Case study · Accounting firm

An accounting firm that passes its clients' security reviews

Larger clients were asking hard security questions. We built a SOC 2–aligned environment — managed devices, strong sign-in, documented controls — and the firm passed its client security reviews with no findings to fix.

The problem

The firm was about to take on larger clients whose vendor-risk reviews demanded enterprise-grade security. The work was excellent; the IT behind it wasn't built for that scrutiny.

No central device management
Security settings that differed from computer to computer
Little visibility into encryption, access or compliance status
No written security baselines or data-handling rules
Growing pressure to prove security before signing new clients

What we did

Managed devices

• Central management for every computer
• Standard secure configuration
• Full-disk encryption everywhere
• Only compliant devices can reach firm data

Identity and access

• Multi-factor sign-in for everyone
• Conditional access policies
• Access to client data based on role and device health

Controls mapped to SOC 2

• Baselines aligned to the SOC 2 Trust Services Criteria
• Logging and monitoring that produce evidence
• Clear separation of client data from internal files

Secure collaboration

• Encrypted cloud storage with strict permissions
• Structured client folders with controlled access
• Encryption at rest and in transit

Documentation

• Security policies and procedures written with the team
• A clear security story for client questionnaires
• Ongoing upkeep without extra admin burden

The results

SOC 2–aligned security posture
Client security reviews passed with no remediation findings
New corporate clients onboarded
Clear visibility into device and data security
Lower long-term risk

Professional-services firms are now held to the same standards as their biggest clients. The right design — not a bigger budget or an in-house IT department — is what gets you there.