Updated Checked by the Tax-Services.ca editorial team How we check
The single best move for digital accounting security is a second login step on every account that touches money: the bank, the payroll tool, the accounting file and the CRA sign-in. The Canadian Centre for Cyber Security lists strong user authentication among its baseline controls for small organizations, and a second factor is the simplest way to get there.
Which controls matter most for digital accounting security?
The Cyber Centre publishes 13 baseline controls for small and medium organizations, set out in its guide to baseline cyber security controls for small and medium organizations. You don’t need all 13 on day one. Half of them cover the same ground your books already sit on, so start there.
| Control | What the Cyber Centre asks for | What it looks like in a bookkeeping setup |
|---|---|---|
| Two-factor login | A second factor wherever possible, especially on financial accounts and admin users | Bank, payroll, accounting file, email |
| Patching | Automatic updates for software and hardware | Laptop, phone, router, accounting app |
| Backups | Back up business systems and store the copies encrypted | A copy that isn’t on the same machine |
| Access control | Minimum access needed for the task | Your part-time bookkeeper doesn’t need the owner’s bank login |
| Training | Awareness training for staff | Spotting a fake invoice or a fake CRA message |
| Incident plan | A written plan with named owners | Who calls the bank, who changes passwords |
Why does two-factor login come first?
Passwords leak. They get reused, guessed and phished. A second step, such as a code from an app, means a stolen password alone opens nothing. Here’s how the Cyber Centre describes it.
These methods combine the use of something the user knows (e.g. a password) with something that the user has (e.g. a physical token, an app-generated code, an automated phone call)
Baseline cyber security controls for small and medium organizations, cyber.gc.ca
Use an authenticator app or a hardware key where the service allows it. Text codes are better than nothing, but they’re the weaker choice. And don’t stop at the accounting software. If someone reaches your email, they can reset almost everything else.
Think about Leah, who does the books for her dad’s plumbing shop in Moncton. Her work email is the recovery address for the bank, the payroll service and the accounting file. One phished email password could have opened all three. Turning on a second step for that one email account took a couple of minutes and closed most of the door. That’s about the best return on a few minutes you’ll find at tax time.
What does the CRA expect from your digital records?
Security isn’t only about thieves. The CRA has rules for where records live and how long you keep them. The general period is six years from the end of the last tax year the record relates to. So a receipt from a 2026 expense stays until the end of 2032.
Records go at your place of business or home in Canada. Electronic records held on a server outside Canada need written CRA permission, and the copies must be readable by CRA software when an official asks. That matters if you choose a cloud tool. Ask where the data sits before you sign up.
Some records never expire, such as those tied to long-term property purchases and sales and the share registry, so keep those for as long as the business exists and treat the six-year rule as the floor for everything else, not the target. Simple.
What if client or staff data leaks?
Payroll files hold names, SINs and pay. If a breach creates a real risk of significant harm, the Privacy Commissioner’s office says you must report it and tell the people affected as soon as feasible. You also keep a record of every breach, big or small, for two years.
That record needs the date, what happened, what type of information was involved, and if you reported it. A shared note file works fine. Nobody wants to build it during a crisis, so write the template now. Payroll is the sensitive part of a small business file, and the payroll remittance calculator shows what a single employee’s deductions add up to each pay period.
A simple monthly routine
Ten minutes a month beats a grand plan that sits in a folder and never gets opened, so pick a day and stick to it. Check that updates installed. Confirm the last backup opened correctly, because a backup nobody tested is a hope. Review who has access and remove people who left. Glance at bank alerts.
Then do a real number check. If you run a small corporation, the corporate tax calculator gives a yearly figure to compare against what your software says. If you work for yourself, the self-employed tax calculator does the same job. A wrong total can mean bad data entry or tampering, and either is worth catching early.
What should you do the day something looks wrong?
Don’t wait to be sure. If you get an email that looks like the CRA but feels off, don’t click the link. Sign in to your CRA account the usual way and see whether the message is there. If a bank login stops working or a payment you didn’t make shows up, call the bank first, then change passwords from a device you trust. Write down what happened and when, because that note feeds the breach record above. A few minutes lost to caution cost far less than a week of clean-up.
Common mistakes and limits
One shared login for the whole team is the classic. It kills the audit trail and makes offboarding a mess. Second: keeping the only backup on the same laptop that got stolen. Third: assuming a big vendor covers everything. The Cyber Centre asks organizations to get security documentation from cloud providers, such as an independent SOC 3 report. Ask for it. Really.
We didn’t compare products, prices or specific vendors, and we can’t say which tool is safest. Check any provider’s own documents. Also, this page is general security guidance. It isn’t a legal opinion on your duties under privacy law.
What this page is based on
The controls come from the Canadian Centre for Cyber Security baseline guidance for small and medium organizations. The breach rules come from the Office of the Privacy Commissioner of Canada. Retention and location rules come from CRA record-keeping pages. No government body has reviewed or endorsed what you read here. For your own filing dates and payments, see the tax instalments calculator.
Frequently asked questions
What is the first thing to secure in digital accounting?
Turn on two-factor login for the bank, payroll, accounting and email accounts. The Cyber Centre lists financial accounts first.
How long do I keep digital accounting records?
Six years from the end of the last tax year they relate to, in general. Some records, like those for long-term property, stay indefinitely.
Can I store my books on a server outside Canada?
Only with written CRA permission, and the copies must be readable by CRA software. Ask your provider where the data sits.
Do I have to report a data breach?
Yes, if it creates a real risk of significant harm. You report to the Privacy Commissioner and tell the people affected as soon as feasible.
How long do I keep a breach record?
Two years, for every breach, even ones you didn't have to report.
All family and benefits calculators
- Self-employed taxes in Canada: income, CPP and GST
How tax works when you are self-employed in Canada: reporting income and expenses, paying both halves of CPP, instalments and when to register for GST