Secure, compliant IT infrastructure for businesses with serious data governance obligations
That information includes legal advice, financial positions, commercial strategies, and personal data that clients have shared under an expectation of confidentiality. The obligations around how that data is stored, protected, and handled are both professional and legal. A data breach in a professional services context is not just an IT incident. It is a professional conduct issue, a regulatory matter, and a reputational event that can end client relationships.
Client confidentiality is a professional obligation, not just a privacy policy requirement. The technology environment that stores client data must be able to withstand scrutiny from the regulator and the client
Many professional services firms are subject to sector-specific data obligations beyond the Privacy Act, including obligations under the Legal Profession Uniform Law, ASIC requirements, and the Tax Practitioners Board standards
The consequences of a ransomware incident in a professional services environment extend to the clients whose data was held, creating notification obligations, potential liability, and significant reputational damage
Remote and hybrid working models mean that confidential client data is being accessed from a range of devices and locations that need to be secured consistently
Growing firms taking on larger clients and more complex engagements need infrastructure that reflects the seriousness of the work they are doing
Many professional services firms are still running IT that was appropriate when the business was smaller and that is no longer adequate for the obligations they now carry
Many professional services firms have IT arrangements that look adequate on the surface but would not survive a serious incident or a detailed compliance review. A backup that has never been tested, a Microsoft 365 tenant that has never been hardened, and a support agreement that responds rather than prevents are common in this sector. The question for a law firm or financial adviser is not whether their IT is convenient. It is whether it is defensible.
Client data hosted on CMTG’s private cloud platform stays in Western Australia on infrastructure CMTG owns. A clear, auditable answer to where client data lives, who can access it, and what would happen in the event of a breach. No foreign jurisdiction exposure.
CMTG manages the Microsoft 365 environment that most professional services firms depend on: security hardening, Secure Score uplift, conditional access policies, and cloud backup covering email, OneDrive, SharePoint, and Teams. The platform as it should be, not as it comes out of the box.
Immutable backup with sub-1-hour recovery capability means that in the event of a ransomware incident, the firm can recover client data and resume operations quickly. The notification obligation is uncomfortable. An extended outage while recovering from an attack is worse.
CMTG provides Essential Eight advisory and implementation, helping professional services firms demonstrate a defensible security posture to clients, regulators, and professional bodies that are increasingly asking the question.
A Perth-based legal practice with a mix of commercial and private client work engaged CMTG to review and upgrade an IT environment that had not been substantially updated since the firm grew from five to twenty-five practitioners. CMTG hardened the Microsoft 365 environment, migrated matter management and client document storage to the sovereign cloud platform, implemented Fortinet endpoint protection across all devices and remote workers, and provided quarterly reporting that gave the managing partners clear visibility of the firm’s security posture. The firm subsequently included CMTG’s security credentials in a response to a commercial client’s supplier security questionnaire.
Your team successfully transitioned us from a fragmented network to a unified, scalable, and secure infrastructure
I just wanted to pass on my thanks for your efforts in getting the server upgrade implemented. Your techs have done a great job completing the upgrade works on-site with absolute minimal disruption. When other staff do not even know it happened, that is a great result.
I cannot thank you guys enough for getting me back up and running so fast. This is a crazy time of year for us and I truly appreciate the prompt and professional help.
CMTG was fundamental to the success of the BlackBox Control data centre migration project. Their focus and attention to detail played a key role in delivering a smooth and secure transition.
To install TakeControl, please enter your 9-digit pin code on the right. If you don’t have a code, please contact our engineers! For Mac Installs please press on the link here
