Protect client confidences, stop wire fraud, and prove to clients that their data is safe with you. Independent audits and testing by CISA-certified auditors, scoped to your firm.
Business email compromise does not need malware. It needs one convincing message on a busy afternoon. Here are the four tells, and what catches each one.
Professional services firms hold their clients’ most sensitive information: privileged communications, deal terms, tax records, and business strategies. A breach does not only expose your firm; it compromises every client who trusted you. Attackers know that time-pressured professionals, large wire transfers, and email-based workflows make these firms easier targets than their clients.
ABA guidance on safeguarding client information, state bar data security rules, the FTC Safeguards Rule and IRS Publication 4557 for tax and accounting firms, CCPA/CPRA, GDPR, SEC requirements for registered advisors, and the security terms in client contracts and outside counsel guidelines. We audit against the Safeguards Rule directly and map findings to the rest.
Most firms start with Microsoft 365, because email, documents, and identities all live there, then add a social engineering test aimed at the payment steps above.
Most firms run their email, documents, and identities in Microsoft 365, which makes its settings some of your most important security controls. We review Entra ID, conditional access, email security, sharing, and data loss prevention to close the gaps behind account takeover and business email compromise.
Microsoft 365 security auditWire fraud and closing scams start with a convincing email or phone call to a busy professional. Through phishing simulations, vishing, and pretexting, we test whether your people and payment procedures stop the request before money moves.
Social engineering assessmentA full review of your servers, cloud services, endpoints, identity, and IT general controls, benchmarked against CIS and NIST standards. It is the clearest way to see whether client data is protected the way you assume.
IT security auditClients increasingly send security questionnaires before they share data. An Auditor Opinion Letter and Secure Seal show clients and prospects that an independent certified auditor has tested your controls.
Auditor Opinion LetterRansomware stops billable work and can expose client files. We verify that your backups are isolated and immutable and that your document and practice management systems can actually be restored, with measured recovery times.
Ransomware readiness auditTax preparers and accounting firms are covered by the FTC Safeguards Rule, and many firms answer to client and regulatory requirements beyond it. We assess your security program and controls against the rules that apply to you.
Compliance auditA ten-person law office, a regional accounting firm, and a national consultancy face very different risks. We do not sell a fixed package. We scope each engagement around your systems, your client obligations, and your team, and deliver findings that are specific and actionable, not a generic checklist.
Microsoft 365, document and practice management systems, client portals, remote work, and the tools your IT provider manages. We test what you actually run.
Findings tied to bar rules, the FTC Safeguards Rule, client contracts, and the other requirements that apply to you, so you can answer client questionnaires with evidence.
An Auditor Opinion Letter and Secure Seal answer client security questionnaires without sending them your full technical report.
Cybercriminals increasingly target law firms, accounting practices, and consultancies because of the client data they hold. M&A deal information, litigation strategy, tax records, and employee data are concentrated in a few systems and handled by busy people, which makes these firms attractive targets for business email compromise, ransomware, and data theft. Our role is to give you an independent, evidence-based view of where you stand, a prioritized plan to close the gaps, and proof you can share with clients.
We start with where client information lives and moves: Microsoft 365, the document management system, file sharing with clients, and the payment steps around closings. We review those settings, test whether your people and payment procedures hold up against a realistic closing scam, and deliver a risk-rated report mapped to the FTC Safeguards Rule and the other obligations that apply to your firm, with clear steps to fix each finding. Where clients ask for proof, an Auditor Opinion Letter documents the result, and our support continues for three months after delivery.
Most organizations begin with one engagement and build from there. Find the situation closest to yours:
Not sure? A free consultation will help you decide.
Altius IT's certified auditors understand professional services firms, where client confidentiality is paramount and billable-hour pressure creates security blind spots, and we tailor every engagement to them. Our 50-point security process evaluates document management systems, email security, client portal protections, and access controls, helping your firm demonstrate security due diligence to clients and regulators.
Firms hold privileged communications, deal terms, and tax records for many clients at once, and clients increasingly send security questionnaires before sharing data. An independent audit finds the gaps before attackers do and gives you evidence, such as an Auditor Opinion Letter, that you can share with clients.
Firms that prepare tax returns are covered by the FTC Safeguards Rule, which requires a written information security program with specific safeguards, and IRS Publication 4557 explains how those obligations apply to tax professionals. Our compliance audit assesses your program and controls against the Safeguards Rule.
Not necessarily. Misconfigured identity, sharing, and email settings leave firms open to phishing, account takeover, and business email compromise. Our Microsoft 365 security audit reviews Entra ID, conditional access, email security, data loss prevention, and your tenant configuration.
Altius IT provides certified IT security audit services across multiple industry sectors.
