Client Confidentiality Checklist for Consulting and Professional Firms
Consulting firms, engineers, architects, agencies, insurance brokers and financial advisors all promise the same thing: your information is safe with us. Clients rarely ask how. But when a proposal leaks to a competitor, a contract is shared with the wrong person, or a laptop with client files is stolen from a car, that promise is tested. This checklist helps professional firms in Canada protect client confidentiality with practical steps that fit a small team.
Why it matters
- Under PIPEDA, your firm stays accountable for personal information even when a service provider stores or processes it for you (Office of the Privacy Commissioner of Canada).
- Many client contracts now include security and confidentiality clauses, and larger clients increasingly ask suppliers how they protect data.
- AI assistants such as Copilot can surface any file a user has access to, so old oversharing becomes a new risk.
The 15-point client confidentiality checklist
Accounts and access
- ☐ MFA on every email and Microsoft 365 account
- ☐ Each person has their own login; no shared accounts
- ☐ Access to client folders based on role or project, not “everyone”
- ☐ Accounts removed the day someone leaves, including guest and contractor access
- ☐ No more than a handful of admin accounts, used only for admin tasks
Files and sharing
- ☐ Client files stored in a central, backed-up location, not on personal drives or USB sticks
- ☐ Default sharing set to “specific people,” with expiry dates on external links
- ☐ A yearly review of old external shares and “Anyone with the link” files
- ☐ Sensitive documents sent through secure sharing instead of email attachments
Devices
- ☐ Laptops and phones encrypted and managed, so they can be wiped if lost
- ☐ Automatic updates and business-grade endpoint protection on every device
- ☐ Personal phones use app protection that keeps firm data separate and removable
People and process
- ☐ Short, regular phishing awareness training
- ☐ A phone call-back rule for any change to banking or payment details
- ☐ A written plan for what to do if client information is lost or exposed
Most of these settings live in Microsoft 365. Our Microsoft 365 security settings guide shows where to find them, and if you are considering AI tools, read our Copilot readiness guide first.
Score your firm
| Ticked | What it means |
|---|---|
| 13 to 15 | Strong. Document it, so you can show clients and insurers. |
| 9 to 12 | Good foundations with gaps. Fix MFA, sharing and device encryption first. |
| Below 9 | Client data is at real risk. Prioritize a security review this quarter. |
How to answer client security questionnaires
Larger clients often send a supplier security questionnaire before signing. The checklist above covers most common questions: MFA, encryption, access control, backups, training and incident response. Keeping a short written summary of your controls turns a stressful week of questions into a one-hour task. If you want a recognized way to demonstrate your security, see our guide to CyberSecure Canada certification.
Frequently asked questions
We are a team of six. Is this really necessary?
Yes. Small firms are frequent targets because attackers expect fewer protections, and most of these steps are settings you already pay for in Microsoft 365.
Which Microsoft 365 plan do we need for these controls?
Many are available on all business plans. Device management and advanced protections are included in Business Premium. See Basic vs Standard vs Premium.
Can we let consultants use their own laptops?
It is possible with the right controls, but company-managed devices are much easier to secure. If personal devices are allowed, use app protection and restrict downloads of client files.
How does your firm score?
Book a free IT assessment. We will check your Microsoft 365 security, file sharing and devices against this checklist and give you a prioritized plan.
See how we support consultants and professional firms on our IT services for professional services page, and explore our Microsoft 365 services, cybersecurity and managed IT.
About the author: Naqash Bin Iqbal is an SEO Specialist at Insmart Technology, a Surrey-based managed IT and cybersecurity provider.
