Cyber Insurance Requirements for Law Firms

Cyber insurance applications for law firms have become longer and more technical. Insurers want to know which security controls are in place before they offer coverage or renew a policy. Every carrier is different, but the same controls appear on most applications.

Why insurers ask law firms so many questions

Law firms hold confidential client information, financial data and wire instructions, which makes them attractive targets for ransomware and email fraud. Insurers have learned which controls reduce claims, and they increasingly require them as a condition of coverage.

Security controls insurers commonly ask about

• Multi-factor authentication (MFA) for email, remote access and administrator accounts.
• Endpoint detection and response (EDR) or managed antivirus on every computer and server, ideally monitored.
• Backups that are kept separate from your network, protected from deletion, and regularly tested by restoring data.
• Email security that filters phishing and malicious attachments, plus a process to verify payment and wire instructions.
• Patching of operating systems and software on a regular schedule, and replacement of systems that no longer get security updates.
• Security awareness training for attorneys and staff, often with simulated phishing tests.
• Limited administrator access, so everyday accounts cannot change system settings.
• An incident response plan that explains who to call and what to do if something happens.

How to prepare your cyber insurance application

• Start early. Some controls, such as MFA or new backups, take time to roll out across a firm.
• Ask your IT provider to confirm each technical answer and show where each control is in place.
• Keep written security policies that match what you actually do.
• Track exceptions, such as an older system that cannot use MFA, and plan how to fix them.
• Review the questions again at every renewal, because requirements change.

Documentation that helps at renewal time

A written IT assessment and current security policies make renewals faster and help you answer client security questionnaires too. Our IT consulting for law firms includes written assessments and policies, and our cybersecurity services for law firms put the controls insurers ask for in place and keep them running.