Talk to an expert

Industry

Technology and security for professional services firms

Professional services firms sell trust and hold the confidential matters of many clients at once. Onion Infosec runs and secures the workplace technology, document systems and AI tools that the work depends on.

Talk to an expert
Sector
Professional Services
Segments
Law firms, Accounting and audit, Consulting and advisory, Architecture and engineering practices

01Context

Law firms, accountancies and consultancies sell trust.

Their systems hold the most sensitive matters of every client at once, so a single breach at one firm exposes the confidential information of many organizations.

The work is centered on email and documents, carried out by mobile professionals, and led by partners who expect exceptions to policy. Clients write security requirements into engagement letters and send detailed questionnaires. Meeting them has become a condition of winning work, particularly from regulated clients.

02Technology

What the sector builds and runs.

Document, matter and knowledge systems
Document management, practice management, client portals and the integrations between them, with matter-level access control and information barriers.
AI for knowledge work
Document review, drafting and research assistants deployed on the firm’s own data, respecting matter permissions and logging every query.
Workplace and IT operations
Microsoft 365 or Google Workspace, device management, identity and remote work, with 24×7 support for professionals in different time zones.
Cloud and data
Migration from on-premises file servers to cloud platforms, with retention, legal hold and client-specific residency requirements handled in the design.

03Risk

The risks that matter most.

Business email compromise
Payment redirection and interception of sensitive correspondence in workflows that run almost entirely over email.
Client data theft
Deal information, disputes and financial records targeted for insider trading and extortion.
The firm as a route to its clients
Attackers who use a firm’s standing access, accounts and email threads to reach client environments.
Uncontrolled use of AI tools
Client material pasted into public AI services with no contractual or technical control over where it goes or how it is retained.

04Regulation and assurance

What you may need to demonstrate.

Professional confidentiality and privilege duties come first. ISO 27001 and SOC 2 are the evidence clients most often request, and GDPR governs personal data in client files. Regulated clients pass their own obligations down the chain: DORA and outsourcing rules from financial clients, HIPAA from healthcare clients. Regional privacy law, such as the DPDP Act in India, applies alongside guidance from bar associations and audit regulators.

  • ISO 27001
  • SOC 2
  • GDPR
  • NIST CSF
  • CIS Controls
  • Cyber Essentials
  • HIPAA
  • DPDP Act

Which of these apply depends on where you operate and what you do. We scope against your actual obligations.

Framework library

05Where we usually start

Services that matter most here.