Legal and professional firms

You hold client files that can't leak, and you share them with more outside parties than most businesses. We look after the access, the practice software and the security underneath, and we're SMB1001 Gold certified ourselves.

Talk to us about your business

What gets in the way

Confidentiality is a professional duty. The Queensland Law Society describes an ethical duty for law firms to take reasonable steps to protect the confidentiality of client information, and that duty reaches into the IT.
Outside parties need access. Auditors, other firms and clients need access to particular matters, and access granted for one job tends to stay open long after the job ends.
Practice software ties it all together. Matters, time recording and calendars often live in one system that has to stay in sync with Outlook, so a sync fault can mean a missed appointment.
Client money attracts fake emails. Firms that move client money are exposed to payment redirection, and the email usually comes from a real, compromised mailbox that looks exactly right.

How we help

Microsoft 365 & Identity: Multi-factor on every account, conditional access and alerts on new mailbox forwarding rules, the controls that stop a stolen password turning into a redirected payment.
Cloud Solutions: SharePoint set up per matter or client, so you can share exactly what an outside party needs and take it away when the job is done.
Bastion Cybersecurity: Vulnerability scanning, endpoint detection and response and patching measured against targets, reported in a form you can show an insurer or a client.
Backup & Recovery: Backups covering Microsoft 365 and your file store, with scheduled test restores, because professional firms keep records for a long time.
Security Awareness: Short training and phishing simulations so staff ring to check a changed bank detail before anyone moves money.
Reporting & Review: A monthly report a partner can read and a quarterly review, so you can see where the firm stands rather than take it on trust.

Obligations worth knowing

The Queensland Law Society says law firms have an ethical duty to take reasonable steps to protect the confidentiality of client information, and recommends members work towards SMB1001 Gold certification. Source
QLS also notes that SMB1001 doesn’t create a safe harbour or guarantee protection, but gives a foundation for showing reasonable safeguards to insurers, clients and regulators. Source
If your firm is covered by the Privacy Act, a data breach likely to result in serious harm must be notified to the affected individuals and the OAIC. Source

Reasonable steps, written down

Most firms already take client confidentiality seriously. The harder part is showing it. The Queensland Law Society says law firms have an ethical duty to take reasonable steps to protect client information, and recommends members work towards SMB1001 Gold. That gives a practice a clear target rather than a vague instruction to be secure. Bastion IT is SMB1001 Gold certified, so we know the process from the inside, and our cybersecurity reporting gives you multi-factor coverage, patching times and open vulnerabilities in a form you can hand to an insurer.

Sharing what’s needed, then taking it back

Across a year of work for five legal practices, access for people outside the firm came up again and again: an auditor, an outside party on one matter, access adjusted as the matter changed. Sharing a whole drive is quick. Sharing only what’s needed and removing it when the job’s done is what protects the client. Our cloud solutions work sets SharePoint up so that’s the easy path, and practice software that has to sync with Outlook gets checked as part of the same job.

Accounting and advisory firms face the same question from their own clients. Advisory and wealth firms are often asked how client data is protected, and a clear answer helps when a client or licensee asks.

The email that asks for money

A compromised mailbox gives an attacker your client list and a trusted address to send from. Microsoft 365 and identity hardening closes most of that, and security awareness training covers the rest: staff who ring a known number before acting on changed bank details. If a firm covered by the Privacy Act does have a breach likely to cause serious harm, the Notifiable Data Breaches scheme requires it to notify the people affected and the OAIC, so it pays to know your steps before you need them.