The SST Insider – August 2026

FROM THE HELM

In July, we started Q3 with access: who can open a file and whether your firm could prove it if a client or regulator asked. In August, we moved to the question firm leadership asks first. What does it cost when something goes wrong?

The recovery invoice is the smallest expense. The main cost is unbilled billable hours. When matters slow down, filing deadlines tighten, and partners who should be on client files spend the week on incident calls. That time is never recovered and rarely appears in any subsequent accounting.

Restored systems are not the same as restored confidence. Clients ask sharper questions about how their information is handled and who else can see it. Insurers ask harder questions at renewal, and what a firm can document matters more than what it can assert.

Compliance strain follows the same pattern. Obligations that felt manageable become urgent, usually when the people who understand them best are tied up in recovery. Firms in that position buy tools under pressure, and those purchases rarely fit the practice once the incident is over.

None of this shows up in a recovery estimate, which is why breach cost belongs in a leadership conversation rather than an IT one. Firms that set their recovery priorities in advance absorb an incident at a fraction of the cost of those that decide in the moment. Which systems come back first, who speaks to clients and when, and what gets documented while it is happening are business decisions, and they are far cheaper to make on a quiet afternoon than during an outage.

In August, we also published a leadership guide, The Cost of a Breach in a Law Firm: Downtime, Exposure, and Response, along with a companion piece on the business cost of a breach. Unscripted with SST Episode 21 brought in an outside expert to discuss what better security actually requires in a legal practice and where common assumptions break down. All three are available now. This issue’s client success story comes from outside the legal sector, but the lesson holds: the organizations that absorb an incident at the lowest cost are the ones that defined their technology standard on a quiet afternoon, long before anyone needed it.

If your firm has never quantified a week of downtime, run that exercise before you need it. Even a rough figure can change your next security decision.

— SST Leadership

CLIENT SUCCESS STORY

From Ad Hoc Assignment to a Documented Technology Standard

THE CHALLENGE

A 140-person Midwest nonprofit had grown without a formal framework defining the hardware, software, and access levels each role or department required. Technology assignments varied by hire, manager preference, or historical exception rather than a defined standard, and systems were configured and maintained inconsistently across the environment.

IT had no clear baseline to measure whether a device or account was properly configured, and onboarding and offboarding decisions were made case by case rather than through a repeatable process. Small inconsistencies accumulated into uneven patching, uneven access levels, orphaned accounts, and blind spots that routine monitoring alone couldn’t detect, leaving leadership unable to answer basic questions about what technology exists and who has access to what.

THE RESPONSE

SST worked with the client to establish a documented technology standard grounded in the CIS Critical Security Controls (v8.1) rather than an internally invented set of rules. The standard had three components:

• Role-based technology tiers defining, by job role or department, which hardware, software, and access levels were appropriate, so provisioning decisions became consistent and defensible rather than ad hoc (CIS Controls 5 and 6)
• A standardized device and configuration baseline applied across managed systems, giving IT a clear reference for what normal looks like and making deviations easier to spot (CIS Controls 1, 2, and 4)
• Documented onboarding and offboarding procedures tied to HR events, closing the gap where access changes were previously handled informally (CIS Controls 5 and 6)

THE OUTCOME

System configuration variance decreased, making patch management and monitoring more consistent across the environment. Onboarding and offboarding became faster and more predictable, closing the window during which access was previously delayed or improperly retained.

Leadership gained visibility into the technology across the organization and how it aligns with the defined standard. Because that standard maps to a recognized framework, the client now has a defensible reference point for demonstrating due diligence to auditors, cyber insurers, or business partners.

— Operations Manager

PROACTIVE INSIGHTS

6 Questions Firm Leadership Should Be Able to Answer Before an Incident

01 — The Cost of Downtime

Do you know what a week without your document management and billing systems would cost in unbilled time and delayed matters? A two-day outage routinely creates weeks of backlog, and court deadlines do not pause while systems are offline.

02 — Scope and Certainty

If systems came back online tomorrow, could you tell clients what was accessed and what was not? Restored systems do not automatically restore confidence, and uncertainty slows decision-making long after the outage ends.

03 — Client Communication

Who speaks to clients after an incident, and what do they say in the first 24 hours? Clients judge the response as much as the incident itself, and inconsistent communication erodes trust faster than disruption does.

04 — Backup Validation

Have you tested a restore recently, or do you only assume the backup will work? Validated backup and restore capability is one of the clearest markers distinguishing a structured program from a reactive one.

05 — Vendor and Privileged Access

Do you know which vendors and privileged accounts can access firm data, and when you last reviewed that list? Documented vendor access and a regular review cadence are among the first things insurers and clients request to see.

06 — Leadership Cadence

Does leadership have a recurring security review, or does security surface only when something breaks? A documented program before an incident is a material advantage for coverage and client due diligence conversations.

The SST takeaway: the useful question is not what recovery would cost, but how stable the firm would remain under pressure. That stability is a function of preparation, not luck.

SST NEWS & EVENTS

Is Your IT Strategy Aligned with Your Growth Goals?

Discover hidden risk, inefficiency, and opportunity in your technology environment.

Schedule a Complimentary Technology Assessment with our AI assistant → CLICK HERE