Permissions and confidentiality audit

Why run this

What this checklist is for

Most firms have a conflicts policy and a matter-site structure. Considerably fewer have tested whether the wall exists anywhere other than in the site.

The most common finding is not a permissions error. It is that search returns a title and a snippet to somebody who cannot open the file, which leaks the existence and subject of a matter.

Run it with

Risk partner or general counsel

And with

SharePoint and Microsoft 365 administrators

And with

A practice group lead as a test subject

The checklist

20 checks, in the order we would run them

Tick only what you can genuinely evidence today. An item you intend to do is not an item you have done, and scoring yourself generously here only produces a comfortable number and an uncomfortable project.

Section 1

Structure and ownership

The foundation everything else depends on.

Every matter site has a named, current ownerOrphaned sites cannot be remediated because nobody can approve a change to them.
Matter site membership is driven from your practice management systemHand-maintained membership drifts, and it drifts silently in the direction of too much access.
Permission inheritance is intact, or breaks are documented and justifiedInheritance broken years ago has been drifting since and nobody remembers why.
Closed matters have restricted or archived accessA closed matter that remains fully accessible is scope in every future discovery exercise.
Site provisioning follows a template rather than being created ad hocAd hoc creation produces inconsistent permissions, which is where exceptions hide.

Section 2

Sharing and external access

Where exposure accumulates fastest.

Anonymous sharing links are disabled or tightly restrictedAn anonymous link to a matter document is a confidentiality breach that requires no attacker.
Organization-wide sharing links on matter content are identified and removedThis is the single most common oversharing pattern and the one most likely to surface in a Copilot query.
Guest access is reviewed against current matter involvementCounsel, experts and clients added for a matter that closed two years ago.
External sharing is restricted by domain where your risk position requires itAllow-listing known counterparty domains is a proportionate control most firms can adopt.
Link expiry is enforced on externally shared contentA link without an expiry outlives the matter, the relationship and occasionally the firm on the other end.

Section 3

Information barriers

Whether the ethical wall is technical or aspirational.

Segments are defined by a dedicated directory attribute, not by DepartmentDepartment reorganises for business reasons and takes your ethical walls with it.
Every user account has that attribute populatedA user with no segment falls outside all policies — effectively on both sides of every wall.
Barriers are applied and the processor has completedCreated is not applied. Confirm the barrier processor finished rather than assuming.
Sensitivity labels protect documents that leave the siteBarriers restrict collaboration inside the tenant. A forwarded document needs protection that travels with it.
A process exists for moving somebody between practice groupsThis is the maintenance question that determines whether the configuration stays correct.

Section 4

The breach test

The section that tells you what you actually have.

Searching as a blocked user does not reveal matter existence or subjectThe result snippet is the leak most firms miss. Test it deliberately.
A direct URL to a matter document is refused for a blocked userTest with a real URL, not a hypothetical one.
A link forwarded by a colleague does not grant unintended accessThe most realistic breach scenario in a professional firm.
Exporting to Excel or downloading does not bypass the intended restrictionAccess controls that apply only in the browser are not access controls.
The findings from the breach test are written down and assignedA test that produces no record produces no remediation.

What your score means

Read this against the number above

These bands are deliberately blunt. The middle band is where most organizations honestly sit, and it is a perfectly reasonable place to proceed from — provided the gaps are written down with owners rather than carried as optimism.

0–59%Significant gaps

Do not proceed yet. More than four in ten items are unaddressed, and the ones that fail here are usually the foundational ones that make everything after them harder.

60–84%Mostly ready, with known gaps

Proceed on a defined scope, with the outstanding items written into the plan as risks with owners and dates. This is the most common honest position.

85–100%Ready

The remaining gaps are small enough to handle during delivery rather than before it. Confirm the unticked items are genuinely minor rather than simply unexamined.

Your score highlights automatically as you tick items above. Nothing is saved, sent or tracked — refreshing the page clears it.

Closing the gaps

If you could not tick these, start here

The four items below are the ones whose absence causes the most trouble downstream. If your unticked items include any of these, they are worth addressing before the rest.

Segments built on Department

Move to a dedicated attribute. This is the change that stops your ethical walls being altered by an unrelated HR restructure.

Search reveals matter existence

This is usually the most serious finding and the least expected. Address indexing and permissions together.

Guest access unreviewed

Run the review this quarter. It is the fastest reduction in exposure available and requires no technical change.

Breach test never run

Spend an hour on it. It is the only way to know whether the wall you designed is the wall you have.

Want a second opinion on your score?

We will run the audit including the deliberate breach test against one practice group, and give you the findings in writing whether or not you take the remediation further with us.

Talk through your result Read the related guides We reply to every message within one business day.

Keep going

Related checklists

intune

legalReadiness

BYOD and personal device audit

Twenty checks on whether client confidences are protected on devices your firm does not own or control.

December 20, 2025 · 20 checksOpen

What this checklist is for

Run it with

And with

And with

20 checks, in the order we would run them

Structure and ownership

Sharing and external access

Information barriers

The breach test

Read this against the number above

If you could not tick these, start here

Segments built on Department

Search reveals matter existence

Guest access unreviewed

Breach test never run

Want a second opinion on your score?

Related checklists

BYOD and personal device audit

Tell us what you're trying to fix

Let’s get started on something great

Phone

Email