Law firms, accountancy practices and financial firms in Ireland need the same IT basics as any business, plus tighter control over client data, email and payments. In practice that means multi-factor authentication everywhere, a strict call-back rule for bank detail changes, tested backups of client files, and a written GDPR processor agreement with your IT provider. ERS IT Solutions started in 1983 supporting the financial services sector and now provides managed IT from Blanchardstown, Dublin 15.
What IT security does a solicitors' or accountancy practice need?
A solicitors' or accountancy practice needs multi-factor authentication on all accounts, up-to-date and supported devices, email filtering, encrypted laptops, tested backups, controlled access to client files, and a payment verification process. Staff training on phishing matters as much as any tool, because so much of a practice's risk arrives by email.
A practical baseline for a small Irish practice:
- MFA on every account, especially email and remote access. The NCSC's Cyber Vitals Checklist asks organisations to check MFA is enabled across the network, particularly for privileged and remote access accounts.
- Leavers removed the same day, and old accounts disabled.
- Least privilege: staff see the matters and clients they work on, not the whole file server.
- Supported software only. No PCs left on Windows 10 without Extended Security Updates.
- Backups of client files and practice systems, tested by restoring them.
- Email security for phishing and spoofed senders.
- Device encryption on laptops that leave the office.
How do law firms and accountants stop invoice and payment fraud?
The most effective control is a call-back rule: any request to change bank details or make an urgent payment is verified by phone using a number you already hold, never one in the email. Ireland's NCSC recommends a strict call-back verification process for any change in bank details, and says a "quick update to bank details" should always trigger a phone call.
This matters most for conveyancing, client account transfers and supplier payments. Pair the call-back rule with MFA on email, alerts for unusual sign-ins, and training so staff know the pattern. The Law Society of Ireland runs a cyber security hub for solicitors with template documents, guidance on triggering professional indemnity insurance after an attack, and alerts about phishing aimed at practices.
What does GDPR mean for a practice's IT provider?
Practices hold sensitive client data, so the IT provider is a data processor if it can access that data. GDPR Article 28 requires a written contract covering confidentiality, security, subcontractors, help with data subject requests and breaches, and the return or deletion of data at the end. Ask for the provider's data processing agreement before signing.
Also ask where the provider's staff are based and which tools they use to access your systems. ERS's engineering team is based in Ireland. Our IT support contract and SLA guide lists the other clauses to check.
IT services for the financial industry in Ireland: what changes under DORA?
Financial entities regulated in the EU must meet the Digital Operational Resilience Act. The Central Bank of Ireland states that DORA has been in application since 17 January 2025, covering ICT risk management, incident reporting, resilience testing and management of risk from ICT third-party providers. Your IT provider is one of those third parties.
For a regulated firm, that means your IT contract needs to support your own DORA obligations: clear service descriptions, security commitments, incident notification, audit access and exit plans. Check with your compliance adviser which DORA requirements apply to your firm's size and type. ERS does not certify DORA compliance. We help clients put the IT controls and documentation in place.
What should a managed IT service for a professional firm include?
For a professional firm, managed IT should include helpdesk for staff, monitoring and patching, Microsoft 365 administration and security, endpoint protection, backup with tested restores, secure remote access, new starter and leaver handling, and regular reporting. Add security monitoring and staff awareness training if you handle client money or sensitive files.
| Need in a practice | What the IT provider does |
|---|---|
| Fee earners working from home and court | Secure remote access, managed laptops, MFA |
| Client files in SharePoint or a document system | Permissions, backup, restore testing |
| Practice management and accounts software | Patching, vendor liaison, user support |
| Payment and conveyancing risk | Email security, sign-in alerts, call-back process support |
| Partners leaving or joining | Same-day account changes, device handover |
| Insurance and regulator questions | Evidence of MFA, backups, patching |
ERS covers these through outsourced IT support, Microsoft 365 monitoring and user awareness training.
Does ERS work with legal and professional services firms?
Yes. Professional services is one of the industries ERS supports. On the software side, ERS built a payment management platform for Legal Administration Solutions, which handles barrister and solicitor accounts across several billing models, legal aid claims and retention tax. It includes duplicate detection, consolidated invoicing, partial payments and reconciliation.
Read the Legal Administration Solutions case study. For managed IT, our PPI case study shows a licensing organisation whose Payment Management System reports went from over 4 hours to minutes after an ERS server project.
Is cloud safe for client files in a law or accountancy practice?
Cloud services such as Microsoft 365 and SharePoint can be safer than an old server in a back office, if they are set up properly: MFA, sensible sharing settings, retention policies and monitoring. The risk is in configuration, not the cloud itself. Ireland's NCSC publishes an Office 365 secure configuration framework for this reason.
ERS moved Communicare from an on-premise file server to SharePoint Online with one site per department and sharing by link instead of email attachments. See the Communicare case study and our cloud migration services.