Client documents shared without expiry
SharePoint and OneDrive links for closing reports, receipts and contracts often stay open to anyone. Sometimes for years. Nobody knows exactly who can still get in.
A service from LUMRA · For accounting firms
PIANOLA, security for the accounting firm that handles client data every day.
Accounting firms hold some of the most sensitive business data in the country, often without an IT team. PIANOLA shows what needs fixing in your Microsoft 365 environment in plain language and takes care of it for you. You can document your security for auditors, quality reviews and insurers without ever reading a technical manual.
PIANOLA fits accounting firms from solo practice up to 50 staff. No installation needed, the connection runs through Microsoft official APIs.
Industry perspective
Three things we often find in accounting firms
These are not theoretical risks. This is what we see in the first scan of accounting firms in Sweden and the Nordics.
MFA missing on at least one admin account
A firm of five people typically has three administrators. One of them usually has multifactor disabled. That is where an attacker starts.
Mailbox forwarding rules nobody remembers setting up
A former employee, an old IT provider, an automation from a bookkeeping tool. Mail leaves your domain every day, without anyone noticing.
Documentation the accounting industry actually needs
Bookkeeping Act 1999:1078
The Swedish bookkeeping act requires safe archiving of accounting records for seven years. PIANOLA documents that data is not leaking through misconfigured sharing.
GDPR + Data Protection Act
Client data contains personal information. We show that you have the technical safeguards required under article 32, documented and dated.
SRF guidance
The industry body's information security guidance. The PIANOLA report can be attached to quality reviews or audits.
Cyber insurance terms
Insurers require documented security. You get evidence ready to send.
Microsoft 365 in reality
You think you have control. But how do you actually know?
Organisations that have hired IT consultants, ticked off Secure Score recommendations and said "Microsoft handles this" usually believe they're secure. PIANOLA is the extra pair of glasses that shows what's actually going on, continuously and not just at audit time.
A scan is a snapshot. A day later, someone has changed a policy, granted a new app or invited a guest, and the picture is already out of date. Documentation that isn't kept up ages just as fast. Security keeps moving, and PIANOLA keeps the picture alive.
- "We've got MFA on"
- "Microsoft handles cybersecurity"
- "Our IT consultant has it covered"
- "We do an audit once a year"
- MFA is often not even enforced for admins
- Microsoft ships tools, not configuration
- The consultant saw the picture in March, not today
- Drift happens every week, not at audit time
What makes us different
Other tools alert. PIANOLA acts.
Most security tools fill the IT inbox with warnings and leave the investigation to you. That is where security work tends to stall, not at detection, but at everything that follows. PIANOLA closes the loop.
The usual path
The alerts are left to you
- The inbox fills constantly. Warnings from different systems, around the clock.
- Assessment takes time. Someone has to react, even in the middle of the night.
- Investigation is manual. Log digging, correlation, situational analysis, all on your own.
- The team takes the hit. Volume always wins in the end.
The PIANOLA path
Decisions are already made
- PIANOLA acts on its own. Decisions execute automatically, with a 24-hour window to undo.
- We measure continuously. Nine security areas in Microsoft 365, all the time.
- The report arrives in your inbox. A monthly snapshot, not a nightly flood of alerts.
- You get time to think. Security no longer requires someone to keep watch.
The difference between chasing security and owning it.
The status view, in two seconds
A glimpse of what leadership sees in the report. Together, the three panels give a quick read on how the environment is doing. The depth is there when you need it.
Open findings
What needs attention right now
0
Critical
2
High
8
Medium
15
Low
Top actions
What to take on first
1
Restrict external sharing
2
Disable legacy auth protocols
3
Revoke risky app consents
Status by area
Where the focus is right now
Identity and MFA
OK
Email and forwarding
2 to review
Sharing in SharePoint
OK
Apps and OAuth consents
1 priority
Endpoint and Defender
OK
One report, four auditors
The same underlying control data, expressed in the language each framework speaks: NIS2 for regulatory compliance, CIS for technical hardening, NIST for risk governance, and ISO for management systems. Whoever asks, you respond from a single report.
EU · Directive
NIS2
Risk management
Art. 21.2.a
Access control
Art. 21.2.d
MFA and authentication
Art. 21.2.j
+ 7 more points
Art. 21.2
CIS · Technical
CIS Controls v8
Data assets
CIS 3
Accounts and privileges
CIS 5-6
Email and web
CIS 9
+ 5 more domains
CIS 4-17
NIST · Strategy
NIST CSF 2.0
Govern
GV
Identify · Protect
ID · PR
Detect · Respond
DE · RS
Recover
RC
ISO · Management
ISO 27001:2022
Identity management
A.5.16
Access control
A.5.15
Secure config
A.8.9
+ more Annex A
A.8.x
Whether your IT partner, auditor or insurer asks, you respond from the same source. PIANOLA automatically maps 109 security controls on every assessment - no separate investigation needed for each framework.
NIS2 from 2026, your biggest driver right now
The new cybersecurity law raises the bar for your Microsoft 365 environment
The ten areas the directive requires, what PIANOLA handles for you continuously, and what remains the leadership's responsibility. Clear, honest, and straight to the point.
The same underlying data also maps to CIS Controls, NIST CSF and ISO 27001. See the frameworks below.
About the company
LUMRA is the company behind PIANOLA
LUMRA is a Swedish IT security company that builds PIANOLA. We specialise in Microsoft 365 security and serve small and medium-sized Swedish businesses and their IT partners.
Instead of one-off reports that go stale the day they're filed, we keep the conversation flowing year-round between leadership, IT, and your partner. PIANOLA is how we put that into practice: regular reports, a clear status view, and actions the service can apply directly or hand back to you.
- CompanyLUMRA
- ServicePIANOLA
- FocusMicrosoft 365 security
- AudienceSwedish small and medium-sized businesses
- Contacthej@lumrait.se
