Cyber security for Australian legal professionals.

Common questions

Asked by buyers like you.

Not in this list? Call us on 1300 004 766 or book a 30-minute consultation. No obligation.

1. 01Does the Privacy Act apply to my law firm?+

   Law firms with annual turnover above $3 million are covered entities under the Privacy Act 1988 and must comply with all thirteen Australian Privacy Principles. Smaller practices may still be covered if they provide services under a Commonwealth contract. Legal Aid Commission agreements and government panel appointments typically bring a practice within scope regardless of turnover. The test has three limbs: annual turnover above $3 million, a Commonwealth contract, or whether you handle tax file numbers or credit eligibility information for clients.

2. 02What is the Notifiable Data Breaches scheme and when does it apply to a legal practice?+

   The NDB scheme requires covered entities to notify the OAIC and affected individuals when a data breach is likely to result in serious harm. For a law firm, the threshold is almost always met when client files are involved. Income records, family violence disclosures, identity documents, financial affidavits and privileged communications each independently create serious harm risk if accessed without authorisation. The assessment is whether a reasonable person would conclude there is a real risk of serious harm. For most legal data, that answer is yes. Notification should not be delayed once that assessment is made.

3. 03Can a cyber security failure lead to disciplinary action under the Legal Profession Uniform Law?+

   It can. The Legal Profession Uniform Law imposes obligations on practitioners around competence and the protection of client confidentiality. A failure to maintain adequate security controls that results in the exposure of privileged client communications or unauthorised access to client funds could constitute unsatisfactory professional conduct or professional misconduct, depending on the circumstances. Law Societies in NSW and Victoria have published cyber security guidance for practitioners. That guidance is the reference point a practitioner would be measured against if disciplinary action followed a breach.

4. 04Which legal practices will be covered by the AML/CTF Tranche 2 reforms from 1 July 2026?+

   The Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 extends the AML/CTF regime to legal practices providing designated services including conveyancing, company and trust formation, estate administration and certain trust account management services. From 1 July 2026, those practices will be AUSTRAC reporting entities with obligations to maintain an AML/CTF program, conduct customer due diligence, report suspicious matters and keep records. Privacy Act obligations will also apply to personal information handled for AML/CTF purposes regardless of annual turnover.

5. 05What is settlement payment fraud and how does it work?+

   Settlement payment fraud is the most common financial attack affecting Australian conveyancing practices. Attackers gain access to a conveyancing email thread, through a compromised email account, a spoofed domain or a compromised client mailbox, and monitor the correspondence. Days before settlement, they send modified payment instructions with substituted BSB and account numbers. The email appears to come from the conveyancer's address and references the correct property and settlement details. Buyers, expecting payment instructions at that point in the process, often transfer without calling to verify. A typical residential settlement is between $500,000 and $1.5 million.

6. 06What does a law firm's trust account exposure look like after a cyber incident?+

   It depends on what was accessed and what was done with that access. If a compromised matter management credential allowed an attacker to view trust account balances and transaction records, you have a potential NDB breach. If the compromise enabled a payment redirection from the trust account, you face both a regulatory and a financial consequence simultaneously. Law Society auditors will expect you to account for what happened, when you detected it and what controls you had in place. Practices that cannot produce that account face audit exposure on top of the breach itself.

7. 07What matter management systems do you work with?+

   We work with law firms and legal practices running LEAP, PracticeEvolve, ActionStep and Clio, as well as custom or legacy document management environments. Our work is primarily at the Microsoft 365 layer, because that is where most breaches affecting legal practices begin. Where matter management platforms have their own MFA and access control settings, we review those as part of any engagement.

8. 08Is the Essential Eight mandatory for Australian legal practices?+

   Not in the sense that a statute requires it. There is no mandatory cyber security framework that applies to private legal practices. But the Law Societies of NSW and Victoria have each published cyber security guidance for legal practitioners that cites the Essential Eight as the relevant baseline. That guidance is relevant in a disciplinary proceeding and in PI insurance renewals. A practice that cannot demonstrate alignment with the Essential Eight at an appropriate maturity level is harder to defend before a Law Society auditor or a disciplinary committee.

9. 09How quickly can a security review be completed for a legal practice?+

   A security review usually runs two to three weeks from initial conversation to report. For practices with a clear, bounded environment, a single Microsoft 365 tenant, a single office and LEAP as the primary platform, the process is often faster. We are upfront about scope and timeline from the first conversation.

10. 10What does IronSights actually do during a Microsoft 365 security engagement for a law firm?+

    We start by reviewing your Secure Score and tenant configuration: whether legacy authentication is enabled, whether MFA is enforced on all accounts, whether admin accounts are separated from standard user accounts, and whether DMARC, DKIM and SPF are correctly configured on your email domains. From there, we work through Conditional Access policies, Defender for Business deployment, and Microsoft Purview sensitivity labelling for client documents. For legal practices specifically, we pay attention to SharePoint external sharing settings and the permissions held by third-party applications connected to your tenant.

11. 11What happens during a ransomware attack on a law firm?+

    In most ransomware events affecting law firms, the attacker has been inside the network for days or weeks before encryption begins. That access period is used to map the environment, identify the most sensitive files, and in many cases exfiltrate a copy of client data before encryption occurs. When encryption starts, the firm loses access to active matters, trust account records and client correspondence simultaneously. The attacker may also threaten to publish exfiltrated data. Client files in a legal context carry particular pressure as threatened disclosures. Containment, recovery from backup and NDB assessment all need to happen at the same time.

12. 12Do you work with sole practitioners or only with larger firms?+

    We work across the size range, from sole practitioners to mid-size practices with multiple offices. Most of our work with smaller practices starts with a security review: a structured assessment of the Microsoft 365 environment, identity controls and how client data is stored. From there, the right next steps depend on the firm's risk profile and what the review finds. Not every practice needs a managed security service. Some need to address a defined set of gaps and maintain their own posture from there.