IT and Cybersecurity for Canadian Law Firms: LSO-Aligned, Privilege-Safe

Yes. Our delivery is aligned to Federation of Law Societies Model Code rule 3.1-2 commentary [4A] and the LSO Technology Practice Management Guideline. We document control evidence (backup restore tests, MFA enforcement reports, EDR coverage, sensitivity-label deployment) in a partner-facing format suitable for practice inspection, insurer questionnaires, and client diligence. Fusion does not provide legal advice. Your firm’s partner-board and risk counsel remain responsible for interpreting the rules. We supply the evidence and the engineering.

Three layers. First, matter-folder access is granted at the SharePoint site or document-library level, not the firm-wide level, and is reviewed quarterly. Second, Microsoft Purview sensitivity labels are applied automatically by content (privileged, confidential, public), with the privileged label restricting external sharing, copy, and print where the firm requires it. Third, conditional access policies block sign-ins from unmanaged devices and from non-Canadian IP ranges by default. Privilege isn’t a single setting. It’s the configuration set you can point to when a court asks how the file was protected.

Yes. We run Clio Manage, Clio Grow, PCLaw and PCLaw|Time Matters, ProLaw, Cosmolex, iManage Work, and NetDocuments across client tenants today. For practice management vendors we don’t touch daily, we treat them like any other line-of-business application: vendor coordination, identity integration, backup of associated data stores, performance monitoring, and inclusion in the disaster recovery plan. We do not require a firm to switch practice management to work with us.

For departures, we follow a documented offboarding runbook: revoke access on the last day, retain the lawyer’s mailbox and OneDrive under litigation hold for the firm’s retention period, capture audit logs of the final ninety days of activity, and provide a signed evidence packet if the firm requires one for a separation matter. For matter close, we work with the firm’s retention policy to apply the right Purview retention label and trigger defensible deletion at the documented horizon. Both runbooks are produced for the firm in writing during onboarding and reviewed at each quarterly business review.

Microsoft Copilot configured inside your firm’s tenant respects sensitivity labels, keeps prompts and grounding data inside the Microsoft 365 boundary, and produces audit logs. With tenant-scoped Copilot, a partner-approved use policy, and verification of AI-generated citations, the LSO and FLSC guidance is satisfiable. Consumer ChatGPT, Claude, and Gemini are a different category: prompts can leave the firm boundary, no audit trail is available to the firm, and confidentiality obligations cannot be enforced. We block consumer chatbots at the network and identity layer on firm-managed devices and supply an internal request path when a specific matter requires a non-Microsoft tool.

For firms on Microsoft 365 Business Premium or higher with the appropriate eDiscovery licensing, we configure Purview eDiscovery (Standard or Premium depending on matter volume), apply legal hold policies that suspend retention deletion on custodian mailboxes and OneDrive sites, and export production sets to the format your litigation counsel requests. For firms that need outside-counsel-grade eDiscovery review, we hand off to Relativity, DISCO, or the firm’s preferred review platform with a documented chain of custody. The Purview legal-hold cost walkthrough linked above shows what this typically runs for a 12-lawyer firm.

Solo practitioners and 2-to-5-lawyer firms are welcome where the practice handles privileged matters that warrant a tenant-scoped Microsoft 365 environment, MFA enforcement, EDR, and a written incident response plan rather than a consumer mailbox. Smaller firms typically land in the $500 to $900 per month range at the solo level and $1,800 to $3,400 per month at three-to-ten lawyers. We are not a fit for solos who want to keep working out of a consumer Outlook.com account: that configuration cannot satisfy the LSO Technology Practice Management Guideline regardless of vendor.

We do not handle trust-account bookkeeping itself. That stays inside your practice management or accounting system under the firm’s controls. We do handle the IT controls that the Law Society spot audit and your external accountant will ask about: who has access to the trust-accounting application, what the access-review log shows, when the last backup restore was verified, and whether the data is held in Canada. We produce that evidence on demand and at each quarterly business review.