IT for professional services firms

Start by reducing the chance of it happening, and then make sure people know who to call when it does.

Under Elevate, we manage your network, servers, and Microsoft 365 accounts and apply patches and updates. Your written IT plan records the age and condition of your equipment and flags what should be replaced, so replacement happens on your schedule and not in the middle of a deadline. We look after your backups. Much of a firm’s work now sits in Microsoft 365, which means staff can often keep working from another location if the office has a problem.

When something does go wrong, your staff reach people who know your systems. Two named people know your account and both have worked on it.

They do not need the setup explained to them, which saves time when a filing or a client deadline is close. If a problem is not moving, there is a set path for who it goes to next.

The help desk, emergency network support, and on-site escalation are available from 7 a.m. to 7 p.m., Monday to Friday.

If the cause is a security incident, the response plan in Citadel Security sets out who is contacted, what is isolated, and who speaks to clients.

Remove it on the day they leave, from every system, and keep a record that you did.

Departures are a common gap. A former employee’s email account stays open for months so that messages can be forwarded. Their login to a document system or a client portal is forgotten. They still have files synced to a personal phone or a home computer. None of this is usually malicious, but each one is a way for client information to leave the firm, and client questionnaires ask about it directly.

A sound process has a few steps. Disable the person’s account so they can no longer sign in. End any sessions that are still active on their devices.

Collect firm laptops and phones. Reassign their mailbox and files to somebody who needs them. Check which outside systems they had access to, such as client portals, and remove them there as well. Change any shared passwords they knew.

This works best when every person has their own account and the firm’s work is kept inside its Microsoft 365 account, because access can then be removed in one place.

Under Elevate, we manage your Microsoft 365 accounts and who can get into what. When you tell us somebody is leaving, we remove their access. If you take Citadel Security, how access is granted and removed goes into the written record, which is what you use to answer a client who asks.

Plan the switch around your deadlines and move in stages.

The first step causes no interruption. The complimentary assessment takes two weeks and looks at your systems, your security setup, your software, and your risks. Your staff keep working as usual. At the end you receive a written report and a 45-minute walkthrough.

The plan follows about a week later. It sets out what we would do, in what order, and what each part costs, with a firm price. It scopes the transition for your firm, because the length depends on how many people and systems you have and how well things were recorded before.

During the transition, we work around your hours. Tell us about the periods when the firm cannot afford any disruption, such as year-end, tax season, or a major client deadline, and we schedule around them. Support stays in place throughout. We write up your systems as we go, so your setup is on paper from the first day.

We deal with your current provider ourselves. We need passwords, license details, and whatever records they hold, and we keep the conversation professional.

The best time to start looking is 90 days before your current contract renews. That leaves room for the assessment, the plan, and an unhurried transition without being rushed into another year.

When it is finished, two named people on our side know your systems.

We control who can get in, how they prove who they are, and what device they are using.

Every person has their own account. That lets the firm limit each person to the files they need and remove access the day somebody leaves.

Multifactor authentication is included in Elevate. A stolen password is one of the most common ways into a firm’s email and files. With multifactor authentication, the password alone is not enough. Clients and insurers ask where it is turned on, and they ask about email and remote access in particular.

Devices matter as much as accounts. A firm laptop managed under Elevate has endpoint protection and receives patches. A personal computer at somebody’s home may have neither, and other family members may use it. Each firm has to decide whether staff may reach client files from personal devices, and under what conditions. That decision belongs in your written rules, and client contracts sometimes make it for you.

Where files are kept matters too. Client documents saved to a personal cloud account or emailed to a personal address have left the firm’s control.

Keeping work inside the firm’s Microsoft 365 account means access can be managed and removed.

We set this up as part of Elevate and write down how it works. That written description is what you use when a client’s questionnaire asks how remote access is secured.

Yes. It is one of the most common reasons firms like yours call us.

If the questionnaire is on your desk now, start with the complimentary assessment. It works through those questions and shows you what is missing before you fill anything in. Send us the form at the start, and we can check your setup against the exact questions your client has asked. The assessment takes two weeks and ends with a written report and a 45-minute walkthrough.

A few principles help with any questionnaire. Answer specifically. If the form asks about multifactor authentication, say where it is turned on. Check before you write, because what somebody remembers about your setup may be out of date. Where the honest answer is no, say so and add what you plan to do and when. A false answer can become a contract problem later, and most clients respond better to an honest gap with a date beside it.

Keep a copy of what you submit. The next client’s questionnaire will ask many of the same things.

For the longer term, Citadel Security keeps a written record of how your security is set up and keeps it up to date. When the next form arrives, most of the answers are already written. As you take on bigger clients, the forms get longer, and the same record covers them.

It means the promises in those agreements have to be true of your systems.

Confidentiality agreements and the security terms in client contracts often contain specific commitments. They may require you to limit access to the people working on the matter. They may require encryption on laptops, or multifactor authentication, or that the client’s information stays in Canada.

Many require you to notify the client within a set number of hours or days if their information is involved in a security incident. Some give the client the right to audit you.

Firms sign these agreements to win the work, and often nobody checks whether the IT setup matches. A partner signs a contract promising notification within 72 hours while the firm has no way of detecting a breach and no plan for responding to one.

The practical step is to gather the security commitments from your main client agreements into one list and compare them with how your systems are set up. Where they match, write that down. Where they do not, either change the setup or raise it with the client.

We help with the technical side. The assessment reviews your security setup, and Citadel Security provides monitoring, a response plan, and a written record that you can check against your commitments. Firms bound by confidentiality agreements are the kind of firm Citadel Security is built for. For what a specific agreement requires, ask your lawyer.

The details vary, but most questionnaires cover the same subjects. Knowing them in advance makes the form less daunting.

• Access. Who can reach the client’s information? Does each person have their own login? Is multifactor authentication turned on for email and remote access? How is access removed when somebody leaves the firm?
• Devices. Are laptops and phones encrypted? Do they have endpoint protection? Are they kept up to date with patches?
• Data handling. Where is the client’s information stored, and in which country? Who else can see it, including your suppliers? How long is it kept and how is it deleted?
• Backups. Are backups made, are they kept separate from your network, and are they tested?
• Monitoring. Does anybody watch for security problems? Do you scan for weaknesses? How quickly are urgent updates applied?
  Incidents. Do you have a written incident response plan? How quickly will you tell the client if their information is involved in a breach?
  People. Are staff trained to recognize phishing? Do they sign confidentiality agreements?
  Suppliers. Which outside companies have access to your systems, and how do you check them? Your IT provider is one of them.
  Insurance. Do you carry cyber insurance?

Our assessment reviews your setup against questions like these and shows what is in place and what is missing.

Insurers ask most businesses the same questions, and firms that hold client information should expect to be asked all of them. A typical application or renewal form covers eight areas.

• Where multifactor authentication is turned on. The form asks about email, remote access, administrator accounts, and anything that touches your backups, each separately.
• Whether backups can be reached from your network, whether you test them, and when you last restored from one.
• Your endpoint protection by name, what it covers, and whether anybody is watching the alerts.
• How quickly an urgent update reaches every machine.
• Who holds administrator rights, how many people, and why each one needs them.
• When staff were last trained.
• Whether you have an incident response plan, when it was last exercised, and who is on the call list.
• What access outside companies have to your systems, including your IT provider.
• Forms for professional firms may also ask about the kind and amount of client information you hold.
• Answer accurately. If you make a claim, the insurer may compare your answers with what it finds.

We suggest starting 90 days before renewal. Our complimentary assessment works through these questions and gives you a written report you can put in front of your broker. Under Citadel Security, the written record holds the answers and is kept up to date. Decisions about coverage and price are the insurer’s.

A professional services firm depends on its people being able to work without interruption and on its clients trusting it with their information. Managed IT has to support both.

With Unimatrix, the day-to-day work is delivered through Elevate. We manage your network, your servers, and your Microsoft 365 accounts, which for most firms means email, files, and Teams. We apply patches and updates and look after your backups. Your staff get a help desk to call, and two named people know your account. The help desk is available from 7 a.m. to 7 p.m., Monday to Friday.

Security is included. Elevate comes with email threat protection, a firewall for up to 75 users, endpoint protection, and multifactor authentication. Elevate

Complete adds security awareness training and phishing testing for your staff.

Firms that hold client information usually need Citadel Security as well. It adds quarterly external vulnerability scanning, stolen-credential monitoring, and managed detection and response. It also gives you a response plan and a written record of how your security is set up. That record is what you use to answer client questionnaires and insurance forms.

You get a written IT plan as well, which we review with you on a set schedule. Partners can see what is coming and what it will cost.

That is normal. Very few firms can answer yes to every question on a long security questionnaire, and the clients who send them know that.

There are usually three reasons a question is hard to answer. The first is that you do not know. The measure may be in place, but nobody in the firm can say for certain. The fix is to check. Our assessment finds these gaps first, so you know the true answer before you submit anything.

The second reason is that the answer is no. The measure is not in place. Here you have two choices. If it is quick and inexpensive to fix, fix it and then answer yes. If it will take longer, answer honestly and say what you plan to do and when. A dated plan is much better than a blank.

The third reason is that the question does not fit your firm. Some questionnaires were written for large suppliers and ask about things a 40-person firm would not have. It is reasonable to explain why a question does not apply and describe what you do in its place.

The one thing not to do is guess, or answer yes because it is easier. Questionnaire answers often become part of the contract. If something goes wrong later and an answer turns out to be false, the firm is in a much worse position.