Information Governance
Annual AML/CFT reporting is also a records and access check.
Practical technology checks before DIA's 31 August 2026 annual reporting date for portal access, Microsoft 365 evidence, delegates, supplier records, and retention.
Insights
Practical insights for firms where trust matters
Cybersecurity, Microsoft 365 governance, privacy, resilience, and safe AI guidance for New Zealand professional services leaders.
Information Governance
When guidance changes, your records workflow needs to keep up.
Practical technology checks after DIA's 17 August 2026 AML/CFT guidance update summary for document ownership, Microsoft 365 access, supplier portals, and evidence records.
Device Security
A lost USB stick is a technology governance issue, not just a one-off mistake.
Practical checks after OPC's lost USB decision note for removable media, Microsoft 365 workarounds, encryption, staff awareness, and incident readiness.
Safe AI
AI in advice workflows needs governance before it needs enthusiasm.
Practical checks after the FMA's AI in financial advice review for approved tools, Microsoft 365 access, human review, supplier controls, and records.
Supplier Security
Supplier security is part of client information governance.
Practical checks for third-party access, Microsoft 365 integrations, assurance evidence, incident reporting, and personal information handling.
Fraud Readiness
Caller ID is not a control. Verification needs a workflow.
Practical checks after current NZ impersonation alerts for unexpected calls, payment changes, remote-access requests, Microsoft 365 controls, and first-hour scam response.
Website Governance
Your website is part of your security perimeter, even when a supplier manages it.
Practical checks for WordPress updates, supplier access, backups, forms, logs, and first-hour incident response.
Microsoft 365 Governance
SharePoint Server exposure is a governance question, not just a patching task.
Practical checks for server ownership, internet exposure, patch evidence, logs, backups, supplier records, and Microsoft 365 continuity.
Cybersecurity
Remote access appliances should not be invisible.
Practical checks for appliance ownership, vendor patching, logs, backups, supplier evidence, and Microsoft 365 continuity.
Network Security
Router hygiene is quiet work. That is why it is easy to miss.
Practical checks for router ownership, firmware, management access, monitoring, backups, and Microsoft 365 continuity.
Information Governance
Identity verification is not just a form. It is a technology records workflow.
Practical checks for identity evidence, supplier portals, Microsoft 365 access, audit records, and safe AI use.
Account Security
Exposed account details are a practical business risk, not just a personal inconvenience.
What to check across password reuse, MFA, Microsoft 365 sign-ins, mailbox rules, and sensitive folder access.
Fraud Readiness
Fraud and deepfake risk is now a practical technology question.
Practical checks for verification, Microsoft 365 mailbox controls, access permissions, complaints capture, and safe AI use.
Information Governance
When a regulator changes, check the systems that carry the work.
What the 1 July 2026 consumer credit transfer to the FMA can prompt firms to check in Microsoft 365, mailboxes, records, and access.
Privacy Technology
Biometric systems need a technology check before they become a privacy problem.
Practical checks for biometric access, identity, visitor, and verification systems before the 3 August 2026 transition date.
Technology Risk
Operational resilience is not just a banking issue. It is a practical technology question.
What RBNZ's June 2026 material can teach professional services firms about critical systems, suppliers, Microsoft 365, and recovery.
Cybersecurity
Frontier AI is changing cyber risk. The practical work still starts with the basics.
What NCSC's June 2026 updates mean for MFA, access control, patching, monitoring, recovery, and safe AI governance.
Safe AI
Can our staff use AI safely?
Clear rules for approved tools, client confidentiality, human review, and Microsoft 365 access in New Zealand professional services firms.
Microsoft 365 Governance
Are our client files exposed?
How to check SharePoint, Teams, guest users, old links, and broad permissions before quiet access gaps become client-confidence issues.
Device Security
What should happen if a laptop is lost?
A first-hour response guide for device encryption, remote wipe, account protection, privacy assessment, and client-risk checks.
Senior IT Support
What should our IT provider be doing that a normal helpdesk misses?
What senior technology support should cover beyond tickets: governance, Microsoft 365 reviews, backup testing, security, and planning.
Cybersecurity
If something went wrong today, would your firm know what to do first?
Practical cybersecurity guidance for New Zealand professional services firms across Microsoft 365, devices, privacy breach response, and first-hour incident readiness.
Safe AI
AI is already inside your firm. The question is whether it is governed.
How New Zealand professional services firms can use AI more safely, with practical rules for confidentiality, Microsoft 365 access, and staff guidance.