Law firms · Self-assessment · Free
Law Firm Cybersecurity Assessment.
Twenty-four questions across the six domains that decide whether privileged client data stays where it belongs, Client Confidentiality, Identity & M365, Wire Fraud & BEC, Ransomware & DMS Resilience, Incident Response & Compliance, and Third-Party Vendors & Vulnerability. About ten minutes. No email required to see your score.
- References ABA cyber guidance, CIS M365, NIST CSF 2.0, CISA
- Maturity scored Initial → Optimized per domain
- Scoring runs locally in your browser
- Optional written report + roadmap on request
Client Confidentiality & Privileged Data Identity & Microsoft 365 / Email Security Wire Fraud, BEC & Trust Account Protection Ransomware, DMS & eDiscovery Resilience Incident Response & Compliance Readiness Third-Party Vendors & Vulnerability Management
Question 1 of 24 0%
What it covers
Six domains. Twenty-four honest questions.
Built around the threat picture law firms actually face: ransomware on the document management system, BEC and wire fraud rerouting settlement and trust funds, third-party DMS and eDiscovery exposure, and the client outside-counsel guidelines and cyber-insurance applications that expect documented evidence. The score gives partners a place to start the conversation: not the conversation itself.
-
Client Confidentiality & Privileged Data
How privileged communications, matter files, and client NPI are classified, encrypted, and kept inside the controls your engagement letters promise.
-
Identity & Microsoft 365 / Email Security
MFA, Conditional Access, and the Microsoft 365 hardening that protects partner mailboxes, document management, and remote attorneys from account takeover.
-
Wire Fraud, BEC & Trust Account Protection
The Microsoft 365 hardening, payment-verification controls, and trust-account guardrails that close the doors attackers use to reroute settlement, escrow, and IOLTA funds.
-
Ransomware, DMS & eDiscovery Resilience
EDR coverage, immutable backups, and tested restores for the document management system, matter files, time and billing, and eDiscovery platforms a firm cannot operate without.
-
Incident Response & Compliance Readiness
What happens between the alarm and the client / state notification, including state breach-notification timelines, ABA ethics duties, and cyber-insurance readiness.
-
Third-Party Vendors & Vulnerability Management
DMS providers, eDiscovery platforms, co-counsel, and the patching cadence that keeps client questionnaires, and attackers, from finding the gaps first.
-
What does the assessment cover?
Twenty-four questions across six domains: Client Confidentiality & Privileged Data, Identity & Microsoft 365 / Email Security, Wire Fraud / BEC / Trust Account Protection, Ransomware / DMS / eDiscovery Resilience, Incident Response & Compliance Readiness, and Third-Party Vendors & Vulnerability Management. Each answer maps to a maturity level (Initial, Developing, Managed, Optimized) and references ABA cybersecurity guidance, the CIS M365 Benchmark, NIST CSF 2.0, CISA #StopRansomware, and state breach-notification statutes.
-
How long does it take?
About ten minutes. You can stop at any point, your answers are scored locally in the browser and never leave your device until you choose to request a written report.
-
Do I need to give an email address?
No. The assessment runs entirely client-side. If you want a written report and a 30/60/90-day plan from our team, you can request one at the end, but the score itself is yours immediately.
-
Is this a substitute for a formal audit, pen test, or ethics opinion?
No. It is a fast, honest self-check, meant to surface the obvious gaps before a client outside-counsel security questionnaire, a cyber-insurance renewal, or, worst case, a wire-fraud or ransomware event. A formal risk assessment, pen test, or ethics review is a separate engagement.
About this law firm cybersecurity assessment
What this assessment measures, and how law firms use it before a client security questionnaire or cyber-insurance renewal.
This cybersecurity readiness assessment is built around the duty of technological competence in ABA Model Rule 1.1 and the confidentiality obligations in Model Rule 1.6, as interpreted in ABA Formal Opinion 477R on securing client communications and ABA Formal Opinion 483 on a lawyer's obligations after a data breach or cyberattack. The questions also map to the CIS Microsoft 365 Foundations Benchmark most firms run their practice management and email on, NIST CSF 2.0, CISA #StopRansomware guidance, and the state-by-state data breach notification statutes that govern a firm's disclosure obligations after client data is exposed.
Scoring runs locally in your browser, nothing leaves your device unless you explicitly request a written report. The four-tier maturity output (Initial, Developing, Managed, Optimized) is written to translate directly into the language of a client outside-counsel guideline (OCG) questionnaire or a cyber-insurance renewal application, so the result is useful the same day you take the assessment.
How law firm security teams typically use these results
Three common patterns: (1) outside-counsel guideline (OCG) prep, corporate clients, especially financial-services and healthcare clients, now send detailed security questionnaires before engagement; the score identifies gaps before the questionnaire arrives; (2) cyber-insurance renewal, carriers increasingly require MFA, EDR, and immutable backups as a condition of binding coverage for firms handling trust accounts and privileged data; (3) management committee reporting, the domain breakdown gives partners a defensible structure for a firm-wide security update without requiring every partner to become conversant in the underlying technology.
What to do next
Cyberuptive serves law firms from solo practitioners to multi-office regional firms with managed cybersecurity programs built around the confidentiality and competence duties above. Our Microsoft 365 & Azure security service hardens the email, document management, and identity platform most firms already run against the CIS Benchmark referenced above, our Managed Detection and Response stack and 24/7 SOC-as-a-Service produce the continuous-monitoring evidence carriers and clients now expect, and our penetration testing services validate the document management system and client portal before a client's security team asks to see the results themselves.
Related reading: MDR vs MSSP vs SIEM: a 2026 buyer's guide · Top MSSP providers in 2026 · What managed SOC coverage actually costs in 2026.
Sources & further reading
Talk to a real engineer
Want a partner who knows what your clients' security questionnaires actually ask for?
Whether you're shoring up after a phishing scare, fielding a Fortune 500 client security addendum, renewing cyber insurance, or scoping a managed SOC for the firm: we can help.
Further reading
Analysis from the team that runs the SOC.