A fiduciary does not protect her data with a single bulwark. To reduce IT risks for a fiduciary in Geneva, combine regular backups according to the 3-2-1 rule, two-factor authentication and access limited to the needs of each role. The 3-2-1 rule provides for three copies of the data on two different media, including one offline copy.
Accounting, salary and tax files require rigorous confidentiality. A malicious attachment, compromised password or unrestorable backup can disrupt daily work and delay case processing. Protection must therefore cover tools, team habits and business continuity.
Discover concrete measures to strengthen these protections without complicating operations: secure emails and access, test restorations, regulate teleworking and take into account the Swiss FADP. The location of the data, particularly its hosting in Switzerland, also deserves particular attention. This will allow you to establish clear priorities and reduce risks methodically.
Key Points
- Apply the 3-2-1 rule to multiply backups, then test the restoration of folders regularly.
- Enable two-factor authentication and give each collaborator only the access necessary for their role.
- Reduce email risks by checking attachments and using secure links to share sensitive documents.
- Integrate the Swiss FADP into your practices and check where the data is hosted, especially when it is stored in the cloud.
- Prepare incident response procedures to protect data and maintain essential operations in the event of an attack.
Table of contents
Regular backup restoration tests
A backup is only usable if the data can be recovered in a readable state. For a Geneva fiduciary, concretely test the restoration of client files, accounting files and tax documents. A software success message confirms that a copy was made, but not that the restored files are intact. The test must therefore verify their opening and their actual use.
The 3-2-1 rule provides for three copies of the data, on two different media, including an offline copy. Map the folders, servers, and tools involved, then associate each source with its backup destination. This view allows you to locate a forgotten directory, especially after adding accounting software or modifying a workspace.
Set up automatic backups for locations used every day, then monitor their execution reports. Repeated failures can go unnoticed if no one checks the alerts. Designate someone responsible, handle reported errors, and document corrections. After a system change, recheck the paths, included files, and copy access.
As an exercise, choose a representative folder and restore it to a space separate from the production files. Open each sample document, check its contents and confirm the presence of associated documents. Then ask someone who knows the file to validate that it is usable. Note the duration observed, the manual steps and the difficulties encountered, without touching the originals.
These results make it possible to establish the disaster recovery plan. Specify who authorizes a restore, which applications to restart first, and how collaborators will find the files. The RTO, or Recovery Time Objective, designates the maximum acceptable duration of interruption before the impact on the activity becomes critical. For a fiduciary, priorities may depend on tax deadlines, salary transactions and client files to be processed.
Also check where the data is hosted in the cloud, as it may be stored abroad. The location of copies matters in the analysis of data sovereignty and protection. Document this in the backup documentation, along with the systems covered and the people authorized to restore the files.
- Control automatic reporting and assign failure handling to a manager.
- Restore files to a separate space, then have their contents validated by their user.
- Update the recovery plan after each significant change in systems or priorities.
Two-factor authentication and access rights
A fiduciary can reduce the risk of improper access by combining second validation and task-specific permissions. Organize these controls based on team accounts, tools, and responsibilities.
Two-factor validation
Two-factor authentication adds proof of identity after password entry, such as validation from an authorized device. Activate it for accounts giving access to messaging, accounting software and sharing spaces. If a credential is compromised, this additional step makes it more difficult for an unauthorized person to use it.
Establish an activation process for each new access. Verify that the employee can use their validation method, then explain how to report a lost or replaced device. Do not share codes with a colleague: each account must remain associated with its user. Also plan a recovery procedure that specifies who authorizes the restoration of access.
Management of access rights
Assign permissions based on tasks, not just job title. A person preparing returns may need to view certain records without being able to change software settings or manage accounts. Have requests validated by the person responsible for the process concerned and document the decision, the access granted and its justification.
When a mandate, function or collaboration evolves, compare existing rights with new responsibilities. For an external partner, define the accessible files and the duration of their intervention. Then remove temporary accesses and record their closure. This review prevents old authorizations from remaining active for no operational reason.
Clean office rules must cover concrete situations: lock the screen before a meeting, put away confidential files after consultation and collect printouts from the printer. In a shared space, keep documents out of sight of visitors and avoid leaving notes with identifiers near a workstation.
Plan for checks upon arrivals, changes of role and departures. A list of accounts and their managers helps identify access without a clearly designated owner. For each request, the manager can confirm the tasks involved, the authorization level and the duration required. Reexamine rights when the scope of a mandate or software changes.
- Enable additional validation for accounts granting access to sensitive tools.
- Document who approves each right and what task warrants it.
- Remove temporary access at the end of the operational need.
To structure these practices in your IT environment in Geneva, you can talk to a specialist.
Risks of cyberattacks for SMEs and fiduciaries
A cyber attack can target records, payments or the availability of tools used for accounting. In Switzerland, the National Center for Cybersecurity recorded a 59% increase in cyberattacks in 2022 compared to the previous year. For a Geneva fiduciary, IT risks also include identity theft, undue access to financial information and interruption of work processes.
The budget for cyber insurance depends on the guarantees chosen, the activities covered, the deductibles and the security measures already in place. Examine in particular the coverage of intervention costs, business interruption and the consequences of a data breach. The amount depends on the insured scope and the conditions of the contract.
Attacks often exploit a link of trust: an invoice that appears to come from a supplier, an urgent request from a manager or access left active after the end of a mandate. These situations may result in an erroneous payment or the disclosure of a customer file. Map sensitive financial transactions and identify who can prepare, validate and transmit them.
Review your approach to cybersecurity at least twice a year. At each review, examine software changes, new interactions with partners and incidents or errors observed since the last check. Record weaknesses, decisions made, those responsible and their follow-up. This method clarifies priorities and makes it possible to adapt procedures to the evolution of the trustee's activities.
Prepare crisis communications before an incident occurs. Designate the people who coordinate decisions and those who communicate with employees, customers and partners. Prepare factual messages to report an interruption or delay in processing, without stating an unverified cause. Keep useful contact details accessible even if professional email becomes unavailable.
When an alert occurs, note the symptoms observed, the time of detection and the systems affected. Transmit these elements to the designated manager, then record the decisions and actions taken. This timeline helps understand the incident and organize the trustee's priorities, including handling urgent financial transactions. It also contributes to coherent communication with the people concerned.
- Reassess the risks after a change of tool, process or partner.
- Prepare crisis roles and messages before any incident.
- Record alerts, decisions, and actions in a timeline.
Security of emails and collaborative tools
For a fiduciary, an email can expose client documents or open the way to an intrusion. Supervise exchanges in messaging, collaborative spaces and devices used by employees.
Email Protection
Enable encryption of sensitive messages and scanning of attachments to detect viruses and malware. To submit a tax return, use a sharing link rather than an attachment. Check the recipient and the rights granted before sending. These controls reduce exposure risks related to transmission errors.
In Microsoft 365 or another business email, teach employees to review the sender's address and context of a request. A message requesting a change of banking details merits verification through a separate channel. Don't open an unexpected attachment just because it appears to come from a known partner.
Adopt a clear rule for passwords: the recommendation provides for at least one special character as well as numbers. Do not share a password between colleagues. For collaborative tools, limit access to the people concerned and remove sharing permissions that become unnecessary after transmitting a file.
Periodic safety checks
Schedule regular checks, adapted to your digital environment. Check messaging rules, access to shared spaces and the processing of alerts related to attachments. Record results, corrections, and who was responsible. Remind employees of the instructions, then adapt them when a sharing tool or process changes.
Security also concerns physical devices. Lock computers when you leave your desk, even briefly, and store laptops safely while traveling. Avoid USB drives from unknown sources. In the office, use an encrypted Wi-Fi network and separate the guest network from the network hosting business tools.
When teleworking or traveling, define the practices to follow before authorizing access to files. For example, avoid unknown Wi-Fi hotspots and favor a mobile connection or virtual private network. Also protect printed documents: do not leave them on an accessible desk and store confidential files in a lockable cabinet.
- Encrypt sensitive messages and favor links to share documents.
- Check shared access, attachments and alerts during periodic checks.
- Lock devices, secure paper documents and keep away unknown USB media.
Compliance with Swiss legal obligations
For a fiduciary, Swiss compliance concerns digital data, paper documents and employee practices. The Federal Data Protection Act (FADP) came into force on September 1, 2023. It regulates the processing of personal data, while IT security brings together the measures that protect their access, storage and transmission.
A fiduciary's files may contain sensitive information about clients, their salaries or their affairs. Treat this data responsibly and adapt access to their use. For example, a person responsible for a salary file should only consult the information necessary for their tasks. Apply the same principle to hard copies, devices and digital sharing spaces.
Managed IT services does not exempt you from providing security measures. If you use external software or a cloud service, identify the data processed, its location, and the protections applied. Data stored in the cloud may be located abroad. Hosting in Switzerland allows data sovereignty and the application of Swiss legislation to be taken into account.
A fiduciary can organize teleworking by integrating data protection into its procedures. Define the rules for accessing remote files, the practices to follow when traveling and the methods of transmitting sensitive documents. For employees outside the office, specify the authorized tools and the precautions to take for printed documents. The instructions must also cover the storage and disposal of paper documents.
Accounting obligations also concern document retention. In Switzerland, any company registered in the commercial register must keep accounts and present accounts in accordance with article 957 of the Code of Obligations. Accounting supporting documents must be kept for 10 years. Therefore, organize the archives with controlled access rights and a method allowing you to find the necessary documents, without exposing all of the files.
To support daily compliance, document processing rules, limit access, protect physical and digital records, then review practices when tools or processes evolve.
- Map the personal data processed by each software and cloud service.
- Set separate rules for office, telecommuting and travel.
- Structure the retention of accounting documents to respect the 10-year deadline.
Flux Group SARL: Flux ICT
Flux Group SARL supports fiduciaries who wish to structure their IT and strengthen their cybersecurity. With Flux ICT, you can address technical issues related to access, work tools and business continuity. Its IT support helps resolve daily challenges, while its cybersecurity services address systems and data protection needs.
This approach is relevant if your security procedures are dispersed, if incidents mobilize your teams or if your tools evolve. Your needs may also concern VoIP telephony and professional telecommunications, depending on your working methods. Present your priorities and the constraints specific to your trustee to initiate a targeted exchange.
To discuss your trustee’s IT security, contact Flux Group SARL or visit fluxgroup.ch.
Advance your security, step by step
To control the IT risks of a fiduciary in Geneva, transform your priorities into consistent decisions. Designate a responsible person, set a deadline for each action and record its progress. This method helps your team integrate security into day-to-day operations, rather than only addressing it after an incident.
Start by identifying the point that most weakens your activity today. Then define a first achievable measure, then plan when to evaluate the result. Regular monitoring allows you to adapt your practices when your tools, your activities or the needs of your employees change. Data protection thus becomes a concrete approach, linked to your processes and your responsibilities.
If you wish to structure this approach or strengthen the security of your IT environment, Flux Group SARL can discuss the needs of your trustee with you.
Each clearly assigned action contributes to building more lasting security for your activity in Geneva.
Frequently asked questions
What cyber attacks are targeting Swiss fiduciaries and accounting firms?
The most relevant attacks to anticipate are phishing, ransomware, credential theft and payment fraud. A false message can imitate a customer and encourage an employee to open a document or modify a transfer. A compromised email account can also be used to send fraudulent requests from a familiar address. Verify unexpected bank change requests through a known channel.
What Swiss data protection and cybersecurity obligations apply to fiduciaries?
FADP applies to the processing of personal data, including those of customers and employees. A fiduciary must treat this information responsibly and protect its access, retention and transmission. In practice, document the categories of data, the tools that process them and the roles that access them. If an IT or cloud service is involved, specify responsibilities and security measures in the relevant agreements.
What cybersecurity requirements impose professional secrecy for fiduciaries in Switzerland?
The processing of confidential information calls for concrete controls: limit access to assigned tasks, use individual accounts and control the sharing of files. The applicable framework also depends on the activities carried out and the commitments made to customers. For example, avoid making a salary document accessible by default to the entire team. Provide a procedure for withdrawing rights when a mandate ends or an employee changes role.
What budget should be planned in Geneva to secure the network and positions of a trustee?
The budget depends on the number and condition of stations, the network architecture, the tools already in place and the level of monitoring and support desired. The perimeter can include email, devices, remote access, and network protection. A relevant estimate is established after having defined these elements and prepared a quote. Prioritize assets that house customer files and accounting operations.
What measures should be taken to prevent ransomware and bank transfer fraud?
To reduce these risks, combine technical protection with clear transaction validation rules. Confirm any change in bank details by calling a number already known, and not the one indicated in the email received. Separate, where possible, the preparation and approval of a payment. Keep posts up to date and ask employees to quickly report suspicious messages, without opening their attachments.
How to set up backups and a cyberattack recovery plan for a fiduciary?
First define which applications and data need to be restored as a priority, for example accounting and files needed for current deadlines. In the event of an attack, isolate affected systems before restoring to avoid reintroducing infected files. The designated manager selects a clean copy, organizes the restoration of services and asks affected users to verify the restored data before resuming operations.
Which Geneva service providers offer cybersecurity audits and services to trustees?
In Geneva, Meyrin, Vernier, Eaux-Vives, Collogny, Grand-Lancy and Petit-Lancy, Flux Group SARL offers cybersecurity and IT support services with Flux ICT. These services can meet the needs of a fiduciary who wishes to strengthen the protection of its environment or structure its IT operations. To frame the process, bring together your priorities: access to files, security of posts, data exchange and continuity of activities.
Article by
Delyan TZONEV
Passionate entrepreneur and manager, I am CEO of Flux Group and Hype Swiss. I support companies in their digital transformation thanks to innovative solutions in IT, telecommunications and software development. My goal is to design high-performance technologies that simplify the daily lives of businesses and support their growth.
Disclaimer
The articles published on the Flux Group blog aim to share our expertise, our field experience and best practices in IT, cybersecurity, cloud, telecommunications and digital transformation of SMEs.
We strive to provide reliable, up-to-date and relevant information at the time of publication. However, technologies, regulations and service offerings are evolving rapidly. The published content is therefore provided for informational purposes and does not constitute personalized, legal, tax, financial or technical advice.
Each company has specific needs, we recommend that you seek professional support before making a decision or implementing a solution presented in our articles.
The opinions, recommendations and comparisons published on this blog reflect our analysis and experience. When we talk about partners or publishers such as Microsoft, Swisscom or Infomaniak, our objective is to present the solutions objectively, highlighting their advantages as well as their limitations depending on the different contexts of use.
Flux Group cannot be held responsible for any direct or indirect consequences resulting from the use of the information published on this blog. Links to external sites are provided to complete the information; their content is the responsibility of their respective publishers.
© Flux Group – All rights reserved.
Our services
If you wish to be supported in the choice, deployment or optimization of your IT solutions, the Flux Group experts are at your disposal. We support SMEs in Geneva, Switzerland and Pays de Gex in their Microsoft 365, cybersecurity, cloud, telecommunications, managed IT services and IT infrastructure projects.
Questions fréquentes
What cyber attacks are targeting Swiss fiduciaries and accounting firms?
The most relevant attacks to anticipate are phishing, ransomware, credential theft and payment fraud. A false message can imitate a customer and encourage an employee to open a document or modify a transfer. A compromised email account can also be used to send fraudulent requests from a familiar address. Verify unexpected bank change requests through a known channel.
What Swiss data protection and cybersecurity obligations apply to fiduciaries?
FADP applies to the processing of personal data, including those of customers and employees. A fiduciary must treat this information responsibly and protect its access, retention and transmission. In practice, document the categories of data, the tools that process them and the roles that access them. If an IT or cloud service is involved, specify responsibilities and security measures in the relevant agreements.
What cybersecurity requirements impose professional secrecy for fiduciaries in Switzerland?
The processing of confidential information calls for concrete controls: limit access to assigned tasks, use individual accounts and control the sharing of files. The applicable framework also depends on the activities carried out and the commitments made to customers. For example, avoid making a salary document accessible by default to the entire team. Provide a procedure for withdrawing rights when a mandate ends or an employee changes role.
What budget should be planned in Geneva to secure the network and positions of a trustee?
The budget depends on the number and condition of stations, the network architecture, the tools already in place and the level of monitoring and support desired. The perimeter can include email, devices, remote access, and network protection. A relevant estimate is established after having defined these elements and prepared a quote. Prioritize assets that house customer files and accounting operations.
What measures should be taken to prevent ransomware and bank transfer fraud?
To reduce these risks, combine technical protection with clear transaction validation rules. Confirm any change in bank details by calling a number already known, and not the one indicated in the email received. Separate, where possible, the preparation and approval of a payment. Keep posts up to date and ask employees to quickly report suspicious messages, without opening their attachments.
How to set up backups and a cyberattack recovery plan for a fiduciary?
First define which applications and data need to be restored as a priority, for example accounting and files needed for current deadlines. In the event of an attack, isolate affected systems before restoring to avoid reintroducing infected files. The designated manager selects a clean copy, organizes the restoration of services and asks affected users to verify the restored data before resuming operations.
Which Geneva service providers offer cybersecurity audits and services to trustees?
In Geneva, Meyrin, Vernier, Eaux-Vives, Collogny, Grand-Lancy and Petit-Lancy, Flux Group SARL offers cybersecurity and IT support services with Flux ICT. These services can meet the needs of a fiduciary who wishes to strengthen the protection of its environment or structure its IT operations. To frame the process, bring together your priorities: access to files, security of posts, data exchange and continuity of activities.
Besoin d'un accompagnement IT à Genève ?
Parlons de votre infrastructure, de votre sécurité ou de votre téléphonie. Sans engagement.
Contacter Flux Group