Legal & Professional

Holding other people’s secrets

A law firm’s network holds material that is valuable precisely because it is confidential: deal documents before announcement, litigation strategy, investigation files, intellectual property, personal information gathered in discovery. The same is true across professional services — an accounting firm holds financial records for hundreds of businesses, a consultancy holds strategy and forecasts, an architecture or engineering practice holds designs for buildings that have not been built.

That concentration is the point of attack. A single firm can be a route to the confidential material of every client it serves, which makes professional services a standing target for actors interested in a client rather than in the firm itself. Business email compromise is common for the same reason: a firm’s instructions about money or documents are trusted by everyone who receives them.

What has changed recently is who is asking. Confidentiality has always been a professional obligation, but for most firms it was self-assessed. Now corporate clients send outside counsel guidelines with security requirements attached, run vendor due-diligence questionnaires, and in some cases audit. Firms that cannot answer credibly are losing work to firms that can — which has moved security from a compliance cost to a business development issue.

Where we focus

Access control and matter separation

Ensuring access to client material reflects who should actually have it, and that the network and identity layers enforce it rather than relying on convention. Where a firm needs to separate matters or teams — ethical walls, conflicts, sensitive engagements — the technical enforcement should match the policy on paper, and be demonstrable if a client asks.

Protecting the document estate

The document management system is where the value is concentrated, and it is usually reachable from every workstation in the firm by design. We build boundaries around it, control what can reach it, and log access so the firm can answer who opened what — the question that matters most after any suspected exposure.

Identity, email and the fraud path

Multi-factor authentication on the paths that matter, privileged accounts separated from daily-use ones, and hardening of the mailflow and identity path that account takeover depends on. Most incidents at professional firms are not network intrusions — they are a legitimate credential in someone else’s hands. See Zero Trust Architecture for how access is structured around verified identity rather than location.

Remote and hybrid working

Professional work is now genuinely mobile — home offices, client sites, courtrooms, hotels, travel. The enforcement that applies in the office needs to apply everywhere, without becoming the kind of friction that drives people to work around it. Practically, that means access tied to identity and device posture rather than to being on the firm’s network.

Guest, visitor and co-counsel access

Conference rooms host clients, opposing counsel, experts and co-counsel, all of whom expect connectivity. Guest access kept fully isolated from firm systems, so hospitality never becomes a route inside.

Answering client security questionnaires

Outside counsel guidelines and vendor questionnaires ask concrete technical questions: how access is controlled, how data is encrypted, how logging is retained, how the firm would detect and respond. We build the controls and produce the documentation and evidence behind the answers, so responding becomes a retrieval task rather than a scramble each time.

Continuity and recovery

Court deadlines, filing dates and closings do not move because a system is down. Redundancy where an outage stops the firm working, and recovery paths that have been tested rather than documented.

How we engage

The same three phases as the rest of our work. Start at any of them; many firms come to us because a client questionnaire arrived, an insurer asked, or a partner wants to know where the firm actually stands.

On obligations

Firms in this sector carry confidentiality duties from several directions at once: professional responsibility rules, engagement letters and outside counsel guidelines, client contracts, and — where the firm holds personal or financial information — data protection and sector regulation such as the FTC Safeguards Rule for accounting and tax practices.

We build and operate the technical controls that support those obligations and produce the evidence to demonstrate them. We do not interpret your professional responsibility rules or advise on what a given duty requires of your firm — that is counsel’s call, and the rules vary by jurisdiction. Our role is to make sure the technical reality matches whatever the firm has committed to. See Compliance & Risk for how assessment and readiness work is structured.

Who this is for

• Law firms of any size whose clients have begun attaching security requirements to engagement terms.
• Practices handling sensitive matters — litigation, corporate transactions, investigations, intellectual property — where confidentiality is the product.
• Accounting and tax firms holding client financial records under the FTC Safeguards Rule.
• Consultancies, architecture and engineering practices holding client strategy, designs or forecasts.
• Firms with a small internal IT function, or none, carrying an obligation that assumes a much larger one.