From reactive break-fix to a security-aligned managed service
A twelve-person commercial law firm in inner Sydney had been paying an IT consultant by the hour for the past six years. When a laptop died, someone rang the consultant. When email stopped working, someone rang the consultant. There was no monitoring, no documented backup, and no security policy beyond the default password on the firewall.
The firm had recently been asked by two of their financial-services clients to evidence their information security controls. They realised they could not produce a single document describing what they did. They also realised their file server was eight years old and no one had tested a restore in as long as anyone could remember.
We proposed a phased engagement rather than a big-bang migration. Phase one was a CPS 234-aligned security review: we interviewed the practice manager, inventorised every device on the network, and produced a written statement of current controls against the APRA CPS 234 framework. This gave the firm a document they could hand to their financial-services clients.
Phase two moved email and file storage to Microsoft 365. We migrated mailboxes, SharePoint document libraries and the practice management software to Azure-hosted virtual machines. Each lawyer got a primary and secondary device, with OneDrive for Business known-folder move enabled so desktop and Documents folders synced automatically.
Phase three put the firm on our managed service: 24/7 monitoring of servers, workstations and the new Fortinet firewall; quarterly access reviews; monthly patch reporting; and a tested backup to an Australian Azure region with a documented recovery time objective.
The firm has renewed its managed service for a second year and has referred two other small legal practices in the same building.
The firm had eleven users, two on-premise servers running Windows Server 2016, and a legacy backup system that had not been tested in two years. We migrated the file server and the practice management database to Azure virtual machines in Australia East, with Azure Backup taking snapshots every twelve hours. The on-premise server was kept as a local cache for the first three months, then decommissioned.
We deployed multi-factor authentication on every user account, email, remote access and the practice management platform. We implemented Microsoft Defender for Office 365 to block phishing emails, and Microsoft Defender for Endpoint on every workstation. We produced a written control statement mapped to APRA CPS 234 expectations, which the firm provided to its financial services clients.
Quarterly access reviews are now automated: we list users with access to each matter folder, compare it to the current employment register, and flag any discrepancies for the principal to sign off. In the first review, we found three former employees still had access. They were removed the same day.
The practice manager no longer receives three calls a week about email or file access. The helpdesk model means most tickets are resolved remotely within the hour. The firm's monthly IT cost is predictable: a fixed fee per user, per month, covering helpdesk, monitoring, patching, backup and quarterly reviews. There are no surprise call-out invoices during business hours.