Identity & Access
- MFA enforcement
- Privileged accounts and admin roles
- Dormant accounts and legacy authentication
- Authentication policies
Independent verification
Can Your Firm Prove the Controls Are Working?
Verify the security controls protecting your firm's client information. We show what is working, what is not, and what leadership should fix first.
Security you can prove.
The problem
A firm can have the tools and still not know whether they are working.
Many law firms already have an MSP, Microsoft 365, MFA, endpoint protection, backups, and cyber insurance. The missing piece is often independent verification: can leadership prove the controls are configured correctly, consistently enforced, and supported by evidence?
This assessment is that verification layer. It is designed to work alongside your existing IT provider, not replace them.
Assessment areas
What we check.
Microsoft 365 & Email
- Tenant security configuration
- Forwarding and mailbox-rule exposure
- Sharing settings and audit capabilities
- SPF, DKIM, and DMARC posture
Endpoint & Device Security
- EDR or endpoint protection coverage
- Device management
- Local administrator exposure
- Patch and update posture where evidence is available
Data Protection
- SharePoint and OneDrive sharing
- External access and link exposure
- Sensitive-data handling
- Backup controls
AI & Information Governance
- AI use discovery
- Copilot readiness concerns
- Approved-tool rules and prohibited data
- Operational safeguards
Incident Readiness
- Incident response plan
- Escalation paths
- Evidence preservation
- Tabletop readiness
Deliverables
You get evidence, not just advice.
- Executive summary for firm leadership
- Prioritized remediation roadmap
- Technical findings for IT or your MSP
- Observed state with supporting evidence where appropriate
- Risk explanation written in plain English
- Optional verification of the resulting state after remediation
Relationship with your MSP
We work with your MSP, not against them.
MSPs are responsible for operating and supporting technology. Our role is different: independently evaluating security controls, documenting findings, and giving firm leadership visibility into the resulting security posture.
The engagement can produce actionable findings that your MSP can remediate.
Who this is for
You already have IT. This answers a different question.
This is a good fit if
- You already have an MSP or internal IT team.
- You need evidence, not just recommendations.
- You want to support client, insurer, or governance conversations.
- You need a clearer view of Microsoft 365, identity, endpoint, and email controls.
This is not the right service if
- You want a full red-team exercise or exploit chain testing.
- You need an open-ended managed service retainer.
- You want a generic small-business checklist instead of a law-firm review.
Business uses
Use the findings where leadership actually needs them.
- • Client cybersecurity questionnaires
- • Cyber-insurance discussions and renewals
- • Outside counsel and governance requirements
- • Microsoft 365 security improvement
- • AI and Copilot readiness decisions
- • Annual security reviews and management oversight
FAQs
Common questions
Yes. This service is designed for firms that already have an MSP or internal IT and want an independent view of the controls they depend on.
Not necessarily. Scope depends on the agreed engagement and the evidence available. Some findings can be verified externally, while others require read-only administrative evidence or screenshots from your team.
No. This is not a vulnerability exploitation engagement. It is a baseline assessment of whether the controls your firm relies on are configured, enforced, and documented as expected.
Yes. You receive practical remediation guidance and, where included, implementation support and verification of the resulting state.
Yes. The point of the engagement is to give leadership evidence that can support client, insurer, governance, and audit conversations.
Independent verification
Your MSP manages technology. We verify the controls leadership needs to trust.
This service gives firm leadership an evidence-backed view of the controls protecting client information, without replacing your existing IT provider.
Typical MSP
Securing Your Law Firm
General IT support across many tasks
Independent verification of the controls that protect client data, email, and access.
Open-ended retainers with no clear finish line
Fixed-scope engagements with clear deliverables, evidence, and a defined end state.
Generic small-business security templates
Built around legal duties, insurer questions, and firm-specific risk.
Configuration changes with no documentation
Observed state, supporting evidence, and practical remediation steps.
Security offered as a side service
Independent cyber verification for law-firm leadership and stakeholders.
Already have an MSP or internal IT? Good. This assessment gives you independent evidence of the baseline and the gaps that still need attention.
Related services
Next steps if you want to go deeper.
Schedule next
Know what is actually protecting your firm.
Start with an assessment that produces a defensible view of your current security posture and a practical path to improvement.