You manage a small firm in a regulated industry — law, healthcare, finance, accounting. A client questionnaire has a section on encryption you are not sure how to answer. A vendor wants your security policy in writing. Your state bar or a federal agency just published new cybersecurity guidance. None of that came with instructions.
This article covers the minimum compliance controls a small US firm must have, what each one costs in time and effort, and how much of it Microsoft 365 Business Premium already handles.
Small firms in regulated industries need a defined compliance floor — not an enterprise security program. Most of that floor is already included in Microsoft 365 Business Premium. The remaining gaps require process and documentation, not additional budget.
Why compliance frameworks mislead small firms
HIPAA, NIST CSF, SOC 2, and most state privacy frameworks were written for organizations with dedicated security teams. Applied literally to a six-person firm, they produce paralysis, not protection. The practical answer is to identify the controls that actually reduce your risk and satisfy regulators, then table the rest until your firm grows into it.
The checklist below is that answer. Each item carries an effort rating: Low (a setting or a one-time click), Medium (an hour to an afternoon), or Ongoing (a recurring habit).
The baseline checklist
Identity and access
- Multi-factor authentication on every account. Effort: Low. Enable it with a single policy in the Microsoft 365 admin center. No exceptions for owners or senior staff — attackers specifically target high-permission accounts.
- Block legacy authentication protocols. Effort: Low. A conditional access policy in Azure Active Directory closes this gap. Legacy protocols can bypass MFA entirely, which makes this step non-optional.
- Least-privilege access. Effort: Medium. Staff should access only what their job requires. Review your admin roles — most people do not need global admin, and that designation should be limited to one or two accounts at most.
Devices
- Endpoint protection on every work device. Effort: Medium (initial setup). Microsoft Defender for Business, included in Business Premium, provides antivirus, endpoint detection, and response across Windows, Mac, iOS, and Android.
- Device management policy. Effort: Medium. Microsoft Intune, also included, lets you enforce disk encryption, screen lock, and remote wipe on every device that touches client data. Enroll every device — including personal phones used for work email.
Email and data
- Email filtering. Effort: Low. Microsoft Defender for Office 365 Plan 1, included in Business Premium, blocks phishing attempts, malware attachments, and sender impersonation before they reach inboxes.
- Encryption at rest and in transit. Effort: Low. Business Premium encrypts data stored in OneDrive, SharePoint, and Exchange by default. Verify that no administrator has disabled these settings.
- Sensitivity labels on confidential files. Effort: Medium. Azure Information Protection Plan 1 is included in Business Premium. Apply labels to client files, financial records, and anything covered by HIPAA or attorney-client privilege. Labels travel with the file, not just the folder.
Backup and recovery
- Offsite backup. Effort: Medium (setup), Ongoing (verification). Microsoft 365 retention policies are not a backup. A separate backup solution — one that stores versioned copies of your data outside Microsoft's environment — is required. This is the one item on this checklist that Business Premium does not cover, and the one most commonly missing from small firm environments.
Policies and agreements
- Written information security policy. Effort: Medium. One to two pages. Who can access client data, how devices are managed, what happens if something goes wrong. Most regulators ask to see this. Write it once, update it annually.
- Incident response plan. Effort: Medium. A short document: who you call, what you preserve, and who notifies clients or regulators. State breach notification laws impose deadlines, so this plan must exist before you need it.
- Business associate agreements or data processing agreements. Effort: Low to Medium. If you handle protected health information, every vendor that touches that data needs a signed BAA. Microsoft provides a BAA for Business Premium accounts. Audit your other vendors.