Consulting

Define where each engagement's information may be stored, who may access it, and how external collaboration is approved. Include data rooms, analytics environments, presentation tools, email, and local working copies. Apply client-specific restrictions rather than assuming a single firm-wide setting satisfies every agreement.

Librarian can help organize repositories and owners, while Cerberus can support approved information-protection workflows. Review access when staffing changes, and close out sharing at engagement completion. Evidence collection and monitoring should avoid unnecessarily reproducing confidential client material in additional systems.

• Separate client workspaces and restrict cross-engagement access.
• Record retention, return, and deletion commitments during project onboarding.

Assess AI assistants, research platforms, transcription services, and internal analytical applications as systems that may receive sensitive information. Determine how inputs, outputs, prompts, and supporting datasets are retained and who can access them. Include administrator permissions and service integrations in the review.

Spark can support privacy and AI-governance work, while Hunter and Lancer can support explicitly authorized technical assessment. Do not assume a platform is secure because it is internal or because its outputs appear useful. Consultants must review analytical conclusions and citations before including them in client advice.

• Use approved accounts and data sources for client work.
• Test authorization boundaries in internal knowledge and retrieval tools.

An incident may require separate assessments for several engagements, each with different contractual and legal obligations. Maintain a reliable map of affected systems and client ownership so response teams can establish scope without speculative or blanket notifications.

Growler can support evidence handling and Dewey can assist with coordination. Human leadership, counsel, and engagement owners must approve consequential actions and client communications. Exercise a compromised consultant account that reaches several workspaces, then verify whether access can be constrained and records restored without exposing another client's information.

• Keep verified client incident contacts outside affected systems.
• Review travel, remote access, and personal-channel impersonation risks with staff.