Access is the whole question
Client matters should be reachable by the people working them and nobody else, including the person who left last year whose account is still active. Getting this right is unglamorous, cheap, and the thing a client questionnaire actually probes.
Email is where firms lose control of a file
The specific failure we look for is a mail rule quietly forwarding to a personal address, which is how client material leaves a firm without a breach in the dramatic sense. Multi-factor authentication and rule auditing close most of it.
Small firms carry the same obligations as large ones
A four person practice holds the same duty of confidentiality as a hundred person one, with none of the infrastructure. The answer is not more product, it is the few controls that matter done properly.
Paper and scanning still shape the workflow
Plenty of firms still run on scan-to-folder, and that folder is often the least protected thing in the office. It is worth checking where scans land and who can read them.
Common questions
- A client sent us a security questionnaire. Can you help answer it?
- Yes, and we would rather help you answer it honestly than help you tick boxes. Most of what they ask about is multi-factor authentication, backup, access control and what happens when staff leave.
- Is our document management system backed up?
- We test that rather than assume it. Document systems often have their own backup requirements that were never set up alongside the file server backup.
- Someone left the firm months ago. Does their account matter?
- It matters a great deal, particularly if it still receives mail or has access to matters. Offboarding should be a written checklist rather than something remembered.
- Can staff work securely from home?
- Yes, and it is mostly about the account rather than the location. Multi-factor authentication and managed devices do more than a VPN alone.
- How do we send a document to a client securely?
- There are a few reasonable options depending on how your clients work. We will pick the one your clients will actually use, because a secure method nobody uses is worse than a simple one everybody does.
- Do you have access to our client files?
- Only what is needed to do the work, and it is logged. We will put that in writing if your professional obligations require it.
Where we do this
These are the towns where this kind of business actually clusters. We work across the whole 30 mile area, so if you are somewhere else on the list, call and ask.
Start with a phone call
You describe what is annoying you. Fifteen minutes, no discovery-call ritual.
Other industries