The SST Insider – September 2026

FROM THE HELM

As we close out Q3, we are also wrapping up a three-month campaign focused on the legal industry.

Throughout the quarter, the conversation focused on a simple idea: strong cybersecurity depends on clarity. Firms need to know who has access, where gaps exist, which controls are in place, and whether leadership has sufficient visibility to make informed decisions.

What became clear over the quarter is that these are not exclusively legal-industry challenges.

Every professional services organization relies on technology to keep work moving, safeguard sensitive information, and meet client expectations. The details may vary by industry, but the need for consistency, accountability, and preparation remains constant.

That is where we are headed next. In Q4, our marketing focus shifts to accounting firms, with a new campaign built around one question: Ready for Busy Season?

For accounting firms, the months leading into January are a critical preparation window. October is the time to establish a clear baseline. November is the time to address the most critical gaps. December is when you verify that systems, access, backups, and support processes are ready before workloads increase.

The goal is not to introduce more technology for its own sake. It is to help firms understand where they stand, prioritize what needs attention, and enter the busy season with fewer unknowns.

October also marks Cybersecurity Awareness Month. This year, CISA is supporting the month with “Securing the Next 250,” while the National Cybersecurity Alliance is leading with “Don’t Make It Easy for Them.” Both themes reinforce an important point: meaningful cybersecurity progress comes from consistent actions, clear standards, and making it harder for preventable weaknesses to become real problems.

That message fits naturally with where we are headed in Q4.

For law firms, the past quarter was about building greater visibility and control.

For accounting firms, the next quarter is about applying that same discipline to prepare for the busiest part of the year.

— SST Leadership

OPERATIONS CORNER

Access Controls Are Not a Data Protection Plan

Many businesses have invested in securing user accounts with strong passwords, multifactor authentication, and role-based access. That work matters, but it answers only one question: who can get in. It does not answer what sensitive data exists, where it lives, or how much of it a single compromised account can reach.

WHAT THIS MEANS FOR YOU

If you cannot say with confidence where your most sensitive information is stored, you cannot fully protect it. In a breach, that uncertainty becomes expensive. It slows the investigation, complicates notification decisions, and makes it harder to answer the questions your insurer, regulators, and customers will ask.

WHAT A DATA PROTECTION STANDARD DEFINES

• Where sensitive data lives: an inventory across servers, cloud storage, email, and devices.
• How data is classified: a simple scheme, such as Public, Internal, and Confidential, with clear handling rules for each.
• Who can reach it: access to Confidential data limited to the roles that need it.
• How long it is kept: retention rules and secure disposal, so outdated data stops adding risk.
• How it is protected on devices: consistent encryption, so a lost laptop does not become a data breach.

These elements align with CIS Critical Security Controls, Control 3, Data Protection.

CUSTOMER TIPS

• Ask your team where your most sensitive customer and employee data is stored today. If the answer is unclear, start there.
• Review who has access to shared folders holding sensitive information, and remove access that is no longer needed.
• Treat “keep everything forever” as a risk, not a safety net. Define how long each type of record should be retained.
• Confirm that every company laptop is encrypted.

HOW SST CAN HELP

SST helps organizations build data protection standards on top of strong account practices, including data inventory, classification, access review, retention planning, and device encryption, all aligned to the CIS Critical Security Controls. Reach out to your SST contact to start defining the standard for your data.

— Operations Manager

PROACTIVE INSIGHTS

5 Signs Your IT Environment Is Creating More Risk Than Leadership Can See

No Clear Technology Standard

Can you define what a properly configured user, device, network, and system looks like? Without a documented standard, inconsistencies become normal and the environment gets harder to manage and secure.

Technology Decisions Are Made One at a Time

Are purchases evaluated as part of a strategy or approved as needs arise? One-off decisions solve today’s problem but create long-term complexity. A disciplined strategy weighs the impact on security, support, productivity, and growth.

Leadership Only Hears About IT When Something Breaks

Does technology reach the leadership agenda only during an outage, security concern, or major purchase? Reactive conversations offer little visibility. Leadership should regularly see current risks, progress, upcoming decisions, and business impact.

Nobody Can Explain What Is Out of Alignment

Can your team identify where the environment falls short of your standards? Knowing the gaps lets you prioritize by business impact instead of urgency.

The Technology Roadmap Starts With Projects

Does your IT plan begin with hardware and software projects or with business outcomes? Growth, resilience, security, productivity, and risk reduction should decide what gets funded and when.

The SST takeaway: Proactive IT management is not about eliminating every problem. It is about giving leadership the visibility, structure, and consistency to make better decisions before problems become disruptions.

SST NEWS & EVENTS

Is Your IT Strategy Aligned with Your Growth Goals?

Discover hidden risk, inefficiency, and opportunity in your technology environment.