The Situation
A 12-person CBD law firm had been managing IT through a break-fix arrangement for over five years. Every call-out cost $180–$400, and the firm had experienced three server outages in the previous six months — once during a critical client matter deadline. There was no documentation of IT assets, no formal backup testing, and no cybersecurity controls beyond a basic antivirus product that had not been updated in 18 months.
The catalyst for change was their cyber insurance renewal. The insurer had declined to renew due to inadequate controls — specifically citing the absence of MFA, lack of patching management, and no documented incident response procedure. The firm faced the prospect of operating without cyber insurance or paying a dramatically higher premium for a bare minimum policy.
The managing partner came to us with a clear brief: fix the insurance problem, stop the outages, and give us predictable IT costs. He also mentioned that the previous provider had promised the same thing three times in five years.
What We Did
We began with a full IT environment assessment in week one — documenting every device, licence, vendor relationship, and network configuration. The audit revealed several issues beyond what the client had reported: an unpatched server running Windows Server 2012 R2 with no security updates for 14 months, three active user accounts for staff who had left the firm, and a backup system that had been silently failing for six weeks.
- Completed full IT asset audit and documentation in week one
- Migrated from on-premise Exchange and file server to Microsoft 365 and SharePoint Online with zero downtime
- Deployed SentinelOne EDR across all endpoints, replacing the inactive antivirus
- Enforced MFA across all Microsoft 365 accounts using number matching via Microsoft Authenticator
- Implemented automated patching with Patch My PC and Intune for all endpoints and servers
- Configured Azure Backup with immutable storage and tested restore procedures monthly
- Achieved Essential Eight Maturity Level 2 within 60 days of engagement commencement
- Prepared cyber insurance application documentation with evidence of controls implementation
For the first time in five years, I'm not dreading what's going to break next week. Everything is documented, everything is monitored, and when something needs attention, CX IT deals with it before I even know about it.
The Outcome
The firm obtained cyber insurance within 90 days of engagement commencement, at a premium 30% below their previous quote. The insurer specifically noted the quality of the Essential Eight documentation and evidence of tested backup restores.
In the 18 months since migration, the firm has experienced zero unplanned outages. Monthly IT cost is now fixed at $99 per user — predictable, budgetable, and 22% lower than their previous average quarterly spend when normalised to a monthly figure.
The managing partner noted that the biggest change was not the technology. It was the confidence of knowing that IT was being actively managed rather than waiting for the next thing to break.