How to use it. Work through one section at a time with whoever looks after your IT, whether that is an outside provider, an internal IT person or the practice manager. Write down each answer as yes, no or unsure. "Unsure" counts as no until someone can show you otherwise. The first two sections matter most, and gaps there are often the cheapest to close.
Revisit the list once a year, and again whenever the firm changes provider, opens an office or takes on a new practice area. For a quicker first pass, the IT risk self-assessment sorts your answers into areas to address first and next.
1. Sign-in and accounts
Most compromises start with a single account. These are the questions to settle first.
- 1.1Is multi-factor authentication enforced for everyone? That includes partners, part-time staff and shared mailboxes, with no standing exceptions for people who find it inconvenient.
- 1.2Are legacy sign-in methods blocked? Older protocols can bypass MFA entirely. If your IT provider can't say whether they are blocked, find out.
- 1.3Are admin accounts separate and few? Administrator rights should sit on dedicated accounts, not on anyone's everyday login, and the list should be reviewed regularly.
- 1.4Are departing staff removed on their last day? Access to mail, files and practice systems should end when employment ends, with the mailbox kept for the firm.
2. Email and payment instructions
Business email compromise targets the moments when money moves, such as settlements and trust account payments.
- 2.1Is there a call-back rule for bank details? Any change to payment details is confirmed by phone on a number already on file, never one supplied in the email.
- 2.2Do clients know your details won't change by email? Saying so in engagement letters and at settlement time gives clients a reason to pause.
- 2.3Is anyone watching for odd sign-ins and mail rules? Attackers often add forwarding or hiding rules to a mailbox. Someone should be alerted to suspicious sign-ins and new rules, including at weekends.
- 2.4Do staff practise spotting phishing? Simulated phishing shows who needs a refresher before a real message arrives.
3. Laptops and phones
Lawyers carry client files to court, home and client offices.
- 3.1Is every device managed and encrypted? Each laptop and phone that touches firm data should be enrolled in device management, encrypted and checked for compliance.
- 3.2Can a lost device be wiped today? Test the process before you need it. A phone left in a taxi should be a five-minute problem.
- 3.3Are updates applied on a schedule? Operating systems and applications should be patched routinely, at times that don't interrupt client work.
4. Backups and continuity
A backup you have never restored is an assumption.
- 4.1Is Microsoft 365 backed up independently? Mail, SharePoint, OneDrive and Teams should be copied somewhere a compromised admin account can't reach.
- 4.2When was the last restore test? There should be a date and a result on record, not a general reassurance.
- 4.3What happens if the office goes offline on a filing day? Decide in advance who works from where, who has a hotspot and who calls the internet provider.
5. Practice systems and vendors
The systems that hold matters and time records often sit with outside vendors.
- 5.1Who holds the vendor account details? Your practice management, document management, phone and internet accounts should be recorded somewhere the firm controls.
- 5.2Do you know each vendor's backup arrangements? If a system is hosted by its vendor, ask how it is backed up and how quickly it can be restored.
- 5.3Is there a register of renewals? Licences, subscriptions and support contracts lapse quietly. A register reviewed monthly catches them.
6. Privacy and data breaches
The Notifiable Data Breaches scheme in the Privacy Act 1988 requires organisations covered by the Act to notify affected individuals and the OAIC about an eligible data breach, which is one likely to result in serious harm.
- 6.1Does the firm know whether and how the scheme applies to it? That is a question for your own advice, and best answered before an incident.
- 6.2Is there a short incident plan? Who decides, who calls the insurer, who talks to clients, and who gathers the facts from IT.
- 6.3Can your IT provider tell you what happened, quickly? Logs from sign-ins and devices are what let you judge whether a breach is likely to cause serious harm.
7. Insurers and governance
Professional indemnity and cyber insurers increasingly ask detailed questions about IT security.
- 7.1Can you answer the insurer's questionnaire honestly? MFA, backups, patching and monitoring are the usual topics. Answers should match what is actually in place.
- 7.2Do you have a recognised reference point? The ACSC Essential Eight is the framework most Australian insurers and auditors recognise, and a useful way to describe where the firm stands.
- 7.3Do partners see a regular report? A short monthly report on security, backups and open issues keeps IT on the partners' agenda without taking it over.
8. Data retention
Law firms keep client files long after a matter closes.
- 8.1Is there a written retention policy? The firm should decide how long each kind of record is kept, and who can approve deletion.
- 8.2Are the systems set up to follow it? Microsoft 365 retention settings and backups should reflect the policy, not the defaults.
- 8.3What happens to a leaver's mailbox and files? They should stay with the firm, retained under the same policy as everything else.