As October comes to a close, Cybersecurity Awareness Month offers one more reminder to review how your business protects its financial information. The month may be ending, but the habits it encourages deserve a place in your routine throughout the year.
Think about the information moving through your business every day: customer payments, vendor invoices, employee records, bank statements, and bookkeeping reports. Protecting those details involves both technology and the everyday decisions people make when handling them.
Before October ends, take a moment to consider where a few simple changes could strengthen your procedures. You can explore practical guidance through the Federal Trade Commission’s Cybersecurity for Small Business resources.
A Familiar Name Doesn’t Always Mean a Legitimate Request
An invoice arrives from a familiar vendor. An email asks you to update payment information. A message that appears to come from your bank warns that your account needs immediate attention.
During a busy workday, these requests can blend into your normal routine. Scammers may use convincing messages, slightly altered email addresses, or compromised accounts to make fraudulent requests appear legitimate.
The FBI describes this type of fraud as business email compromise. Its Business Email Compromise guide explains how these scams work and what businesses can do to protect themselves.
Imagine receiving an email that appears to come from your usual supplier. It explains that their banking information has changed and asks you to send the next payment to a new account. The invoice amount looks right, and the timing makes sense. Even so, the change deserves a separate check.
Before updating the information, call your established contact using a phone number already in your records. Avoid using the number included in the message you are trying to verify. The FBI recommends independently confirming changes in payment instructions through a known contact.
Making that verification step part of your regular payment process gives your team a clear procedure to follow—even when a request looks routine.
Protect the Accounts That Keep Your Business Moving
Your email, banking, payroll, and bookkeeping accounts deserve particular attention because of the information and access they hold.
The Cybersecurity and Infrastructure Security Agency recommends using long, random passwords that are unique to each account, storing them in a password manager, and enabling multifactor authentication where available. Multifactor authentication adds an identity check beyond your password, such as a code from an authenticator app.
Start with a manageable review of your essential accounts. Are you using the same password in more than one place? Is an additional sign-in safeguard available but still turned off? Does everyone understand that passwords and verification codes should remain private?
For a quick reference you can share with your team, CISA’s Cybersecurity Awareness Month tip sheet summarizes password security, multifactor authentication, phishing awareness, and software updates.
Account protection is an ongoing responsibility. Revisit these settings as your business adds employees, changes systems, or introduces new services.
Review Who Has Access to Your Financial Information
As a business grows, access can accumulate. Employees change responsibilities, outside providers finish projects, and temporary arrangements sometimes remain in place longer than intended.
The FTC recommends restricting sensitive information to the people who need it to perform their work. Its Protecting Personal Information: A Guide for Business offers a deeper look at safeguarding information in both electronic and paper form.
Apply that principle to your financial systems. Review who can view reports, edit records, manage users, or authorize payments. Consider whether each person’s access still matches their current responsibilities.
Where your software supports it, give each person an individual login with appropriate permissions. Include an access review whenever someone joins your business, changes roles, or leaves.
These reviews also create an opportunity to clarify responsibilities. Knowing who enters a bill, who approves it, and who releases the payment makes your process easier to manage and review.
Make Updates and Backups Part of the Routine
Software updates are easy to postpone when you are in the middle of something. However, they can include security fixes that help protect your devices and information. CISA recommends keeping software current and enabling automatic updates when available.
Backups deserve a place on the schedule, too. The FTC recommends regularly backing up important business information and keeping protected backups separate from the network to support recovery after an attack.
Think beyond the numbers inside your bookkeeping software. Your business may also depend on invoices, receipts, contracts, payroll documents, and other supporting records.
Ask your technology provider to help confirm what is being backed up, how those backups are protected, and how files would be restored. A backup plan is most useful when the people responsible understand how it works.
Give Your Team Permission to Pause
A verification procedure works best when people feel comfortable using it.
Let employees know that checking an unusual request is part of doing their job well—even when the message appears to come from an owner, manager, longtime client, or trusted vendor.
Consider walking through a few realistic examples together:
- A vendor requests a last-minute change to payment instructions.
- An employee email asks to redirect a paycheck to a different bank account.
- A message claims an account will be suspended unless someone signs in immediately.
- An unexpected attachment arrives with instructions to review an overdue invoice.
The FTC recommends training staff to recognize suspicious messages and ensuring they know how to report potential problems. Its small-business cybersecurity resources include guidance on phishing, ransomware, and business email imposters.
Choose a clear internal contact for questions and concerns. If someone clicks a suspicious link or shares information by mistake, encourage prompt reporting so the appropriate person can respond.
Carry These Habits Into November and Beyond
As we wrap up October, choose a few practical improvements to carry forward.
You might enable multifactor authentication on an essential account, review access to your bookkeeping system, establish a payment-change verification procedure, or confirm backup arrangements with your technology provider.
Give each action an owner and a completion date. “Review security” is easy to postpone. “Confirm vendor payment-change procedures with our team next week” creates a clear next step.
At J. Zollo & Associates, we understand how much your business depends on accurate, organized financial information. Clear bookkeeping procedures and consistent attention to your records support the day-to-day management of your business.
Cybersecurity Awareness Month may be coming to an end, but thoughtful habits remain valuable all year. For help organizing your books and establishing a more consistent bookkeeping routine, visit jzollo.com.