Managed IT services and cyber security for law firms.
IT support, cyber security and compliance for law firms in Brisbane, Sydney and Melbourne, from one accountable partner. We support LEAP, Actionstep, Smokeball, Clio, Infinitylaw and more, protect client confidentiality, and give you the evidence clients, insurers and regulators now ask for.
ISO 27001:2022 certified
SMB1001 Partner
ALPMA Partner
What keeps partners awake
Your reputation is your most valuable asset
Client confidentiality, billable time and trust are on the line every day.
Breach of client confidentiality
Privileged client information exposed through email, a device or a supplier.
Downtime that stops billable work
Fee earners locked out of matters, documents and court deadlines.
Client due diligence and insurers
Security questionnaires from clients and insurers that keep getting harder.
An unsafe AI rollout
AI tools used on client matters without clear rules or oversight.
How we protect your firm
Managed IT and cyber security built around how law firms work
One accountable partner for your firm’s IT support, cyber security and compliance, so the partners deal with one team instead of separate IT, security and audit vendors. Here’s what we look after.
Business Protect and managed security
IT support, cyber security, recovery and governance in one managed service, with SMB1001 certification built in and 24×7 managed detection and response on the higher tiers. Compare the tiers
Email, device and endpoint protection
Filtering for phishing and email impersonation, including fake requests to change bank details. Managed protection on every laptop and desktop, and encrypted, centrally managed devices, so a lost laptop doesn’t expose client files.
Microsoft 365 and document security
MFA and Conditional Access on every account, sharing controls that keep matter documents inside the firm, and retention settings that match your file-keeping obligations. Microsoft 365
Backup, continuity and recovery
Independent backups of Microsoft 365, practice data and servers, with restores tested, so you know how quickly fee earners can get back to work before a court deadline or settlement depends on it. Backup and recovery
Essential Eight maturity
An assessment of your maturity level across all eight strategies, a costed plan to close the gaps, and evidence for clients and insurers that ask. Essential Eight assessment
SMB1001 certification readiness
As a CyberCert partner we get your firm certified at the tier your clients, insurer or tenders ask for, then keep you ready for renewal. SMB1001 certification
Practice management system support
Day-to-day support for LEAP, Actionstep, Smokeball, Clio, Infinitylaw and more, including the Outlook and Word integrations fee earners rely on. More below
vCIO advisory and partner reporting
A virtual CIO who reports to the partners on risk, maturity and technology spend, plans IT around the firm’s strategy, and helps answer client due diligence and insurer questionnaires. vCIO services
Safe, governed AI
Clear rules and technical controls for Copilot and other AI tools, so they help with matters without exposing privileged information. Copilot and MCP: who signs off?
Practice management
IT support for LEAP, Actionstep, Smokeball, Clio, Infinitylaw and more
Your practice management system is where fee earners spend the day. When it’s slow, or an Outlook or Word add-in stops working, billable time stops too. We support the systems we see most in Australian firms, along with the Microsoft 365 setup around them.
| System | How it runs | What we look after |
|---|---|---|
| LEAP | Cloud-based, with a Windows desktop app, LEAP Office for Word and Outlook integration | Keeping the desktop app, Office add-ins and Windows updates in step, and fixing slowness at the device and network end |
| Actionstep | Runs in the browser, with Outlook and Word add-ins for Microsoft 365 | Deploying the Microsoft 365 add-ins, moving firms off the legacy Windows Office plug-in, and setting up OneDrive document access |
| Smokeball | Cloud-backed. The Grow and Prosper+ plans need the desktop app on Windows 11 64-bit with Office installed locally | Making sure every device meets the system requirements before updates roll out, and supporting the desktop app and Office integration |
| Clio | Cloud-based, with an Outlook add-in and Clio for Word | Deploying and supporting the add-ins, and securing sign-in to Clio and Microsoft 365 |
| Infinitylaw | Cloud-based practice management from Thomson Reuters | Supporting users day to day, securing sign-in, and planning the move if you’re changing systems |
| And more | Other legal, document management and accounting systems | Tell us what your firm runs and we’ll tell you up front how we’d support it. |
Across every system, we:
- deal with the vendor’s support team for you, so a fee earner logs one ticket, not two
- set up MFA and secure sign-in for the system and the Microsoft 365 accounts linked to it
- keep devices on the operating system and Office versions the vendor supports
- plan migrations, whether you’re moving off an on-premises server or between systems
- get new starters set up with the system, add-ins and access they need on day one
Compliance
The obligations behind your IT decisions
Law firms carry obligations most businesses don’t. We’re not your lawyers or AML advisers. We look after the technology and security side, so your systems support the obligations instead of getting in the way.
AML/CTF Tranche 2: law firms are now regulated by AUSTRAC
Since 1 July 2026, law firms that provide certain services must meet AML/CTF obligations. These “designated services” include helping with real estate transactions, buying or selling companies and trusts, receiving or managing client money or property for a transaction, setting up or restructuring companies and trusts, and acting as or arranging a nominee director or trustee.
Firms that provide them must enrol with AUSTRAC, have an AML/CTF program and a compliance officer, carry out customer due diligence, report suspicious matters, keep records and train staff. Where IT comes in:
- secure storage and access controls for identity documents and due diligence records
- audit logs that show who accessed or changed client records
- record retention set up so nothing is deleted before it should be
- security awareness training that covers the scams aimed at trust money
See AUSTRAC’s list of legal designated services.
Privacy Act and notifiable data breaches
Unless your firm qualifies for the small business exemption, the Privacy Act and the Notifiable Data Breaches scheme apply. You generally have 30 days to assess a suspected breach, and you must notify affected clients and the OAIC if serious harm is likely. Since 10 June 2025, individuals can also sue for serious invasions of privacy. From 10 December 2026, privacy policies must explain when automated systems make or substantially inform significant decisions about people.
Even where the exemption applies, your duty of confidentiality to clients doesn’t change. We set up the logging and incident response that let you assess a breach quickly and accurately. See the OAIC’s guide to notifiable data breaches.
Law society and regulator guidance
- Queensland: the Queensland Law Society supports SMB1001 and recommends members work towards Gold certification. Its Guidance Statement No. 37 covers the use of AI in legal practice.
- New South Wales: the Law Society of NSW and Lawcover publish a data and cyber security guide and a cyber risk checklist for practices.
- Victoria: the LIV Cybersecurity Hub points to the Victorian Legal Services Board + Commissioner’s minimum cyber security expectations, which treat MFA, strong passwords and security updates as critical controls.
Insurers and payment redirection fraud
Professional indemnity and cyber insurers ask harder questions every renewal: MFA, backups, patching and how you stop fake bank-detail changes. LPLC’s advice is simple: call before you pay. We back it up with impersonation protection, external-email warnings and a documented call-back process, and we help you answer the questionnaire with evidence. Ready to formalise it? SMB1001 for Queensland law firms.
What you get
Answers you can take to the partners
- Client confidentiality protected by layered security and tested recovery
- Evidence ready for client due diligence and cyber insurers
- Partner-ready reporting on risk, maturity and progress
- Billable time protected by resilient, well-supported systems
- Safe, governed adoption of AI across the firm
Where we start
1. Discover
A discovery call to understand your requirements.
2. Propose
A tailored proposal based on what we find.
3. Onboard
Once accepted, a planned, documented onboarding.
4. Improve
Ongoing reviews, certification where it applies, and a roadmap.
FAQ
Law firm IT questions
How much do managed IT services for a law firm cost?
Pricing depends on the number of users, the Business Protect tier you choose and the systems we look after. You get a clear quote after the discovery call, so the partners know exactly what they’re approving.
Can you work with our practice management vendor?
Yes. We support LEAP, Actionstep, Smokeball, Clio, Infinitylaw and other legal systems, and we deal with the vendor’s support team directly, so your staff don’t get passed back and forth.
Does AML/CTF Tranche 2 apply to our firm?
It depends on the services you provide. Conveyancing, company and trust work and handling client money for transactions are the common triggers. Check AUSTRAC’s list of designated services or ask your legal adviser. We can help with the technology and record-keeping side either way.
Should our firm get SMB1001 certified or assessed against the Essential Eight?
For most firms, SMB1001 is the better first step, because it gives you a certificate to show clients and insurers, and QLS recommends Gold. Choose an Essential Eight assessment when a government client or tender asks for a maturity level.
Is it safe to use Copilot and other AI tools on client matters?
It can be, with the right permissions, data controls and a clear policy approved by the partners. Our article Copilot and MCP for law firms: who signs off? explains what to check first.
Can you take over from our current IT provider?
Yes. Onboarding is planned and documented, with no gap in support. We can also start with an assessment alongside your current provider.
Further reading
Book your assessment
Let's find out where you stand
Tell us a little about your firm and what’s prompting the review. We’ll come back to you to book the discovery conversation.
- No obligation to proceed
- Written for leadership, not for IT
- Works alongside your current provider
Helping you protect what you’ve built and build what’s next. Australian owned, operating in Brisbane, Sydney and Melbourne with local accountability and global capability.