The Minimum Cybersecurity Baseline for an Ontario Law Firm (2026)
This article is written for a managing partner or business manager at an Ontario law firm, not for an IT person. If you already know what Conditional Access is you can skim it. If you do not — read it once, and take the checklist at the end to your IT provider.
Why this matters now
Two things about the threat landscape in 2026 are worth being blunt about.
First, the attacker economy has caught up with multi-factor authentication. Off-the-shelf phishing kits — Evilginx, Tycoon 2FA, EvilProxy, others — routinely defeat traditional MFA at Microsoft 365 sign-in by relaying the user's session in real time and stealing the resulting cookie. The user does everything right, approves the prompt on her phone, and the attacker is still signed in as her afterward. This is not theoretical; we have worked through it directly at small professional services firms in the last twelve months.
Second, the cost of an incident has drifted upward. Trust-account fraud, wire redirection against real-estate closings, and mass-mailing of phishing from a compromised partner's account are all incidents we now expect to see at small firms. Cyber-insurance carriers have responded by pushing their questionnaires deeper into the technical detail: an incomplete or dishonest answer during renewal can be treated as material non-disclosure at claim time. And the Law Society of Ontario's technology guidance, while not prescriptive, treats a lawyer's competence in protecting client information as part of their professional obligations.
None of this makes cybersecurity a technology conversation. It makes it a governance conversation that a managing partner has to be able to hold their IT provider to. The rest of this article is that conversation.
The baseline: ten controls
Each of the ten items below has three parts: what it is, why it matters for a law firm, and what "done" looks like so you can verify it.
1. MFA everywhere, phishing-resistant for administrators
What it is: every user account signs in with a second factor. Administrator accounts use a phishing-resistant method — a hardware key, a Windows Hello sign-in bound to the device, or a Microsoft Authenticator passkey — not a code sent by SMS.
Why: MFA blocks the most common credential attacks. Phishing-resistant MFA blocks the modern ones that defeat push notifications and codes.
Done looks like: your Microsoft 365 Conditional Access policies list every user, and administrator accounts show FIDO2 or Windows Hello as their authentication method, not "SMS" or "phone call."
2. Conditional Access with compliant-device enforcement
What it is: sign-ins to Microsoft 365 are only allowed from devices you have enrolled and marked as compliant. Someone with your password, your MFA response, and a stolen session cookie cannot use them from their laptop, because their laptop is not on the list.
Why: this is the single most effective control against modern phishing-kit attacks. It makes stolen credentials worthless off the firm's own devices.
Done looks like: your IT provider can show you the Conditional Access policy in Microsoft Entra ID that requires compliant devices, and every user's laptop and phone are visible in your Intune console as enrolled and healthy.
3. No legacy authentication protocols
What it is: old sign-in methods — Basic Authentication in Exchange, IMAP, POP3, SMTP AUTH — are turned off at the tenant level. Attackers preferentially attempt these because they bypass MFA entirely.
Why: many small firms still have legacy protocols enabled by default from an older setup. Turning them off is free and prevents whole classes of attack.
Done looks like: your IT provider can produce a Microsoft 365 Secure Score report showing legacy authentication is blocked, and no email clients or line-of-business apps still depend on it.
4. Administrator accounts separated from daily accounts
What it is: the people who administer Microsoft 365, your firewall, and your servers have two separate accounts. Their normal work account has no elevated privileges. Their admin account is only used when a change is being made.
Why: if an attacker phishes a partner's email account and that partner also happens to be a global administrator, the attacker becomes an administrator of your tenant. If those roles are split, the phish only gets the mail.
Done looks like: in Microsoft Entra ID, no daily-use account holds Global Administrator, and admin roles are held by named .admin accounts that do not receive email.
5. MDR (managed detection and response) on every endpoint
What it is: every computer in the firm runs an endpoint agent — for us, Sophos MDR — that is monitored 24/7 by a team of analysts. When something suspicious happens, a human investigates and responds, not just software.
Why: most serious incidents at professional services firms are caught at the endpoint or through anomalous sign-in patterns, not at the firewall. Traditional antivirus is not enough on its own, and after-hours coverage matters — attackers know when your IT provider goes home.
Done looks like: every laptop and workstation shows up in the MDR console as protected and reporting. The provider can name the analysts and the SLA for triaging alerts outside business hours.
6. Email security with impersonation protection
What it is: filtering that catches spoofed messages, look-alike sender domains, and attempts to impersonate a partner or the firm's accounting inbox for wire fraud.
Why: the single most expensive attack pattern against Ontario law firms right now is business email compromise directed at real-estate transactions. Impersonation protection is what catches the "the wire instructions have changed" email before it reaches the person who would act on it.
Done looks like: anti-impersonation and DMARC alignment are configured, and you can produce a monthly report of how many impersonation attempts were blocked.
7. Backups that are tested, offline or immutable
What it is: copies of your data — email, files, practice-management database — that live somewhere an attacker who has compromised your Microsoft 365 tenant cannot delete. Ideally a copy that cannot be modified for a defined retention window (immutable), even by an administrator.
Why: ransomware operators now routinely delete or encrypt backups as part of their attack. A backup you have never restored from is not a backup; it is a hope.
Done looks like: your provider does a test restore of a real file every quarter and shows you the report. The offline or immutable copy is documented.
8. A patching cadence you can name
What it is: operating systems, Microsoft 365 apps, browsers, and third-party software (Adobe, Zoom, PDF tools) are updated on a defined schedule — typically within 7–14 days of a security patch being released.
Why: most breaches begin with an unpatched vulnerability that had a fix available. This is boring, unglamorous work that has to happen every month.
Done looks like: your provider can produce a report of the current patch level of every device in the firm, and the last date each was updated.
9. Least-privilege file access
What it is: partners and staff can only access the matter files they need. The junior real-estate assistant cannot browse the litigation matters, and vice versa.
Why: most breaches expose whatever the compromised user had access to. Broad access — "everyone in the firm can read everything" — turns a single compromised account into a firm-wide disclosure.
Done looks like: your document-management system enforces matter-level or department-level access, and the access list is reviewed at least annually.
10. An incident response plan with a phone tree
What it is: a one-page document that says: who calls whom, in what order, when a partner receives a suspicious email, notices unusual sign-in prompts, or finds files that will not open. It names your IT provider, your cyber-insurance carrier, and the LSO practice advisor.
Why: the difference between a 20-minute incident and a 20-hour incident is usually who knew to make which phone call first.
Done looks like: every partner has the phone tree printed and stored somewhere they can find it if their computer is locked. It is reviewed once a year.
A self-assessment checklist
Sit with this list for five minutes and mark each item honestly:
- MFA is enforced on every account, and administrator accounts use FIDO2/passkey or Windows Hello.
- Conditional Access requires a compliant device for Microsoft 365 access.
- Legacy authentication protocols are blocked at the tenant.
- Administrator accounts are separated from daily-use accounts.
- Every endpoint runs an MDR agent monitored 24/7.
- Email security includes impersonation protection and DMARC.
- Backups are tested quarterly and include an offline or immutable copy.
- All devices are patched on a defined cadence within 7–14 days.
- File access follows least-privilege at the matter or department level.
- The firm has a written incident response plan with a phone tree.
If you have fewer than seven of these, you have material work to do. Fewer than four is the risk posture we most commonly see when we are called in after an incident.
What to ask your current IT provider
Send this email to your current IT provider today. Ask them to answer in writing.
- Can you send me the current Microsoft 365 Secure Score and a screenshot of our Conditional Access policies?
- Is compliant-device enforcement required for Microsoft 365 sign-ins from staff laptops? If not, why not?
- Which staff accounts hold administrator roles in our tenant, and are those separated from their daily accounts?
- What MDR platform runs on our endpoints, and what is the after-hours response SLA?
- When did we last successfully test-restore a file from our backups?
- What is our incident response plan, and where is it stored?
If the answers are vague, defensive, or include "we can look into that," you have found the reason to have a broader conversation.
Where ellwood Technology fits
We are a Toronto-area IT and cybersecurity provider that works predominantly with law firms and other professional services firms across the GTA. Our engagements are usually a fixed monthly fee that includes managed IT, Microsoft 365 security, Sophos MDR, and incident response. If you would like to compare notes on any of the ten controls above, or to have us look at your current posture without changing anything else, get in touch through the law firms page or the main contact page.
The point of a baseline is that it is not exceptional. A law firm in 2026 should have all ten of the items above in place, and be able to prove it. Most of the work required to get there is a series of small settings changes, done in a defined sequence, over 30–60 days. It is the kind of work that is much cheaper to do before an incident than after.