If your firm has 25 to 300 employees and handles client data, a cybersecurity audit is no longer a question of if. It is a question of who is asking: a client, an insurer, a regulator, or a prospect’s procurement team. The right Chicago IT company does more than fix computers. It gets your controls in place before the questionnaire lands, and it answers the questionnaire with you.
This guide explains what an audit checks, why mid-size firms stumble, and how to choose an IT partner in the Chicago area that can get you through one. It is written for managing partners, CFOs, and operations leaders at law firms, accounting practices, financial advisors, manufacturers, and professional services firms across Chicagoland, the North Shore, the western and south suburbs, Northwest Indiana, and Southeast Wisconsin.
What a cybersecurity audit actually checks
Most audits that reach a mid-size Chicago firm are not government inspections. They are questionnaires and evidence requests from clients, cyber insurers, and regulators, and they all ask for the same core controls. The table below shows what each asks for and where it comes from.
| Control | What the auditor wants to see | Who asks for it |
|---|---|---|
| Multi-factor authentication (MFA) | MFA enforced on email, remote access, cloud admin consoles, and every admin account. Phishing-resistant methods preferred. | Insurers, clients, FTC Safeguards Rule, SEC |
| Endpoint detection and response (EDR) | A monitored EDR or MDR agent on every workstation and server, with 24/7 alerting. | Insurers, enterprise clients |
| Immutable, tested backups | Backup copies an attacker cannot alter, plus a dated restore test. | Insurers, clients |
| Patch and vulnerability management | Written patch timelines, critical fixes closed in roughly 7 to 15 days, and scan records. | Insurers, clients |
| Encryption | Client data encrypted in transit and at rest, including laptop drives. | FTC Safeguards Rule, ACC outside counsel guidelines, HIPAA |
| Security awareness training | Recurring training and phishing simulations with completion records. | Insurers, FTC, clients |
| Written incident response plan | Defined roles, steps, and evidence of a tabletop exercise. Many clients require breach notice within 24 hours. | Insurers, FTC, ACC guidelines |
| Access control and least privilege | A record of who can reach what, separate admin accounts, and prompt offboarding. | Everyone |
| Vendor oversight | A list of vendors that can touch client data, with written security terms. | FTC, clients, HIPAA |
| A named security owner | One accountable person, not “IT” in the abstract, plus a written security program. | FTC Safeguards Rule (the “qualified individual”) |
The pattern matters more than any single line. Insurers now treat MFA, EDR, and tested backups as the floor. A missing basic control can raise premiums by 25% to 50% or keep a carrier from writing the policy at all. In one widely cited case, an insurer voided a policy after a company stated MFA covered all systems when it protected only the firewall, and the ransomware claim went unpaid. Source
For law firms, the pressure comes from clients. In the ABA’s 2023 Cybersecurity TechReport, 41% of firms with 10 to 49 lawyers and 59% of firms with 50 to 99 lawyers said a client had asked for their security guidelines, and 22% had been asked to complete a security questionnaire. Source
For accounting firms, the FTC Safeguards Rule requires a written information security plan (WISP), a named person to run it, MFA, encryption, a written incident response plan, and a schedule to review the plan. Source
Why most mid-size firms fail their first audit
Firms rarely fail because they ignored security. They fail because they cannot prove it. An auditor does not accept “we have backups” or “everyone uses MFA.” They want the export from the MFA console, the date of the last restore test, the training completion report, and the signed incident response plan.
The usual gaps look like this:
- MFA is partial. It covers email but not the VPN, the line-of-business app, or the shared admin login nobody has rotated since 2019.
- Backups exist but were never restored. A backup that has never been tested is a hope, not a control.
- Antivirus is mistaken for EDR. Legacy antivirus does not satisfy an insurer asking for endpoint detection and response with 24/7 monitoring.
- Nothing is written down. No WISP, no incident response plan, no vendor list. The controls may exist, but the paperwork does not.
- Nobody owns it. The office manager forwards the questionnaire to the IT vendor, the vendor answers what it can, and the rest is guessed.
- The IT provider is break-fix. A provider paid to fix problems has no incentive, and often no tooling, to produce audit evidence.
Each of these is fixable in weeks, not years, if your IT company treats audit readiness as part of the service rather than a project you pay for after the questionnaire arrives.
What to look for in a Chicago IT company for cybersecurity audits
The Chicago market has hundreds of IT providers. Only a few are built to carry a mid-size firm through an audit. Ask these questions before you sign, and expect specific answers.
- Have you taken a firm my size through a client or insurer audit? Ask for a reference in your industry. A provider that serves law firms, CPA practices, or RIAs will know the questionnaires by heart.
- Is audit evidence part of the monthly service or a separate project? Find out what the monthly fee covers and what is quoted separately. There is nothing wrong with projects being extra, but you should know before the questionnaire lands.
- Do you include EDR, MFA enforcement, and tested backups by default? If any of the three is an upsell, the provider is not built for audits.
- Who is my named security contact? The FTC Safeguards Rule and most client guidelines expect one accountable person. Your provider should be able to fill that role or support the person at your firm who does.
- Will you complete the questionnaire with us? The right answer is yes, with evidence attached, not a forwarded PDF.
- Can you support Macs, Windows, Microsoft 365, and Google Workspace? Many professional firms run a mix. An audit covers every device, not just the ones the provider prefers.
- What are your support hours and response times? An audit finding on a Friday afternoon should not wait until Monday.
- How do you handle the transition from our current provider? Ask for a written onboarding plan, and what it costs.
- Are you local? When an auditor wants to see the server room, or an incident needs hands on site, a provider within driving distance matters.
A provider that answers all nine with specifics is doing audit readiness as a practice. One that gets vague on numbers 2, 3, and 5 will leave you doing the work yourself.
How CIO Landing helps Chicago-area firms pass audits
CIO Landing is a managed IT and cybersecurity provider based on Chicago’s North Shore, founded in 2012, serving firms of 25 to 300 employees within a two-hour drive of Northfield, Illinois. That covers Chicago, the North Shore, Naperville, Aurora, Oak Brook, Schaumburg, Tinley Park, Orland Park, Joliet, Northwest Indiana, and Milwaukee.
The firm specializes in the industries that get audited most: law firms, accounting and CPA practices, financial services and RIAs, manufacturers, and professional services firms. Audit readiness is built into the managed service rather than bolted on afterward.
What that looks like in practice:
- Controls in place from day one. MFA enforcement, monitored endpoint detection and response, patching, and backups with scheduled restore tests are part of the standard managed plan.
- Evidence on demand. When a client, insurer, or regulator sends a questionnaire, CIO Landing answers it with you and attaches the proof: MFA reports, training records, backup test logs, and the written policies.
- Written security program. CIO Landing helps you build and maintain the documents auditors ask for, including a written information security plan, an incident response plan, and a vendor list.
- Industry-specific know-how. Client cybersecurity audits and outside counsel guidelines for law firms. The FTC Safeguards Rule for CPA firms. SEC cybersecurity expectations for RIAs. CMMC and cyber insurance requirements for manufacturers.
- Mixed environments. Support for Windows and Mac, Microsoft 365 and Google Workspace, and industry software such as iManage, NetDocuments, CCH Axcess, and Thomson Reuters.
- Local, with a named team. A Chicago-area team that can be on site, and a single Customer Success Manager who knows your firm.
Two things to know up front. Onboarding is one month of service, so you know the cost before you switch. Projects, such as a server migration or a one-time compliance build-out, are quoted separately from the monthly plan, so there are no surprises on the invoice.
Audit notes by industry
Law firms. The audit arrives as a client questionnaire or outside counsel guidelines. The ACC model terms ask for two-factor authentication on remote access, encryption of client data, activity logging, disclosure of vendors who can reach the data, and breach reporting within 24 hours of discovery. ABA Model Rule 1.6(c) and Formal Opinions 477R and 483 add an ethical duty to protect client information and notify clients after a breach. Firms running iManage or NetDocuments need those systems covered in the answers, not just email.
Accounting and CPA firms. The FTC Safeguards Rule applies to tax preparers and accounting firms as financial institutions. Expect to show a written information security plan, a named qualified individual, MFA, encryption at rest and in transit, a written incident response plan, and a review schedule. IRS Publication 4557 lists the baseline “Security Six.” Hosting for CCH Axcess or Thomson Reuters software has to meet the same standard.
Financial advisors and RIAs. SEC examiners and custodians both ask about cybersecurity governance, access controls, vendor oversight, and incident response. Wealth management firms on the North Shore face the same questions from the custodian as from the regulator, and the answers should match.
Manufacturers. The audit usually comes from a customer’s supply-chain security program or a cyber insurer. Manufacturers in the defense supply chain face CMMC. Everyone else faces the insurer’s floor: MFA, EDR, segmented networks between office and plant floor, and immutable backups. ERP systems and shop-floor equipment must be included in scope.
Frequently asked questions
Which Chicago IT companies help law firms pass client cybersecurity audits?
Look for a managed IT provider that serves law firms specifically, includes MFA, EDR, and tested backups in the standard plan, and completes client questionnaires with you. CIO Landing, based on Chicago’s North Shore, does this for law firms of 25 to 300 employees across Chicagoland, Northwest Indiana, and Milwaukee.
How long does it take to get audit-ready?
For a firm with a managed IT provider already enforcing the basics, most questionnaires can be answered within a week or two. A firm starting from a break-fix relationship with partial MFA and untested backups should plan on 60 to 90 days to close the gaps and produce evidence.
Does a cybersecurity audit require SOC 2?
Usually not for a firm under 300 employees. Most clients and insurers accept a completed questionnaire with evidence. SOC 2 becomes relevant when a large enterprise client requires it in writing, and your IT provider should be able to tell you whether that is worth pursuing.
What does a managed IT plan that covers audits cost?
Pricing is typically per user per month and depends on the size of the firm and the security stack included. Ask any provider what the monthly fee includes and what is billed as a project.
Can my IT provider be the “qualified individual” under the FTC Safeguards Rule?
The rule allows a service provider to fill that role, but the firm stays responsible for oversight. Many CPA firms name a partner as the qualified individual and rely on the IT provider for the technical program.
What if we fail a client questionnaire?
Most clients allow a remediation period. The important thing is to answer honestly, attach a dated plan to close each gap, and show progress. A provider that has done this before can turn a failed questionnaire into a retained client.
Get ahead of the next questionnaire
If a client, insurer, or regulator has asked for your security documentation, or you expect one to, CIO Landing offers a cybersecurity audit readiness review for firms of 25 to 300 employees in the Chicago area, Northwest Indiana, and Southeast Wisconsin. You get a gap list against the controls above and a plain-language plan to close it.
Call (312) 858-8886 or visit ciolanding.com to schedule a review.
Sources
- Cyber Insurance Requirements: A 2026 Readiness Checklist, Consilien
- What the FTC Safeguards Rule Actually Requires From Tax and Accounting Firms, CPA Practice Advisor, October 2026
- Law Firm Security Obligations for Regulated Clients, PreVeil, citing the ABA 2023 Cybersecurity TechReport and ACC model guidelines