Every law firm has a window each year where the urgent work eases off enough to look at the firm itself. For most Sydney practices it lands after the financial year closes, around the time the professional indemnity renewal questionnaire arrives and asks, again, about your cyber controls.
That timing is not a coincidence to dread. It is an opportunity. The post-financial-year stretch is the natural moment to baseline your IT: to stop guessing about your controls, get a documented picture, and close the gaps before your insurer, or an attacker, finds them for you.
This is a 90-day plan to do exactly that. It is built around the gaps that hit law firms hardest, because a practice that holds trust money, privileged client matters, and confidential records is precisely the kind of target attackers and insurers both pay close attention to. For the broader picture, including what PI insurers now ask, our guide to IT for law firms sets the scene.
Why This Window Matters
Two pressures converge in the post-financial-year period. The PI insurance renewal cycle puts your cyber controls under formal scrutiny, and the quieter caseload gives you the room to actually do something about them.
Trying to tighten security mid-trial or in the run-up to settlement is a recipe for half-finished work and frustrated staff. Doing it now means you can test restores properly, train people without resistance, and have a documented baseline you can point your insurer to rather than bluffing your way through the questionnaire.
The goal over 90 days is not a perfect security posture. It is a clear, honest picture of where your firm stands and the biggest gaps closed in priority order.
The First 30 Days: See Where You Stand
You cannot baseline what you have not measured. The first month is about getting an honest picture, not buying products.
Build an inventory of every system that holds client data, controls money, or governs access: Microsoft 365, your practice management system, the document management system, any remote access tools, and the systems around your trust account. For each one, answer plainly: is multi-factor authentication actually enforced, or are you assuming it is?
Most firms find their first surprise here. Multi-factor authentication tends to be on for email and missing from the document system, remote access, or an old admin account nobody remembers. Map it now, before you decide what to fix. This is also the point to note where your PI questionnaire answers would be weak, so the next 60 days target the right things.
Days 30 to 60: Close the Law-Specific Gaps
With a clear picture, the second month closes the gaps that matter most in legal practice.
Trust accounts and payment fraud. The highest-stakes risk is money moving to the wrong place. An attacker who gets into one mailbox can watch settlement and disbursement conversations, then send a convincing email asking to update bank details before a payment. Because it comes from a real account, it passes the usual checks, and trust money is unforgiving when it goes astray. Multi-factor authentication on every mailbox makes the break-in much harder, and a firm rule that any change to payment details is confirmed by phone to a known number, never by replying to the email, catches most of what slips through. Our guide to business email compromise explains the pattern.
Confidentiality and document access. Privilege depends on the right people seeing the right matters. Review who can access what, restrict access to the matters people actually work on, and make sure a departing solicitor or paralegal loses access on their last day. Permission-based access on your document system is not a luxury for a firm that owes clients confidentiality.
Tested backups. A backup nobody has restored from is a guess. Confirm your matter files and practice data are backed up, tested on a schedule, and that at least one copy is protected so ransomware cannot encrypt or delete it. This is also one of the questions your insurer asks directly, so getting it right pays twice.
Days 60 to 90: Make It Stick and Map It to a Standard
The final month turns a cleanup into something durable.
Security drifts. A new account appears without multi-factor authentication, patching slips behind, a backup quietly stops. The firms that stay secure are the ones with ongoing monitoring and reporting, so the state of their controls is visible rather than assumed. This is also what lets you answer next year’s PI questionnaire from evidence instead of hope.
Everything in this plan maps to Essential Eight, the baseline controls published by the Australian Cyber Security Centre: multi-factor authentication, patching, tested backups, restricting access. You do not need to memorise the framework. You need the controls behind it working in your practice, which is what these 90 days deliver, and it reduces the actual risk to your clients and the privilege they trust you to protect.
Where to Start
If your renewal is approaching and you are not confident in your answers, do not guess and do not bluff. Use the window while it is open and get a clear picture first.
Our IT maturity assessment gives you a plain-English read on where your firm stands in a few minutes and shows what needs attention first. From there you can decide what to handle internally and what to hand over.
We are a Sydney-based team in Bella Vista, and we work with law firms across Sydney. We understand the specific pressures your practice faces, from trust accounts to confidentiality, and we secure them without getting in the way of the work. Talk to our team when you are ready.
