Every engagement starts with a client handing over something they would never make public: a merger strategy, a tax return, a litigation file, the floor plan of a secure facility. How your firm protects that information is part of the service, whether or not it appears on the invoice.
Centaris works with law firms, accounting and tax practices, consulting firms, and architecture and engineering firms across Michigan and the Great Lakes. We secure client information across Microsoft 365, the devices your people carry, and the AI tools they are already using. The goal is a firm that can show clients, carriers, and regulators exactly how their data is protected.
Security at a firm is never finished. Staff turn over, clients raise their requirements, and new tools arrive every quarter. We stay engaged as all three change, so your protections never fall a season behind.
Obligations are rising, and threats are getting more targeted, often in the middle of your busiest stretch of the year.
Security questionnaires, outside counsel guidelines, vendor risk reviews, and cyber insurance applications all ask the same thing: prove it. MFA, endpoint protection, tested backups, and an incident response plan have moved from best practice to a condition of doing business.
Retainers, trust account disbursements, tax refunds, closing funds, and project payments all run through the inbox. That makes professional services firms a favorite target for business email compromise, where one convincing message redirects one large payment.
Tax and accounting firms fall under the FTC Safeguards Rule. Lawyers carry a duty of reasonable security under ABA Model Rule 1.6(c). Design firms supporting defense work face CMMC. The rules differ, but each one expects documented, working controls.
Tax season, trial prep, deal closings, and project submittals don't move because a server went down. Every hour your people can't work is an hour that doesn't get billed.
What one outage costs in billable time
Each of these is manageable. What they require is a partner who knows how a firm operates between filing deadlines, trial dates, and project submittals.
Your staff are already experimenting, so the real decision is which tools earn approval and under what rules. Centaris helps you set that policy, prepares Microsoft 365 for Copilot, and applies sensitivity labels that keep privileged and confidential documents protected. We also train your people to increase productivity with AI without feeding client data into public models.
When a client sends a 200-question security questionnaire, you should be able to answer it from documentation you already have. We put the controls, policies, and reporting in place so you can respond faster with accurate, consistent, and defensible information.
Business email compromise rarely needs malware. It needs one inbox, one lookalike domain, and one rushed approval. These controls take those openings away:
Conflicts, ethical walls, and need-to-know access matter in professional services. We configure Microsoft 365 permissions and information barriers so teams see what they need and nothing more. We also make onboarding and offboarding clean, including seasonal staff, who should leave with nothing but their paycheck.
Partners draft from home, staff split time between offices, and consultants work from client sites and airport lounges. Every login is verified, and every device is checked before it touches firm data, so location is no longer a security variable.
Most firms have no reason to staff a security operations team. Centaris provides you with a Michigan-based team of engineers, security specialists, and Microsoft consultants who already know your environment. Hand us the whole IT function, or keep your internal IT staff and let us cover the gaps they cannot reach. You decide where the line sits.
Move your phone system into Teams so calls follow your people from office to home to client site. Teams Rooms make client meetings and hybrid conferences work the first time. It becomes one platform, secured and managed as part of the same environment.
Architecture and engineering firms carry the same confidentiality obligations as every professional services firm, plus pressures that law and accounting offices never face. Your work lives in files measured in gigabytes. Your teams move between offices, job sites, and client locations. And a growing share of your clients are public agencies and defense programs with security requirements written directly into the contract.
Revit models, Civil 3D surfaces, and point clouds don't behave like ordinary documents. Centaris designs storage, collaboration, and backup around how design teams actually work. Multiple offices can share project files without workarounds, and a ransomware event means restoring last night's models instead of rebuilding a project from scratch.
Design firms supporting Department of Defense projects often handle Controlled Unclassified Information in drawings and specifications. Phase 2 of the CMMC rollout, which would have added third-party Level 2 assessments as a condition of award, was suspended in July 2026 while the Department reviews the program. Phase 1 self-assessments are still required, and so is protecting CUI under NIST SP 800-171. We help you draw a boundary around the systems that touch CUI, implement the NIST SP 800-171 controls inside it, and assemble the evidence an assessor will ask for. When a formal assessment is required, it is performed by an accredited third-party organization or the government, not by us.
Floor plans for hospitals, schematics for utilities, and security layouts for plants and public buildings are valuable to the wrong people. We control who can access, share, and download sensitive project data, both within the firm and when it is shared with consultants and contractors.
High-performance workstations, graphics drivers, design software licensing, and field tablets all need to work on day one of a project. We manage the full lifecycle, secure mobile devices on job sites, and keep your designers designing instead of troubleshooting.
Your obligations may come from the ABA, the FTC, the IRS, client contracts, or the Department of Defense. Each one expects reasonable, documented security that holds up when someone asks to see it.
| Obligation | Law firms | Accounting & tax | Consulting | Architecture & engineering |
|---|---|---|---|---|
| ABA Model Rule 1.6(c) | Applies | No | No | No |
| ABA Formal Opinion 512 | Applies | No | No | No |
| FTC Safeguards Rule | No | Applies | No | No |
| IRS | No | Applies | No | No |
| Client contracts | Applies | Applies | Applies | Applies |
| Cyber insurance applications | Applies | Applies | Applies | Applies |
| CMMC (Department of Defense) | No | No | No | In some cases |
Applies Half mark: applies to design firms supporting defense work.
Here is how Centaris gets a firm from uncertain to answerable:
Identify where client data lives, how it moves, and which obligations apply to your firm, from ABA Model Rule 1.6(c) and the FTC Safeguards Rule to client security terms and CMMC.
Measure your current controls against those obligations and rank the gaps by how much client data each one leaves exposed.
Fix what matters most first, with changes scheduled around your deadlines rather than on top of them.
Build the written information security plan, incident response plan, policies, and questionnaire-ready evidence that your clients, carriers, and regulators expect.
Revisit controls, retrain staff, and refresh documentation on a regular cadence, so the next client audit or insurance renewal is a routine exercise.
The outcome is a security program you can explain in plain terms to a managing partner, a client, or an underwriter.
Your reputation depends on confidentiality. We design access, sharing, and AI controls around that reality, not around a generic office template.
Centaris keeps its cybersecurity team on staff. If an incident hits, the engineers responding have seen your environment before, and there is no outside call center in the middle.
Identity, email, documents, Teams, and Copilot are configured and protected as one system, so the licenses you already pay for do more of the security work.
Major changes are scheduled around filing deadlines, trial dates, closings, and project milestones. Your busy season is our planning input, not an inconvenience.
We are not your ethics counsel, your peer reviewer, or your CMMC assessor. We build the environment, documentation, and evidence that people will review, and we bring in outside specialists when an engagement requires them.
of law firms reported having experienced a security breach, and another 19% didn't know whether they had. A firm that can't answer that question can't answer a client's either. Logging, monitoring, and a tested incident response plan turn "we think we're fine" into a real answer.
in business email compromise losses were reported to the FBI in 2025 across 24,768 complaints. That averages roughly $123,000 per complaint, often a single redirected wire, retainer, or project payment. MFA, email authentication, and a verified payment process close most of that gap.
is how long tax and accounting firms covered by the FTC Safeguards Rule have to notify the FTC after discovering a breach of unencrypted information involving 500 or more consumers. The clock starts at discovery, so detection and a working response plan decide how much of that time you actually have.
Firms often reach out to us for the same reasons. A previous MSP handled passwords and printers but called the client security questionnaire "not our area." An outage landed in the middle of tax season. A spoofed email redirected a payment, and the provider wrote it off as user error.
Many firms have lived some version of that. Centaris takes the opposite position: IT operations and security sit with one accountable team that understands professional services, so there is never a question about who owns the problem.
A no-obligation assessment shows your leadership which client data is exposed, which controls are working, and what your clients, carriers, and regulators are likely to ask for next. You get the findings before a questionnaire, renewal, or incident sets the timeline for you.
One conversation. Straight answers. Your decision on what comes next.