September 29, 2026
Where you stand — firm and personal digital security together
Your firm systems are the strongest part of the picture. The bigger exposure is uncertainty — several questions below that no one in the room could answer yet. That is usually a bigger risk than a single missing control, because you can’t manage what no one has checked.
How to read 56%: we asked 136 questions covering your firm systems, remote work, AI use, and VIP Digital Security; 105 applied to you (31 did not). A full “yes” counts fully, “partial” counts half. This is a conversation guide, not an audit score.
The same picture, by area
What is working well
- Sign-in protectionMFA on email, admin accounts, and key apps. Admins use stronger, phishing-resistant sign-in.
- Devices kept currentAutomatic patching and endpoint protection on all devices. Old systems retired or isolated.
- Email defensesSpam and phishing filtering, spoofing protection, and office macros blocked.
- BackupsEncrypted, with one copy kept offline. Restores have been tested, not just assumed.
- Access controlStaff are added and removed promptly, daily accounts have no admin rights, and a password manager is used.
- Remote accessRemote access runs through VPN or zero-trust, not open management ports.
Your next steps
Set which AI tools staff may use with client and firm data, and agree on a shared habit for verifying an unexpected urgent call or voice message before acting on it. The same verification habit protects a payment or vendor request at the firm and a personal impersonation attempt.
Run a short yearly training session plus quarterly simulated phishing emails, with follow-up for anyone who clicks.
Put personal and guest devices on a separate network from devices used to access firm systems, and use the VPN on every network a work device connects to off-site.
Get written confirmation of your Microsoft 365 security configuration, and check that home routers used for remote access to firm systems have current firmware and a changed default password.
List phone numbers for your IT provider, custodian, CRM, or portfolio-system vendor, cyber insurer, and attorney on one sheet, plus who decides what and who watches for trouble after hours.
Write down every device, cloud account, and vendor with access to client and firm data, and note what happens if one of those vendors has a breach.
Why this Snapshot also looks at VIP Digital Security
- Executive and vendor-request verification (not in place): The same channel-verification habit that stops a deepfaked “urgent wire transfer” call also stops a deepfaked family emergency call. Neither is in place yet.
- Personal identity and account recovery (not sure yet): Transaction alerts on personal bank and payment accounts weren’t confirmed. The same instinct — know immediately when money moves — applies to shop accounts.
- Personal digital footprint and privacy (not in place): Personal email, social-media, and public-information exposure may make firm leaders easier to target. Not urgent, but worth a look once the items above are handled.
Questions to ask your vendors (6 areas)
| Area | Ask this | Who to ask |
|---|---|---|
| Custodian / CRM / portfolio systems | “Who backs up our job files, quotes, and production data, how often, and when did you last test a restore for us? What is your outage plan?” | custodian, CRM, or portfolio-system vendor |
| Microsoft 365 and email | “Can you show me who has admin access, and which mailboxes forward outside the firm? Who sees a suspicious sign-in?” | Managed IT provider |
| Firm network and remote access | “What is exposed to the internet from our firm, and who is watching it at 2 a.m. on a Saturday?” | Managed IT provider |
| Backups | “Show me the last file you restored from our backup, and how long a full recovery would take.” | IT provider and critical application vendors |
| Remote access and VIP Digital Security | “What is the rule for the router firmware, personal-device use, and VPN when someone accesses firm systems remotely?” | Firm leadership, with IT provider |
| AI tools and impersonation verification | “What client or firm information can staff put into an AI tool, and what is our rule for verifying an unexpected urgent call before acting on it?” | Managing partner and operations leader |