StudioSicuro® · Firm security review
Independent advisory for professional firms. Nothing to buy, no system to replace, no conflict of interest.
The moment
A corporate client or a bank sends you a vendor security assessment. It asks for evidence, not reassurance, and no one in the firm can answer with authority.
The cyber policy comes up for renewal at a higher price, or is declined. The proposal form asks about controls no one has ever verified in writing.
A nearby firm is down for days after ransomware, in the middle of tax or court deadlines. The question turns concrete: if it happened to us, could we show what we had done?
What you receive
The Studio Security Review ends with three documents. Two are for you and your IT provider; the third answers whoever asks you to account for your security, and does so under the responsibility of the person who signs it.
The central item
Ready, defensible answers to client and insurer questionnaires, signed by the consultant as an assumption of professional responsibility. It records the verified state of affairs, even when that is uncomfortable: that is what makes it defensible.
For the firm owner, in plain language and no jargon. What is protected, what is not, and what actually matters.
Operational instructions for the firm's IT provider, in order of risk, with the criteria to verify each item is closed.
What I don't do
I don't touch your systems. I verify whoever does.
Your IT provider is not replaced: they receive clear instructions and their work is verified. It is oversight, not competition.
How it works
A first call to understand the firm, the clients asking questions and the deadline in front of you.
We gather the evidence where it lives: systems, providers, procedures. On site, without stopping the firm's work.
Report, remediation plan and response sheet, delivered within 15 working days of the on-site work.
A meeting with the owner to read the findings, the priorities and the answers to give clients and insurers together.
Prices
| Firm profile | Workstations | Price |
|---|---|---|
| Small firm | Up to 8 | €2,400 + VAT |
| Mid-size firm | 9-15 | €3,600 + VAT |
| Larger firm | 16-30 | €4,800 + VAT |
| Additional office | Extra office | €600 + VAT |
All inclusive. Invoiced 50% at the start and 50% on delivery. No extra costs within the covered provinces.
Workstation: any desktop, laptop or server that accesses the firm's data, regardless of headcount.
Covered provinces: Como, Lecco, Varese, Monza-Brianza and Milan.
After the review
Some firms are done after the review; others prefer oversight that doesn't stop at the first pass. Ongoing oversight keeps the firm's security current, answers the questionnaires that arrive through the year and verifies the IT provider's work. You pay when you receive the record, not up front.
Discuss ongoing oversight| Firm profile | Workstations | Per quarter |
|---|---|---|
| Small firm | Up to 8 | €1,170 + VAT |
| Mid-size firm | 9-15 | €1,470 + VAT |
| Larger firm | 16-30 | €1,770 + VAT |
Annual contract · invoiced quarterly on delivery of the record · 60 days' notice
Who signs
Simone Nogara
More than 14 years of enterprise security. Every task is carried out personally: no juniors, no subcontracting. The signature on the documents is the same person who did the review.
Signing the documents is an assumption of professional responsibility, backed by professional indemnity insurance with a €5,000,000 limit. Your IT provider cannot sign for what they sell; an independent consultant can.
Frequently asked
Before booking, firm owners almost always ask the same things: whether the service is really needed when there is already an IT technician, what changes for the IT provider, how much it weighs on the firm's day-to-day. Here are the most common answers, put plainly and without jargon. If your question is not among them, bring it to the first conversation: half an hour, no commitment.
Book the reviewYes, because they do two different things. Your technician runs the systems; I verify, independently, that they are protected and put it in writing under my own responsibility. The review gives your technician clear instructions and gives you a signed document to show clients and insurers.
No. I don't touch your systems and I don't resell services. The provider stays yours: they receive a remediation plan in order of risk and their work is verified. It is oversight, not competition.
A workstation is any desktop, laptop or server that accesses the firm's data, regardless of headcount. The price depends on workstations, not people: two professionals with five devices count as five workstations.
The on-site work is at most two half-days. The documents arrive within 15 working days. I work around your commitments: there is no need to stop the firm or switch systems off.
They go into the remediation plan, in order of priority, with the criteria to verify each is closed. The response sheet states the real position and refers to the plan: never window-dressing. That honesty is exactly what makes it useful in front of clients and insurers.
The consultant who signs. Signing is an assumption of professional responsibility, backed by professional indemnity insurance with a €5,000,000 limit. That is why your IT provider cannot sign for what they sell, while an independent consultant can.
Typical situations
Illustrative scenarios: they do not describe specific clients, but the situations a request usually starts from and what the review produces in each.
Client questionnaire
An accounting firm receives a security questionnaire from a banking client that asks for evidence, not statements. The practice software cannot answer for the firm and the technician is unwilling to sign. The review establishes the real state of the controls in writing: the signed response sheet is the document to attach to the reply.
Cyber policy
At cyber policy renewal, the proposal form asks for controls no one has ever verified in writing, and no one at the firm can say for certain what is actually in place. The review separates what is already present from what is missing and gives the IT provider a remediation plan in order of risk. The insurer's questions can then be answered against the facts, not good intentions.
Oversight
The IT provider reassures the firm verbally, never with verifiable evidence, and the owner has no way to know whether it is true. The review does not replace the provider: it gives them clear instructions in order of risk and verifies the work. What is already in place is recognised; what is missing is assigned in writing, with the criterion for proving it is closed.
Multiple sites
A firm with a secondary office takes for granted a backup no one has ever tried to restore: two offices, one copy, no test. The review covers both sites and the report explains to the owner, in plain language, where the risk actually lies and in what order to address it. The remediation plan goes to the provider; the response sheet stays with the firm.
Access
A colleague left the firm months ago, but their accounts and access to the practice software are still active and no one has noticed. The review lists access and responsibilities, the remediation plan gives the IT provider a verifiable revocation procedure, and closure is recorded in the response sheet.
Responsibility
An institutional client asks a notarial firm not only what has been done, but who is personally accountable for it. An internal self-declaration is not enough: it needs a document signed by the person who carried out the review. The consultant's signature gives the answer that weight, because it commits an identifiable person.
The first step
A 30-minute conversation, no commitment, to see whether the service fits your firm.
Book the reviewYou can choose which cookies to allow. Essential cookies are always active and cannot be disabled.
Newsletter
Insights on cybersecurity, NIS2/CRA and due diligence — only when there’s something worth reading.