RemoteIT for law firms
Law firms hold trust money, privileged files and client identities. Attackers know.
A hacked mailbox at a law firm can redirect a settlement, expose privileged advice and trigger a notifiable breach in the same week. Here is what Australian firms need from their IT, the obligations that apply, including AML/CTF from 1 July 2026, and a readiness check for your practice.
Regulatory details from AUSTRAC guidance, the OAIC and the Victorian regulator, checked 30 October 2026. General information, not legal advice.
- Trust account protection
- Obligations explained
- 10-point readiness check
Reviewed by Blake Bath, General Manager, on 30 October 2026.
What we find
Five IT gaps we see in law firms.
Each one carries privilege, regulatory or trust account risk.
Mailbox takeover
A partner's email is read for weeks, then used to redirect a settlement.
- Phishing-resistant MFA
- Rule alerts
- 24/7 monitoring
Files outside the system
Matter documents in personal OneDrive, email attachments and USB drives.
- One managed store
- Sharing limits
- Retention
Shared logins
One login for the trust banking or a shared mailbox password everyone knows.
- Named accounts
- Two approvers
- Sign-in blocked
Personal devices
Client files opened on home computers with no encryption or wipe.
- Managed devices
- App protection
- Remote wipe
No incident plan
Nobody knows who calls the bank, the insurer or the regulator.
- Written plan
- Contacts listed
- Tested yearly
Law firm IT readiness check
How ready is your firm?
Tick what is true for your practice today. You get the gaps to close in the order we would close them.
Tick what is true for your practice today.
Where you stand
0of 10 controls in place
10 gaps to close.
- Phishing-resistant MFA on email and the practice systemAccount takeover is the start of most trust account fraud.
- Bank detail changes verified by phonePayment redirection cost Australians A$166.8 million in 2025 (ACCC).
- Two people approve trust paymentsOne rushed person is the weak point.
- Only managed, encrypted devices reach client filesA lost laptop with matter files is a notifiable breach risk.
- Matter files in one managed placeFiles that leave with staff cannot be protected or produced.
- Backups that ransomware cannot deleteRecovery without paying depends on it.
- Leavers lose access on the dayFormer staff with access are a privilege and fraud risk.
- Someone watches sign-ins and mailbox rulesAttackers read mail for weeks before redirecting a settlement.
- A written incident planThe first hour decides how much money comes back.
- AML/CTF program and records in placeObligations for lawyers started 1 July 2026.
What applies
The obligations that shape law firm IT.
| Obligation | What it means for IT | Applies to |
|---|---|---|
| Privacy Act and Notifiable Data Breaches | Reasonable steps to protect personal information; assess suspected breaches and notify where serious harm is likely | Firms covered by the Privacy Act |
| Confidentiality and privilege | Client communications and work product protected from unauthorised access | All practices |
| State regulator expectations | In Victoria, minimum cyber expectations across critical, system and behavioural controls | Practitioners in that state |
| AML/CTF (from 1 July 2026) | Enrolment, a program, customer due diligence, secure records and suspicious matter reports | Firms providing designated services |
| Professional indemnity and cyber insurance | Controls the insurer asks about, such as MFA and backups | Firms with cover |
General information only. Check your obligations with your regulator, insurer and legal adviser.
From 1 July 2026
AML/CTF: the IT side.
- Secure customer recordsIdentity documents and due diligence records stored with access controls and an audit trail.
- Reporting timeframesSuspicious matter reports within 24 hours for terrorism financing, 3 days otherwise, 5 days where privileged information is included.
- Systems you can evidenceThe program, training records and monitoring need to be shown on request.
- Staff trainingRecorded, refreshed, and part of onboarding.
What good looks like
The controls that matter most for a practice.
- Phishing-resistant sign-inPasskeys or security keys for partners, trust staff and admins.
- Payment verificationPhone call on a known number for every bank change, and two approvers for trust payments.
- Managed devicesEncrypted, updated and able to be wiped. Personal devices limited to app protection.
- One home for matter filesThe practice system or SharePoint, with access by matter and no personal storage.
- Independent backupsMicrosoft 365 and practice data, immutable copies, tested restores.
- 24/7 monitoringSign-ins, mailbox rules and endpoints watched, with someone to act.
Our view
Protect the trust account first.
The most expensive incidents we see in professional services start with one mailbox and end with a redirected payment. So we start with sign-in, mailbox monitoring and the payment process, before anything else.
Then we make sure files live in one place, devices are managed, and backups would actually get the practice running again. That order protects clients and gives you evidence for your insurer and regulator.
The order
Securing a law practice in five steps.
- Step 1Lock down sign-in
Phishing-resistant MFA, starting with partners and trust staff.
- Step 2Fix the payment process
Phone verification and two approvers.
- Step 3Bring files and devices in
One file store, managed devices.
- Step 4Back up and monitor
Immutable backups and 24/7 monitoring.
- Step 5Plan and train
Incident plan, AML records and staff training.
Related guides
Law firm IT in depth. Start with the money.
Fraud, sign-in, certification and incidents.
Get help your way
Six ways to reach us. Pick whichever suits you.
Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.
- Call 07 3114 2808
An engineer answers Monday to Friday, 8am to 5pm AEST. After hours, weekends and public holidays, Chip, our AI agent, answers on the same number or on 07 3180 0965, logs it and escalates urgent incidents to the on-call engineer.
Call now - Email the helpdesk
Send it to helpdesk@realbytes.com.au and a ticket is logged straight away, with a reference number you can quote.
Email us - Client portal
Log and follow your tickets, see what we are working on and who has it.
Open the portal - Remote support
When an engineer asks to see your screen, start a secure session here. You start it, so nobody sees your screen until you do.
Start a session - Chat in Microsoft Teams
Clients can message Chip, our AI assistant, in Teams to log a request without leaving their desk.
How clients reach us - Service status
Check whether Microsoft 365 or another cloud service is down before you lose an hour troubleshooting.
See live status
Questions
What law firms ask about IT and security.
What IT obligations apply to Australian law firms?
The Privacy Act and its Notifiable Data Breaches scheme for client personal information, your duty of confidentiality and privilege, your state regulator's expectations on cyber security, and, if you provide designated services, the AML/CTF regime that started for lawyers on 1 July 2026. This is general information, not legal advice.
When did AML/CTF obligations start for lawyers?
AUSTRAC opened enrolment on 31 March 2026 and obligations started on 1 July 2026 for firms providing designated services. Suspicious matter reports are due within 24 hours for terrorism financing, 3 days for other matters, and 5 days where the report contains privileged information.
What does the Victorian regulator expect on cyber security?
The Victorian Legal Services Board and Commissioner has set minimum cyber security expectations covering critical controls such as updates, strong credentials and MFA, system controls, and behavioural controls such as ongoing training. It has said some failures are capable of being unprofessional conduct or professional misconduct.
What Essential Eight level should a law firm aim for?
Maturity Level One across all eight strategies is the practical first target, then Level Two for the controls that protect trust accounting and client files. Check what your insurer and any government clients ask for.
How do law firms stop settlement and trust account fraud?
Verify every change of bank details by phone on a number you already had, require two approvers for trust payments, use phishing-resistant MFA on email, and watch for mailbox forwarding rules. Tell clients at engagement that you will never change your bank details by email.
Does Microsoft 365 or our practice system back up our files?
They keep deleted items for limited periods. That is not the same as an independent backup you control. Back up Microsoft 365 and practice data separately, keep copies that cannot be deleted, and test restoring them.
Next step
Want an IT assessment built for a law practice?
We assess sign-in, payments, files, devices, backups and your AML/CTF records, then give you a prioritised plan and evidence for your insurer and regulator.
Keep reading
Reviewed by Blake Bath, General Manager, on 30 October 2026. Regulatory details from published guidance and reporting. General information only, not legal advice. Checked 30 October 2026. LawCPD, Tranche 2 AML/CTF timeline for lawyers; Lawyers Weekly, Victoria's minimum cyber security standards; OAIC, Notifiable Data Breaches scheme; ACCC, Annual scam losses exceed $2 billion (2025); ASD, Essential Eight maturity model