On a first engagement with a firm of 30 to 80 staff, the work is built to surface defects of a shape self-assessment rarely catches. For example:
- 01A practice-management service account — LEAP, Affinity, iManage, or your equivalent — with full read/write across the matter database, a multi-year-old password, and no presence in the firm’s MFA, conditional-access, or offboarding workflow.
- 02A signed and paid backup contract with no documented restore test on file. The piece of evidence cyber-insurance underwriters ask for at renewal.
- 03Mailbox-forwarding rules and matter-folder share links that have outlived the staff member or the matter that created them — including share permissions on confidential briefs that were never set to expire.
- 04Conditional-access exceptions added for a partner’s travel or a project deadline, then left permanent in the policy with no documented owner.
The output is a document a managing partner can forward to the MSP with one line: “We need these actioned, please confirm timeline.”