Client confidentiality is the whole business.
Your clients trust you with their data. Your insurer and your reputation depend on you protecting it. Most professional-services breaches begin with a single compromised credential — we close that door and prove it stays closed.
Dossier 05 / 10
Professional Services
Your clients trust you with their data. Your insurer and your reputation depend on you protecting it.
- Privacy Act 1988 / APPs
- Client contractual obligations
- Professional indemnity conditions
What the obligation actually requires of you.
- 01
Privacy Act 1988 / APPs
Where the Privacy Act applies, personal information in client files, engagement letters and deliverables requires reasonable protection; commercially sensitive information also needs contractual and professional safeguards.
- 02
Client contractual obligations
Larger clients now write specific security requirements into engagement contracts, and audit against them before renewal.
- 03
Professional indemnity conditions
Professional-indemnity insurers are beginning to ask what controls you actually run before they renew, and to adjust terms when the answer is thin.
controls to review
Use this sector-specific set of practical prompts to identify owners, evidence and the next control to verify.
A departing consultant's laptop retaining access.
Illustrative scenario — In this example, A consultant's employment ended, but an offboarding gap left their laptop with active access to shared client folders for eleven days. Access-log review flagged file activity from that device after the departure date.
Example response — A suitable response is to disable the departing user, revoke active sessions, review file-access logs and confirm that client folders no longer inherit unnecessary access.
What to verify — Confirm the relevant control is configured, tested and evidenced for this scenario; record the owner, review date and any exception before treating the risk as addressed.
Control evidence to collect
Configuration, test evidence, an accountable owner and a review date for the controls described in this scenario.
Illustrative scenario only. It is not a client case study, endorsement, zero-loss claim or proof of a security outcome.
Run it yourself, then see the priorities.
Review each practical control, assign an owner, and get an educational action list before you request a prepared follow-up.
These are practical control prompts, not a legal compliance determination. Exact obligations vary by entity, asset, contract and jurisdiction.
Professional Services Cybersecurity Checklist
Complete each control to see your prioritised plan before submitting.
The questions this vertical always asks.
Conditions are appearing at renewal, not before. Firms that can already answer the security questions renew cleanly; firms that can't negotiate from a weaker position.
The assessment examines your infrastructure and access controls, not client engagement content. What we see is scoped, and confidentiality terms are agreed upfront.
The controls scale to your size. A ten-person partnership needs MFA, access control and a tested incident plan just as much as a two-hundred-person firm — the exposure per partner is often higher.
Find out exactly where your client confidentiality is exposed.
The Cyber Readiness Assessment is the forensic starting point, backed by a 100% refund guarantee. Enquire for scope and terms.
Melbourne VIC · Australia · gmanit.com.au