- Controller/Lead Bookkeeper: All accounting areas, but not account-owner settings, user management, or app-authorizations unless part of their job.
- Staff/Contractors: Narrow scopes—e.g., enter bills, view vendors, no banking, no payroll. Turn off customer lists if they don’t need them.
- CPA/Auditor: Read-only; time-bound access that you disable after close or audit.
- Clients/Vendors: Use a portal for uploads and approvals; do not give them QBO logins unless they actually perform accounting tasks.
Quarterly access audit checklist
- Remove users who haven’t logged in during the last quarter.
- Review app connections (Gear → Apps → My Apps) and disconnect anything you don’t actively use.
- Confirm who can see bank registers and payroll.
- Verify closing date is set with a password to prevent prior-period edits.
Tip: Mirror your estimating/operations code list inside QBO (items, products & services, classes). Clean roles + consistent codes = fewer miscoded transactions and faster reviews.
2FA/MFA everywhere: banks, QBO, DEXT, portals
Stolen passwords are still the #1 cause of account takeovers. Two-factor authentication (2FA/MFA) turns a stolen password into a useless string.
Turn on MFA for:
- Banks and credit cards (every institution, every user)
- QBO (all roles)
- Payroll (Gusto, ADP, QuickBooks Payroll, etc.)
- DEXT / receipt apps
- File storage (Drive/OneDrive/Dropbox)
- Email (Google Workspace / Microsoft 365)
- Password manager (absolutely)
Better than SMS: Use an authenticator app (Microsoft Authenticator, Google Authenticator, 1Password’s built-in) or hardware keys (YubiKey) for admins. Store backup codes in the password manager entry so recovery doesn’t become its own incident.
Vendor/app vetting: what “good” looks like
Not every app deserves a ride inside your books. Before you connect:
- Security attestations: SOC 2 Type II or a recent third-party pen test.
- Audit logs: Can you see who did what, when? (Vital for forensics.)
- MFA/SSO support: Can you force MFA for all users?
- Granular permissions: Can you limit what the app can read or change?
- Data residency/retention: Where is data stored, and for how long after you disconnect?
- Offboarding path: How do you export your data and fully delete your account?
Red flags: no MFA, vague security claims, no logs, or broad “all data” access with no controls.
PII & 1099 data: intake, storage, transmission
Bookkeeping often touches Personally Identifiable Information (PII): SSNs on W-9s, addresses, bank account info, payroll data. That’s regulated in multiple ways and dangerous if mishandled.
Safe intake
- Collect W-9s and vendor PII via secure forms/portals (e-signature or file requests with encryption), not email.
- Disable email attachments for PII by policy; use share links that expire.
Controlled storage
- Maintain a “PII—Restricted” folder with limited access.
- Enable version history and file event logs.
- Keep a PII index: who has access, and why.
Careful transmission
- Share links, not files; set expiry dates and viewer-only permissions.
- Use password-protected PDFs only when you must send a file, and share the password through a different channel (e.g., SMS).
Seasonal risk: 1099 prep
- Create a “need-to-know” roster for the 1099 project window.
- After filings, purge temp files that duplicate PII (downloads, desktop copies).
- Keep the authoritative W-9 and 1099 archive in the restricted folder with role-limited access.
Incident-ready: backups, versioning, and a one-page response plan
Incidents happen: a laptop is lost, a bank login is phished, an app sync goes sideways. The goal is to be recoverable and decisive.
Backups & versioning (so you can roll back fast)
- Cloud drive versioning: ensure it’s on for your accounting folder structure.
- Periodic offline exports (quarterly at minimum):
- QBO General Ledger (by fiscal YTD), Trial Balance, Chart of Accounts
- Open AR/AP, vendor list, customer list
- Bank rules (export) and list of connected accounts
- Payroll reports (if applicable)
- Store exports in a read-only backup folder or offline archive with access limited to admins.
The one-page incident response plan (who, what, when)
This should be a plain-English PDF everyone can find quickly.
Sections to include:
- Trigger examples: suspected email compromise, missing laptop/phone, unexpected MFA prompt, bank alert, unusual app activity, ransomware notice.
- First 4 steps (always):
- Isolate (log out everywhere; disable the user; put lost devices in remote lock/wipe mode).
- Rotate (change passwords for the affected app + email + password manager; invalidate tokens/API keys).
- Review (check audit logs for changes, new rules/forwards in email, new payees or bank rules).
- Notify (internal lead + owner; external bank/app support as needed).
- Decision tree: When to freeze spending, shut off bank feeds, or engage an external IT/security partner.
- 72-hour communications: simple templates for notifying a bank, a vendor, or—if necessary—clients affected.
- Evidence capture: where to export logs, who stores them, retention period.
- Post-mortem checklist: root cause, fixes, training, and a date to verify changes stuck.
Want our one-page Incident-Ready Checklist template? Ask and we’ll share a PDF you can drop your company name into.
Implementation roadmap: roll this out in one week
Day 1–2: Foundation
- Enforce MFA across email, QBO, banks, payroll, DEXT, and drives.
- Require the password manager for the finance team.
- Enable device encryption and auto-updates.
Day 3–4: QBO & files
- Set/confirm closing date with password.
- Review QBO user roles; remove dormant users; tighten staff/contractor access.
- Turn on file versioning and create PII—Restricted folders.
- Document “never via email” policy for PII and banking details.
Day 5: Apps & inventory
- Vet connected apps; remove what you don’t use.
- Create your access inventory (people, apps, roles, last review date).
- Export key QBO reports and bank rules for the recovery archive.
Day 6–7: Drill & polish
- Draft the one-page incident plan and run a 20-minute tabletop scenario (e.g., “lost laptop” or “phished bank login”).
- Train the team on where to find backup codes, how to use the password manager, and how to upload PII safely.
Common pitfalls (and how to avoid them)
- Shared logins. If two people share “admin@…”, you have no audit trail and you’ll fail MFA recovery at the worst moment. Fix: individual accounts only.
- SMS-only MFA for admins. SIM-swap risk is real. Fix: authenticator apps or hardware keys for admins.
- Everything in email. Email is the least secure place to store PII. Fix: portals and share links with expiry.
- Over-granting in QBO. “Just give them admin so it’s easier.” Fix: least-privilege plus a quarterly access audit.
- No closing date. Prior-period edits hamstring audits and board reporting. Fix: set the date, require a password.
- No plan. Incidents feel bigger when you improvise. Fix: one-page plan you can act on in 5 minutes.
FAQ: quick answers for owners
Q: Is SMS 2FA “good enough”?
A: Better than nothing. For admins and banking, use an authenticator app or hardware keys.
Q: Do I need SOC 2 vendors only?
A: It’s ideal, but not always feasible for small tools. If no SOC 2, look for some third-party testing, robust audit logs, MFA support, and clear data deletion.
Q: How often should we run access audits?
A: Quarterly is a good cadence; monthly if you have high contractor turnover.
Q: What if my bookkeeper resists using a password manager?
A: Make it a condition of access. It’s cheaper than one incident.
Q: Where should we store backup codes and exports?
A: In your password manager (for codes) and in a read-only backup folder with admin-only access (for exports).
A simple security checklist (copy/paste)
- MFA on email, QBO, banks, payroll, DEXT, file storage, password manager
- Password manager enforced; unique 20+ character passwords
- Device encryption + automatic updates verified
- QBO closing date with password; quarterly access audit
- App vetting done; unused connections removed
- PII—Restricted folder with limited access; link-sharing with expiry
- W-9/1099 handled via portal; purge temp files post-filing
- Quarterly offline exports: GL/TB, AR/AP, bank rules, lists
- Incident plan written; team drill completed
- Access inventory updated with last-review date
Bring virtual efficiency and security together
You don’t need perfect security—you need predictable, repeatable controls that keep donor data, vendor PII, and your cash safe while your team moves quickly.
If you want help implementing this baseline—MFA rollouts, QBO role tuning, app cleanup, and a one-page incident plan—we can stand it up fast and hand you the keys.
Explore our Virtual Bookkeeping services (paperless, audit-ready): centsandbalance.com/virtual-bookkeeping
Have questions or want the checklist PDF? centsandbalance.com/contact
Primary keyword: virtual bookkeeping cybersecurity
Secondary: secure bookkeeping, permissions in QuickBooks, two-factor authentication
By Katherine White
