Industries · Professional services · Canada and USA

Cybersecurity for accounting, engineering, consulting and design firms.

Client data on laptops, deliverables in the cloud, and a security questionnaire before every engagement. Sophos sized for firms in Canada and the United States.

In plain terms: Professional firms hold other companies' confidential data, which makes them a way into their clients. The buying decision is often forced by a client questionnaire or an insurer. The right stack answers those questions with evidence rather than promises.

Get a quote for your professional network Size a firewall in 30 seconds Call 1-833-283-7373

Sophos Silver Partner. Offices in Markham, Ontario and Dallas, Texas. Quotes in CAD and USD, shipping to Canada and the United States.

The page in 30 seconds

Three questions every professional services owner asks. Tap a card to jump to the detail.

1The problem

You are the client's third party
Invoice and payroll fraud
Ransomware at the deadline

See the top risks →

2The rules

SOC 2
PIPEDA
Law 25

See what they ask for →

3The fix

Sophos or TrendAI for protection and 24/7 response
N-able Cove or Axcient for backup you can restore
1Password for strong, unique passwords

See the feature match →

1. The problem: your top 4 risks, the rule behind each, and what fixes it

Each row shows what can go wrong, which rule or standard expects you to control it, and the products that do. The tags under each risk show where Sophos or TrendAI name the same risk on their own industry pages or in their research.

1You are the client's third party

Your access to client systems and data makes your firm the way into theirs.

48% of breaches involved a third party (all industries). Source

Rules and standards

SOC 2 CC6.1ISO 27001 A.5.15

What fixes it

Sophos Workspace Protection (ZTNA)Sophos ITDR 1Password Business

2Invoice and payroll fraud

Accounting and payroll mailboxes are hijacked to redirect payments.

62% of breaches involved the human element (all industries). Source

Rules and standards

SOC 2 CC6.1ISO 27001 A.5.14 information transfer

What fixes it

Sophos Email TrendAI Email Security Sophos ITDR

3Ransomware at the deadline

Attacks land at filing and delivery dates, when downtime costs the most.

42% of business and professional services victims paid the ransom. Source

Rules and standards

SOC 2 CC7.3 to CC7.5SOC 2 A1.2 backup and recovery

What fixes it

Sophos MDR Sophos Endpoint N-able Cove backup

4Proof for clients and auditors

Client questionnaires and SOC 2 auditors want logs, MFA reports and tested restores.

Rules and standards

SOC 2 CC7.2ISO 27001 A.8.15 logging

What fixes it

Sophos Next-Gen SIEM Sophos Managed Risk TrendAI CREM

Orange links are Sophos, 1Password, N-able and Axcient products; blue links are TrendAI. A product supports the control; meeting a rule also takes your own policies and records.

The risk in numbers

What breach and ransomware research says about this sector. Every figure links to its source.

62%

of breaches involved the human element (all industries)

Verizon 2026 Data Breach Investigations Report

48%

of breaches involved a third party (all industries)

Verizon 2026 Data Breach Investigations Report

48%

of breaches involved ransomware (all industries)

Verizon 2026 Data Breach Investigations Report

31%

of breaches began with an exploited vulnerability (all industries)

Verizon 2026 Data Breach Investigations Report

Figures are the all-industry 2026 DBIR baselines. Professional firms are the third party in many of the third-party breaches the DBIR counts.

If ransomware hits a professional services firm

Most common way in50%Malicious email and phishingtogether the most common way in (26% and 24%)

56%of attacks encrypted data

16%of attacks both encrypted and stole data

48%of organizations with encrypted data paid the ransom

55%recovered within a week

What it costs$769Kmedian ransom paid

And then$1.7Maverage cost to recover, ransom not included

42%of business and professional services victims paid the ransom. Source

Sophos does not publish a separate professional services report. These are its 2026 all-industry figures (2,158 IT and security leaders, 17 countries), plus its figure for business and professional services. Source: Sophos

How an attack unfolds here, and where Sophos stops it

The same four stages appear in nearly every breach. Each stage below shows what it looks like in this sector and the control that breaks the chain.

1Entry

What happensPhished login or a stolen laptop

What stops itSophos Email Plus; ITDR; disk encryption and device control

2Foothold

What happensA consultant's laptop

What stops itSophos Endpoint stops exploits and ransomware behavior

3Spread

What happensToward file shares and client portals

What stops itZTNA per application; firewall segmentation at the office

4Impact

What happensClient data theft; payment fraud

What stops itMDR Plus responds 24/7; Next-Gen SIEM keeps the evidence; Cove restores

What you have to comply with

The rules and expectations that shape a security purchase in this sector, in both countries. Status is as of September 2026; check the linked source before relying on a date.

Where	Rule or expectation	What it asks for
Both	SOC 2 Trust Services Criteria	Clients increasingly require a SOC 2 report. Security criteria include access control, monitoring, incident response and change management, all of which need tooling and logs. Source
Canada	PIPEDA and Quebec Law 25	Breach reporting to the commissioner and affected individuals; Law 25 requires a privacy officer and privacy impact assessments for Quebec firms. Source
United States	State breach notification and data security laws	All states require notification; several require a written security program for firms holding personal data. Source
Both	Professional body guidance	CPA bodies, engineering regulators and design associations publish confidentiality and technology expectations for members. Source

2. The rules, in plain English

What the rules above ask you to do, in everyday words. Three dates and numbers to know first, then the requirements that come up again and again.

Type IISOC 2

a SOC 2 Type II report shows controls worked over a period, commonly 3 to 12 months, not just on one day

Source

24months

keep a record of every privacy breach in Canada (PIPEDA)

Source

PromptlyLaw 25

notify Quebec's privacy commission and affected people of a confidentiality incident with a risk of serious injury

Source

1Lock every login with a second step

A password alone is not enough. Staff, admins and anyone working remotely confirm each sign-in with a phone app or key.

SOC 2 (auditors expect)Insurers

Covered by: Sophos ITDR finds who is missing it; 1Password; Sophos Workspace Protection

2Stop malware and ransomware on every computer

Every laptop, desktop and server runs protection that blocks and rolls back ransomware.

SOC 2

Covered by: Sophos Endpoint and Endpoint for Server; MDR watches it 24/7

3Keep a record of who did what

Systems log sign-ins and changes, and the logs are kept long enough to investigate.

SOC 2

Covered by: Sophos Next-Gen SIEM, Sophos XDR

4Have a plan, and report on time

A written plan for a breach, people to carry it out, and notices sent to regulators and customers within the deadline.

SOC 2PIPEDALaw 25

Covered by: Sophos MDR Plus responds 24/7 and documents the incident

5Back up, and prove you can restore

Copies of your data that an attacker cannot delete, and a restore you have actually tested.

SOC 2 (availability)Insurers

Covered by: N-able Cove, Axcient x360Recover and x360Cloud

6Check your vendors

Suppliers with access to your systems or data are vetted, and their access is limited and removed when no longer needed.

SOC 2

Covered by: Sophos Workspace Protection limits vendor access; ITDR finds stale accounts

7Teach staff to spot scams

Regular training so people recognize phishing, fake invoices and impersonation.

SOC 2Insurers

Covered by: Sophos Email catches most lures; a staff training program covers the rest

The tags show which rule or buyer asks for each item. Insurers, investors and large customers often ask for the same controls even where no law requires them.

Not sure which of these you already cover?Send us what you run today. A Nuformat specialist marks each requirement as covered, partly covered or missing, at no charge.

Get a free gap check Call 1-833-283-7373

Feature match: what you need, and who covers it

Each row is one job your security has to do, in plain words. Pick one product per row from the vendor you prefer: Sophos and TrendAI cover most rows; N-able Cove or Axcient cover backup; 1Password covers passwords. The last column shows the professional services rule each row helps with.

How the pieces fit together

Govern

Set the rules

Decide who is responsible, which rules apply and what is allowed.

Sophos AI Defense

Identify

Know your weak spots

List what you have and find the gaps before attackers do.

Sophos Managed Risk

Protect

Keep attackers out

Firewall, email and device protection, safe logins and remote access.

Sophos FirewallSophos EndpointSophos Endpoint for ServerSophos EmailSophos ITDR1Password BusinessSophos Workspace ProtectionAxcient x360SyncSophos Mobile

Detect

Spot what gets through

Watch accounts, networks and logs for signs of an attack.

Sophos NDRSophos ITDRSophos Next-Gen SIEM

Respond

Stop it fast

Contain an attack fast, work out what happened, and tell the people who need to know.

Sophos MDR

Recover

Get back to work

Backups you have tested, so you can restore instead of paying.

N-able Cove M365Axcient x360CloudN-able CoveAxcient x360Recover

The six steps are the functions of the NIST Cybersecurity Framework 2.0. TrendAI equivalents appear in the table below. Source

What you need	Sophos	TrendAI	Backup: N-able Cove or Axcient	1Password	Helps meet
Block attacks at your internet connectionChecks traffic coming in and going out and blocks attacks. A firewall also keeps parts of the network apart; TrendAI Network Security is intrusion prevention that works alongside a firewall. Protect	Sophos Firewall (XGS)	TrendAI Network Security (intrusion prevention, used alongside a firewall)	–	–	SOC 2 CC6.6 and CC6.7; ISO 27001 A.8.20
Stop ransomware and malware on computers and serversProtection on each laptop, PC and server that blocks malicious software and stops files being encrypted. Protect	Sophos Endpoint Sophos Endpoint for Server	TrendAI Endpoint Security	–	–	SOC 2 CC6.8 malicious software; ISO 27001 A.8.7
Stop phishing and fake-invoice emailsChecks email before it reaches staff and blocks phishing links, malware and impersonation. Protect	Sophos Email	TrendAI Email and Collaboration Security	–	–	SOC 2 CC6.8; ISO 27001 A.8.7
Experts watching for attacks around the clockA security team monitors your systems 24/7 and acts on attacks, including nights and weekends. Detect and Respond	Sophos MDR	TrendAI MDR	–	–	SOC 2 CC7.3-CC7.5 incident response; ISO 27001 A.5.24-A.5.26
Protect logins and passwordsSpots stolen or risky accounts and missing multi-factor authentication, and gives every person a unique, strong password. Protect and Detect	Sophos ITDR	TrendAI Identity Security	–	1Password Business	SOC 2 CC6.1-CC6.3; ISO 27001 A.5.15-A.5.18; SOC 2 CC6.1
Watch devices that cannot run security softwareWatches network traffic to spot attacks on cameras, scanners, medical or plant equipment and other devices with no protection of their own. Detect	Sophos NDR	TrendAI XDR for Networks (NDR)	–	–	SOC 2 CC7.2; ISO 27001 A.8.16
Safe remote access for staff and vendorsLets people reach only the applications they need from home or on the road, instead of the whole network. Protect	Sophos Workspace Protection (ZTNA)	TrendAI ZTSA Private Access	–	–	SOC 2 CC6.1 and CC6.6; ISO 27001 A.8.5
Find and fix weak spots before attackers doFinds exposed systems and missing patches, and ranks what to fix first. Identify	Sophos Managed Risk	TrendAI Cyber Risk Exposure Management	–	–	SOC 2 CC7.1; ISO 27001 A.8.8
Keep logs as proof for auditors and insurersCollects and keeps security records, so you can show what happened and when. Protect and Detect	Sophos Next-Gen SIEM	TrendAI Agentic SIEM	–	–	SOC 2 CC7.2; ISO 27001 A.8.15 logging
Back up Microsoft 365 or Google WorkspaceKeeps a separate copy of email and cloud files, so a deleted mailbox or an attack does not mean lost data. Protect and Recover	–	–	N-able Cove for Microsoft 365 Axcient x360Cloud	–	SOC 2 A1.2 backup and recovery; ISO 27001 A.8.13
Back up servers and PCs, and restore fastBacks up whole machines so you can restore files or entire systems after ransomware or a hardware failure. Protect and Recover	–	–	N-able Cove for PCs, Macs and servers Axcient x360Recover	–	SOC 2 A1.2 and A1.3 recovery testing; ISO 27001 A.5.30
Share files with clients and partners securelyControlled file sharing with permissions, instead of email attachments or personal cloud drives. Protect	–	–	Axcient x360Sync	–	SOC 2 C1.1 confidentiality; ISO 27001 A.5.14
Control the AI tools staff useShows which AI tools people use and keeps sensitive data out of the ones you have not approved. Govern and Protect	Sophos AI Defense	TrendAI ZTSA AI Service Access	–	–	ISO/IEC 42001 AI management; NIST AI RMF
Manage, lock and wipe phones and tabletsKeeps company phones and tablets set up securely, and locks or wipes them if they are lost. Protect	Sophos Mobile	TrendAI Mobile Security protects phones from malicious apps but does not manage, lock or wipe them.	–	–	SOC 2 CC6.7; ISO 27001 A.8.1

A dash means that vendor does not sell a product for that row through Nuformat. A product supports the control; meeting a rule also takes your own policies and records.

Want this priced for your sites?Pick a column or mix them. Tell us your sites, users and servers, and we quote Sophos and TrendAI side by side in CAD or USD within two to three business days.

Quote my feature match Call 1-833-283-7373

Every Sophos product line, mapped to professional services (17 lines)

All 17 Sophos product lines Nuformat sells, what each one does in this sector, and the standard or framework control it supports. This is a high-level map: products supply the technical safeguards, and compliance still depends on your policies, people and evidence.

Sophos product line	Use in professional services	Helps meet
Sophos Firewall (XGS)Protect	Office perimeter and encrypted links between offices.	SOC 2 CC6.6 and CC6.7; ISO 27001 A.8.20
Sophos Virtual FirewallProtect	Protects client and project systems hosted in the cloud.	SOC 2 CC6.6; ISO 27001 A.8.20
Webserver Protection add-onProtect	Protects client portals and file exchange sites.	SOC 2 CC6.6; ISO 27001 A.8.26
Sophos SwitchProtect	Separates staff, guest and lab networks.	ISO 27001 A.8.22 segregation of networks
Sophos AP6 wirelessProtect	Staff and client Wi-Fi kept apart.	ISO 27001 A.8.22
Sophos EndpointProtect	Protects consultant laptops on client sites and at home.	SOC 2 CC6.8 malicious software; ISO 27001 A.8.7
Sophos Endpoint for ServerProtect	Protects file, accounting and project servers.	SOC 2 CC6.8; ISO 27001 A.8.7
Sophos XDRDetect	Investigation across devices, email and firewall.	SOC 2 CC7.2 monitoring; ISO 27001 A.8.16
Sophos MDR and MDR PlusRespond	24/7 monitoring and response with incident records for auditors.	SOC 2 CC7.3-CC7.5 incident response; ISO 27001 A.5.24-A.5.26
Sophos ITDRDetect, Respond	Access reviews and MFA coverage reports for the audit.	SOC 2 CC6.1-CC6.3; ISO 27001 A.5.15-A.5.18
Sophos NDRDetect	Detects unknown devices and lateral movement.	SOC 2 CC7.2; ISO 27001 A.8.16
Sophos EmailProtect	Stops invoice fraud and client impersonation.	SOC 2 CC6.8; ISO 27001 A.8.7
Sophos Next-Gen SIEMDetect	Log retention and reports that become SOC 2 evidence.	SOC 2 CC7.2; ISO 27001 A.8.15 logging
Sophos Managed RiskIdentify	Scheduled vulnerability findings and risk trends.	SOC 2 CC7.1; ISO 27001 A.8.8
Sophos Workspace Protection (ZTNA)Protect	Per-application access for remote staff and subcontractors.	SOC 2 CC6.1 and CC6.6; ISO 27001 A.8.5
Sophos MobileProtect	Encrypts and manages phones that hold client data.	SOC 2 CC6.7; ISO 27001 A.8.1
Sophos AI Defense Quote on requestGovern, Protect	Policy and data controls for AI tools used on client work.	ISO/IEC 42001 AI management; NIST AI RMF

Show all 17 product lines

Section and control numbers point to the requirement a product helps with. Your auditor or assessor decides whether the control is met. Nuformat maps a specific questionnaire or assessment to these products on request.

Cyber insurance: what it pays for and what insurers check

Cyber insurance pays for the cost of an attack or a data breach. Before quoting, insurers check a short list of security controls; missing ones raise the premium, cut the limit, or end the conversation.

Your own costs

Incident response and forensic investigators
Restoring data and rebuilding systems
Lost income while the business is down
Ransom or extortion demands, where the policy and law allow
Breach notices, call centers and credit monitoring
Funds lost to fake invoices or wire fraud (often a small sublimit, sometimes excluded)

Claims against you

Lawsuits from customers or partners whose data was exposed
Regulatory investigations, and fines where the law allows them to be insured
Card brand assessments after a payment breach (on some policies)
Liability for spreading malware to others

Policies differ. Read the exclusions, waiting period and sublimits, especially for ransomware and social engineering fraud.

The 12 controls insurers look for

MFA for remote and privileged (admin) accessSophos ITDR shows gaps; 1Password; Workspace Protection

Email filtering and web securitySophos Email; Sophos Firewall web filtering

Secured, encrypted and tested backupsN-able Cove; Axcient x360Recover and x360Cloud

Privileged access managementSophos ITDR flags admin accounts; 1Password vaults admin credentials

Endpoint detection and response (EDR)Sophos Endpoint with XDR, or MDR

Patch and vulnerability managementSophos Managed Risk; TrendAI CREM

Incident response planSophos MDR Plus includes incident response

Security awareness training and phishing testsA staff training program; Sophos Email cuts the volume

Remote desktop (RDP) lockdown and hardeningSophos Firewall; Workspace Protection replaces exposed RDP

Logging and monitoringSophos Next-Gen SIEM; MDR

Replace or protect end-of-life systemsFirewall segmentation; Sophos NDR watches what cannot be patched

Supply chain and vendor riskWorkspace Protection limits vendor access; ITDR removes stale accounts

The list follows Marsh's twelve key cyber controls. Source

Answer the application accurately. In 2022 an Illinois manufacturer's application said it required MFA for email and remote network access. After a ransomware attack, the insurer said MFA was only on the firewall and asked a court to cancel the policy. On August 26, 2022 the court entered judgment rescinding the policy, with the company's agreement, leaving it without coverage. Source

Where insurers dig deeper: Accounting, engineering and consulting firms are asked about MFA on email, invoice and payment fraud controls, and how client data is backed up.

Renewing or applying for cyber insurance?We map your current setup to the twelve controls before you fill in the application, so the answers are accurate and the gaps are known.

Get an insurance readiness review Call 1-833-283-7373

A worked example: a 60-person accounting firm

A firm with two offices, 60 staff, Microsoft 365 and a cloud practice-management platform would typically run:

Where	What runs there
Two offices	XGS 128 and XGS 118 with Xstream, SD-WAN between them
Every laptop	Sophos Endpoint, disk encryption, MDR Plus
Identities and mailboxes	ITDR, Sophos Email Plus, 1Password Business, MFA everywhere
Client and home access	Sophos ZTNA, per application
Evidence	Next-Gen SIEM for SOC 2 and questionnaires; Cove backup with a tested restore

Licenses are sold in 1, 2 or 3-year terms or month to month through Nuformat. Hardware is bought outright or as Hardware as a Service. Every quote states the currency.

Get this sized and quoted for your organization

Send us your site list, user count and any questionnaire you have been given. A Nuformat specialist maps the products to it and returns a quote within two to three business days.

Request a quote Use the firewall sizer Call 1-833-283-7373

Available in Canada and the USA. Sophos Silver Partner.

Frequently asked questions

Which cybersecurity rules and frameworks apply to professional services?

The main ones on this page are listed by country. In Both: SOC 2 Trust Services Criteria, Professional body guidance. In Canada: PIPEDA and Quebec Law 25. In the United States: State breach notification and data security laws. Many organizations also organize the work with the voluntary NIST Cybersecurity Framework 2.0 and its six functions: govern, identify, protect, detect, respond and recover. Check the linked sources for current status and dates.

Which products cover the main cybersecurity needs for professional services?

Sophos covers the firewall, endpoint, email, identity, network detection and 24/7 managed detection and response, and TrendAI Vision One offers an alternative for most of the same needs, except the firewall itself. Neither Sophos nor TrendAI sells backup or a password manager through Nuformat, so N-able Cove or Axcient handle backup and recovery, and 1Password Business handles passwords. The feature match table on this page lists each need with the product from each vendor.

Will Sophos help us pass a SOC 2 audit?

SOC 2 is about the firm's controls and evidence. Sophos supplies the tooling for several criteria: endpoint and email protection, MDR monitoring and response, ITDR access reports and SIEM logs. The auditor still needs your policies and procedures; Nuformat can map the products to the criteria.

What do client security questionnaires usually ask for?

MFA on email and remote access, endpoint detection and response, 24/7 monitoring, email protection, encrypted laptops, tested backups and an incident response plan. The Sophos stack on this page covers each of those with a report you can attach.

How do we protect laptops that never touch the office?

Sophos Endpoint with disk encryption enforced, ZTNA for application access, and MDR Plus watching every device wherever it is. The office firewall is secondary for a mobile workforce.

How do we stop invoice and payroll fraud?

Sophos Email Plus blocks impersonation and look-alike domains, MFA stops stolen passwords, and a call-back rule for payment changes covers the rest.

Do you serve firms in both countries?

Yes. Nuformat is a Sophos Silver Partner with offices in Ontario and Texas, quoting in CAD and USD.

Will Sophos help us get or renew cyber insurance?

It covers much of what insurers ask about: MFA visibility, EDR, email security, logging and 24/7 response through MDR. Backups come from N-able Cove or Axcient. Insurers decide coverage and price, so answer the application accurately; Nuformat can map your current controls to the questionnaire before you submit it.

Sources

Get a quote Call