01Know which devices and accounts access client work
When laptops, subscriptions, and user accounts are tracked in separate spreadsheets or someone’s memory, important gaps stay hidden. We review your asset inventory, administrator roles, account ownership, and device-management coverage to identify what the firm controls and what needs attention. Google Workspace supports centralized administration, but its capabilities still need appropriate configuration and may depend on the subscription and devices involved. A practical improvement plan can address unmanaged computers, outdated systems, missing access controls, and unclear ownership. Your firm gets a clearer picture of its environment before another person, device, or application is added.
02Set security controls before an incident sets the agenda
Buying a new security product after each incident often creates overlapping tools without a consistent operating process. We help prioritize preventive controls around the way your firm works: account protection, device updates, endpoint security, recovery arrangements, and clearly assigned administrative tasks. Regular review helps identify settings that have drifted or systems that were left out. This does not remove every risk, but it creates a more deliberate approach than waiting for a compromised account or lost laptop. Recommendations connect each change to a business exposure, its operational impact, and the responsibilities needed to keep it working.
03Make staff changes and shared files an orderly process
A new employee should receive the access their role requires through a repeatable process. A departure should trigger timely account changes, access removal, device recovery, and an agreed handover of business records. We help define that process with your authorized decision-makers. We also review scattered folders and permissions across Teams, SharePoint, OneDrive, and Google Drive. Individual storage has a place for personal working files, while ongoing team and client records often belong in organization-controlled shared locations. The aim is a consistent structure with appropriate access, so client work remains available to authorized colleagues when someone changes roles or leaves.
04Replace shared logins with accountable access
One password for an entire department makes it difficult to remove a former employee’s access or understand who changed a client record. The same problem arises when every business subscription is registered through one person’s everyday account. We review shared credentials, resource ownership, administrator access, and available ways to give people individual access. Where suitable, recommendations include named accounts, multifactor authentication, delegated administration, and managed password sharing for the limited resources that require it. Ownership and recovery details should remain under firm control. Any change needs to account for vendor capabilities and your working practices rather than disrupt access without a handover.
05Protect email and teach staff what to question
Client-facing firms regularly exchange documents, payment details, and sensitive requests by email. We review email configuration, including SPF, DKIM, and DMARC, along with filtering, mailbox permissions, and collaboration settings. If you operate an in-house mail server, its spam and threat-filtering arrangements need attention too. Authentication helps address domain impersonation but cannot stop every fraudulent message. External-sender notices can provide a useful cue, while practical awareness training gives staff a process for checking unexpected links, attachments, payment changes, and credential requests. We help define how suspicious messages are reported and escalated, so staff know what to do when a request looks convincing.
06Align software purchases with actual business needs
Overlapping tools can increase cost without improving control. Sharing one Microsoft 365 user account across staff can also create access, accountability, and licensing problems. We review the products you use, who needs them, and the applicable licensing requirements before recommending changes. This includes checking whether a Windows edition supports the device-management and security capabilities your firm requires. Windows Home is not automatically prohibited for business use, but it may lack features your intended setup needs. The outcome is a scoped purchasing plan: appropriate user access, clearer subscription ownership, fewer unnecessary overlaps, and a documented reason for any proposed upgrade.
