Cybersecurity for accounting firms and fiduciaries in Morocco: the priority measures

The short answer: an accounting firm or fiduciary in Morocco holds, for dozens of clients, financial statements, tax returns, payslips, bank details, and often their access to public platforms such as SIMPL (tax) or DAMANCOM (social security). That makes it a prime target. The priorities, in order: multi-factor authentication on email and every remote access, email protected against spoofing (SPF, DKIM, DMARC), a written procedure against bank detail change fraud, a credential vault instead of shared spreadsheets, encrypted laptops protected by EDR, access rights per client file, and immutable backups tested before every filing deadline.

At ALLSAFE SOLUTIONS, we support accounting firms, fiduciaries and law firms from Casablanca with their IT and security (see our page on IT for accounting and law firms). This guide lists what we put in place first, without unnecessary jargon.

Why accounting firms are targets

Three reasons make a firm more exposed than an SMB of the same size:

• Data concentration. A single staff laptop can hold the financial statements, payroll and ID documents of several companies.
• Delegated access. The firm logs into tax and social security platforms on behalf of its clients, sometimes into their banks or ERP. A credential stolen at the firm opens the door at the client.
• Trust. Clients are used to receiving document requests, schedules and amounts to pay from the firm. A hijacked mailbox can send perfectly credible fake messages to the whole portfolio: fake bank details, fake document upload link, fake fee invoice.

Add to that the activity peaks around tax and social security deadlines: the time when people click fast, work late from home, and when an outage or ransomware costs the most.

What the rules say

Three frameworks are worth knowing, without turning this into legal advice:

Framework	What it means for a firm
Professional ethics	Chartered accountants are bound by a Code of professional duties, made applicable by decree no. 2-18-454; confidentiality of client files is at the heart of the profession
Law 09-08 (personal data)	Payroll, employee lists, ID documents: personal data to secure, processing to frame, CNDP as supervisory authority
Law 05-20 (cybersecurity)	Rarely applies directly to a private firm, but often imposed by contract when it serves public clients or critical infrastructure

For details, see our guides on law 09-08 and the CNDP and on law 05-20 and the DGSSI. The split of responsibilities between the firm and its clients for payroll data is set out in the engagement letter: have it reviewed by your legal adviser.

The priority measures

Priority	Measure	What it prevents
1	Multi-factor authentication on email, VPN and cloud apps	A mailbox taken over through a simple stolen password
2	SPF, DKIM and DMARC on the firm’s domain	Fake emails “from the firm” sent to your clients
3	Written procedure against bank detail fraud	A payment diverted on the strength of an email
4	Business password manager	Client credentials in a spreadsheet or browser
5	Access rights per file or portfolio	One compromised account exposing every client
6	Encrypted, remotely managed laptops	A lost laptop turning into a data leak
7	Monitored EDR on PCs and servers	Ransomware detected too late
8	Immutable, tested 3-2-1 backup	An accounting database lost in the middle of a deadline
9	Remote access through VPN or ZTNA, never exposed remote desktop	The entry point most used by ransomware
10	Staff awareness before each deadline	A click on a fake “government” message

1 and 2: lock down email

Email is the number one entry point. Turn on multi-factor authentication for every account, including partners and shared mailboxes, and block legacy protocols that bypass it. On Microsoft 365, follow our 10 settings to secure Microsoft 365. Then publish SPF, DKIM and DMARC records so that a fraudster can no longer send emails that appear to come from your domain: the method is detailed in our guide SPF, DKIM and DMARC in Morocco.

3: the bank detail fraud procedure

This is the least technical measure and one of the most useful. Write it down and have it signed:

• no change of bank details, supplier side or client side, on the strength of an email or PDF alone;
• always call back on a phone number already known, never the one in the message;
• approval by a second person for any unusual or urgent payment.

Tell your clients too: “the firm will never ask you to change bank details by email”.

4 and 5: credentials and access rights

Clients’ SIMPL, DAMANCOM or banking credentials have no place in a shared Excel file or in an employee’s browser. A business password manager lets you create vaults per team or per portfolio, protected by multi-factor authentication, with an access log. Same logic for files: an employee only accesses the files of the clients they handle. When someone leaves, their access is cut in one operation and sensitive passwords are changed.

6 and 7: mobile laptops and ransomware

Staff often work at client sites or from home during filing season. Every laptop must be encrypted (BitLocker on Windows), managed remotely so it can be wiped if stolen, and protected by a monitored EDR, not just an antivirus. With Microsoft 365 Business Premium, all of this goes through Intune: see our guide Microsoft Intune for SMBs. For the difference between antivirus and EDR, see EDR vs antivirus. Finally, remove administrator rights from everyday users.

8: backups that survive a deadline

A firm’s backup must cover three things: the accounting software database (backed up consistently, not just as open files), the file server or document space, and email, which Microsoft does not back up for you in the sense of a full restore (see Microsoft 365 backup and shared responsibility). Apply the 3-2-1 rule with an immutable copy, and test a restore before each major deadline, not during it.

9: remote access

A remote desktop (RDP) opened directly to the internet remains one of the entry points ransomware exploits most. Partners and staff connect through a business VPN, IPsec or ZTNA, with multi-factor authentication, behind an up-to-date firewall.

10: raise awareness at the right time

Phishing campaigns readily imitate a government body, a bank or a client. The DGSSI reminds the public that all official websites of the Moroccan State are hosted under the .gov.ma domain: a simple reflex to pass on to staff. Run a short session before each filing period, with concrete examples from our guide on phishing in Moroccan SMBs.

Exchanging documents with clients

Email attachments remain the main way firms exchange documents, and the main attack vector. Two simple improvements:

• A sharing space (SharePoint, OneDrive or Google Drive depending on your email) with one folder per client, links restricted to invited people and an expiry date.
• A rule of suspicion: an expected document that arrives as a link to a sign-in page is suspicious, even from a known client, whose mailbox may have been hacked.

Mistakes we come across

1. Shared generic mailbox (contact@, accounts@) without multi-factor authentication.
2. Spreadsheet of client credentials on the server or in email.
3. Partners exempted from multi-factor authentication “to save time”.
4. Backup on a USB drive permanently plugged in, encrypted by ransomware along with the server.
5. Exposed remote desktop for working from home.
6. Former employees whose accounts and access to client platforms remain active.
7. No written procedure for bank detail changes.

Getting-started checklist

• Turn on multi-factor authentication for every email account and remote access.
• Publish SPF, DKIM and DMARC.
• Write and share the bank detail fraud procedure.
• Move client credentials into a password manager.
• Review access rights per client file and disable unused accounts.
• Check laptop encryption and EDR deployment.
• Check backups of the accounting software, files and email, then test a restore.
• Close any exposed remote desktop and switch to a VPN.
• Hold an awareness session before the next deadline.
• Prepare a disaster recovery plan suited to filing periods.

How we work

We start with an audit: email, PCs, server, backups, remote access, credential and departure management. We deliver a list of actions ranked by priority, then implement them without disrupting production, outside deadline peaks. From then on, PCs, servers and backups are monitored 24/7, with critical incidents handled in under 15 minutes.

Discover our business cybersecurity in Morocco offer and our managed IT services in Morocco, then request your free initial audit: we reply within 24 business hours.

Sources: decree no. 2-18-454 making the Code of professional duties of the Order of Chartered Accountants applicable (adala.justice.gov.ma portal), law no. 09-08 and the CNDP, law no. 05-20 and the DGSSI, DGSSI reminder on the .gov.ma domain (April 2026).