IT for law, accounting and consulting firms in the UAE.

Why professional firms are a particular target

Law, accounting, audit, tax and consulting firms hold information that clients would not want anywhere else: contracts, financial statements, tax positions, deal plans and personal data. Their main product is trust. A single mis-sent email or a compromised mailbox can do more damage to a practice than most technical failures, and clients, banks and insurers increasingly ask how that information is protected. For the service view, see the professional services IT page.

The areas below are the ones that matter most, in roughly the order a partner or practice manager meets them.

1. Client confidentiality and matter separation

Confidentiality is more than keeping outsiders out. Within a firm, not everyone should see every client. Conflicts of interest, ethical walls and engagement-specific confidentiality mean that access should follow the client or matter, not the office.

• Structure files so each client or matter has its own location with its own permissions, rather than one shared drive open to all staff.
• Use groups for engagement teams, so adding or removing a person is a single change.
• Where an ethical wall is needed, restrict access explicitly and record who was given access and when.
• Keep client data out of personal email, personal cloud accounts and messaging apps. If staff need a quick way to share, provide an approved one.

This separation is also what makes it possible to answer a client who asks who has seen their files.

2. Access control and sign-in

The most effective single control for a professional firm is multi-factor authentication on every account, especially email. After that comes access that matches the job: standard users do not need administrator rights, and administrator accounts should be separate from everyday accounts. Review access when people change role, and remove it on the day they leave. The MFA rollout guide explains how to introduce it without disrupting fee earners.

3. Secure document sharing with clients

Professional firms exchange sensitive documents with clients constantly, and plain email attachments are a weak way to do it. A better approach is to share through a controlled link or a client portal where possible:

• Share specific files or folders by link, not by attaching copies, so access can be withdrawn later.
• Require sign-in for the recipient where the content is sensitive, and set an expiry date.
• Use sensitivity labels or encryption for the most confidential material, so protection travels with the file.
• Limit who inside the firm can share externally, and keep a record of external sharing that can be reviewed.

Microsoft 365 provides most of these controls when it is configured deliberately. The Microsoft 365 security baseline lists the settings to check.

4. Email security and payment fraud

Email is where professional firms are most often attacked. Typical patterns are an impersonated partner asking finance to pay an invoice, a client email thread altered to change bank details, or a phishing message that harvests a password and then reads the mailbox for weeks. Firms that handle client money or settlement instructions are particularly exposed.

• Publish and enforce SPF, DKIM and DMARC for the firm's domains so others cannot easily impersonate you.
• Filter incoming email for phishing and malicious attachments, and warn staff about messages from outside the firm.
• Review mailbox forwarding rules regularly. Attackers often create a hidden rule to copy mail out.
• Adopt a rule that any change to bank details is confirmed by a call to a known number, never by replying to the email.

The email security and payment fraud guide goes deeper, and the free email security checker tests a domain.

5. Retention, records and backup

Professional records must often be kept for a set period and must be findable and unaltered when needed: engagement letters, working papers, signed agreements and invoices. Retention periods depend on the profession, the regulator and the contract, so confirm them with your own adviser. From an IT perspective the aims are straightforward: know where each class of record lives, stop it being deleted early, and be able to restore it.

• Back up Microsoft 365 as well as file servers. Native recycle bins and retention settings are not a substitute for a separate backup. See why Microsoft 365 needs its own backup.
• Keep at least one copy off the main system, and test a restore of a client folder on a schedule.
• For records that must not change, consider a document archive with a tamper-evident history. Missan Global is the exclusive Middle East partner for windream.

6. Remote working and devices

Partners and fee earners work from client sites, courts, airports and home. That makes the device the new perimeter. Firms should decide which devices may access client data and what condition they must be in.

• Prefer company-managed laptops and phones, enrolled in device management so they can be locked or wiped if lost.
• If personal devices are allowed, restrict them to approved apps and keep client files from being saved locally.
• Encrypt disks, require a screen lock and keep operating systems and applications updated.
• Use secure remote access for internal systems rather than exposing them to the internet.

The remote and hybrid work guide and the mobile device management guide cover this in more detail.

7. A written device and acceptable-use policy

A short written policy helps both staff and clients. It should say which devices are permitted, how client data may be stored and shared, what to do if a device is lost, and what happens when someone leaves. Keep it to a page or two so people actually read it, and make sure new starters sign it.

8. Audit-ready logging, described generally

Clients, regulators and insurers may ask a firm to show who accessed what and when. You do not need to promise a specific standard to be ready for that question. In general terms, a firm should be able to show that sign-ins are logged, that access to client files can be traced to a person, that administrator actions are recorded, and that logs are kept for a sensible period and protected from alteration. Microsoft 365 records much of this when auditing is enabled. The practical step is to confirm it is switched on, decide how long the records are retained, and know who can retrieve them.

Data protection law is part of the picture too. The UAE Personal Data Protection Law applies to most firms, and DIFC and ADGM have their own regimes, so confirm with your legal adviser which applies to you. The PDPL guide explains the general obligations.

Where to start

A structured review is usually the quickest way to see where a practice stands. The free IT health check covers Microsoft 365, email security, backup and access to client files. Missan Global has supported UAE organisations since 2004 from its head office in Al Majaz, Sharjah.