From high risk to SMB1001 Gold. In four months.
A team of ten-plus, taken from shared passwords and an unsupported server to a recognised Australian cyber security standard. (Name withheld at the firm's request.)
High risk, across the board.
When we first assessed this firm, the honest answer was: high risk, across the board.
- Multi-factor sign-in had gaps, so a stolen password could be enough to get in
- Passwords were shared and reused across accounts
- Remote access was open to attack
- An ancient server, no longer supported, hadn't seen a security update in years, and nothing was keeping the rest of the software patched either
- And behind all of it: years of no real investment in security, no roadmap, no strategy
For a law firm holding confidential client matters, that's not a technology problem. It's a trust problem waiting to surface. The partners knew it, and they wanted more than patch-up fixes: they wanted to get to a standard they could stand behind.
Four months, methodical, built around the standard.
The work was shaped by the five areas SMB1001 covers. In plain language:
- Moved the firm to Microsoft 365 and locked the environment down to our best-practice baseline, which goes further than Gold requires
- Closed the sign-in gaps: multi-factor sign-in enforced everywhere through strict sign-in rules that check who's signing in, from where, on what device, with the firm's main apps brought under one secure sign-in covered by the same rules
- Secured remote access behind multi-factor-protected connections instead of leaving it open to the internet
- Contained what couldn't be replaced: the old systems the firm still needed were separated from the working environment with tightly protected access, so their risk is fenced in rather than ignored
- Hardened every computer: local administrator rights removed across the board, every firewall switched on and monitored, and attack-detection software watching each machine
- Fixed the backups: automated, and tested annually so recovery is proven rather than assumed
- Wrote the policies and procedures, verified them, and set them up for regular review, then trained the whole team so staff know what the firm has committed to
- Then went past Gold: continuous detection and response, with the firm's Microsoft 365 environment under security monitoring 24/7
Certified. And it stays that way.
- Certified SMB1001 Level 3 Gold, reached in four months from a starting point that was years behind
- An improved insurance outcome and experience at renewal
- A secure environment that's actually manageable, instead of a collection of unknowns
- Staff trained and aware of the commitment the firm has made
- It stays this way. The firm is now an ongoing managed client, onboarded into Kevin, our client portal, with full visibility of their SMB1001 status at any time: score, gaps, roadmap and evidence, not a certificate in a drawer
Want to know where your firm would score today?
Four months took this firm from the worst starting position we see to a recognised standard. The certification wasn't the trick: it was the by-product of actually fixing things. Book a free assessment and find out where you stand.