JurisIT
Offshore Operations Risk Review
Findings report: Harbourside Legal
Sample report
Overall rating
Red
3 Red3 Amber1 Green
Headline finding
Six accounts signed in from outside Australia. The firm declared four.
One of the two undeclared accounts belongs to a contractor who left in July. It was still active and last signed in nine days before this review. Client files were reachable from personal laptops, with no record of what left the firm.
Findings register
| Check | Rating | What we found | Obligation touched |
|---|---|---|---|
| Offshore sign-ins | Red | 6 accounts signed in from 3 countries. 2 were not on the firm's list, including a former contractor's account.Source: Entra ID sign-in logs, 30 days | Privacy Act APP 11 (security); Conduct Rules r 9 (confidentiality) |
| Devices | Red | 3 of 4 offshore staff work on unmanaged personal laptops. 214 client documents were downloaded to them.Source: Entra device registry, SharePoint audit log | APP 11; APP 8 (cross-border disclosure) |
| Data controls | Red | No data loss prevention policies. One offshore mailbox auto-forwards all mail to a personal webmail address.Source: Purview policy list, Exchange mailbox rules | APP 11; Notifiable Data Breaches scheme |
| MFA and access rules | Amber | MFA is enforced for all users, but sign-ins are accepted from any country and any device.Source: Conditional Access policies | APP 11; typical cyber insurance proposal questions |
| Consumer AI use | Amber | Offshore accounts reached 2 consumer AI tools, including a free online PDF summariser.Source: Defender for Cloud Apps discovery | Conduct Rules r 9; APP 8 |
| Engagement contract | Amber | Agency agreement has a confidentiality clause. No breach notification, data return or audit rights clauses found.Source: agency agreement supplied by firm | APP 8.1 (reasonable steps); Conduct Rules r 37 (supervision) |
| Admin privileges | Green | No offshore account holds an admin role.Source: Entra role assignments | No action needed |
Recommended next steps
- This week: disable the former contractor's account and remove the external mail forward.
- Within 30 days: move offshore staff onto managed devices or a cloud desktop, and add location and device rules.
- Within 60 days: adopt an Offshore Staffing Policy and add breach notice, data return and audit terms to the agency agreement.
- Ongoing: quarterly access review and attestation pack for insurers and client audits.
Find out where you stand
Start with the free Snapshot
- A short structured questionnaire, about 10 minutes
- Your Snapshot report by email within one business day
- If a Risk Review is warranted, we confirm its scope and fixed fee
- Risk Reviews use read-only access and make no changes
info@jurisit.com.au · jurisit.com.au