Law Firm Cyber Insurance: The Controls Carriers Ask About

The renewal packet arrives from your broker with a cyber application attached. Forty or so yes/no questions, a signature line for a partner, and a due date. Someone forwards it to the office manager, who forwards it to whoever handles the computers, and the answers come back as a column of “yes” because that is what gets the policy bound.

That column is the problem. A cyber application is a set of representations about how your firm operates, and a claim is the moment someone checks them. If the application says every account has multi-factor authentication and the forensics report shows the compromised paralegal mailbox did not, you are now arguing about coverage while also notifying clients. We help firms answer these questions truthfully, and more often than not the first pass through the form turns into the firm’s security project list for the year.

Here is what the common questions actually require, in the order they tend to cause trouble.

Multi-factor authentication on email, remote access, and admin accounts

This is the first question on nearly every application now, and carriers mean it literally: every user, every mailbox, every way into the network from outside, and every account with administrative rights. Not “most attorneys.” Not “everyone except the scanner account that sends PDFs.”

The accounts that get skipped are the ones attackers find. Shared mailboxes with a password everyone knows, a former IT vendor’s admin login, the conference room account. Before you check yes, pull the list of accounts without MFA from your Microsoft 365 or Google Workspace admin console and deal with each one. The service accounts that genuinely cannot do MFA get a long random password, a restricted scope, and a note in your records explaining why.

Some applications now ask whether the MFA is phishing-resistant. Text-message codes count as MFA on most forms but not as phishing-resistant. Authenticator apps with number matching, or hardware keys for partners and admins, are the honest yes.

Endpoint detection and response on every device

Carriers stopped accepting “we have antivirus” a few years ago. The question is whether you run endpoint detection and response (EDR), and increasingly whether someone watches it. EDR records what happens on a machine, flags behavior rather than just known files, and lets a responder isolate a laptop from the network remotely.

The word “every” matters again. Attorneys’ home machines that connect to the document management system, the bookkeeper’s laptop, the Mac in the marketing department. If a device touches client data, it needs the agent. If nobody is reviewing the alerts, say so on the form or fix it; an unwatched console at 2 a.m. is how a two-hour incident becomes a two-week one. The monitoring piece is what a security operations center provides.

Backups that are separated from the network and have been restored

Applications ask three things here, and firms usually answer only the first: Do you back up? Are the backups offline, immutable, or otherwise unreachable from a compromised network? When did you last restore from them?

A backup that sits on a server share with the same credentials as everything else is the first thing ransomware encrypts. The honest yes means a copy exists that an attacker with your domain admin password still cannot delete, and that someone has actually restored a matter folder or a mailbox from it recently and written down how long it took. That restore time is also the number your disaster recovery plan should be built around.

Privileged access and shared administrator accounts

Who can make changes to everything, and do they use that account for daily work? Carriers want to see separate admin accounts, used only when needed, with MFA, and a short list of people who hold them. Trim the list, and remove the old IT provider while you are at it.

Email filtering, DMARC, and the lookalike question

Most applications ask whether you filter inbound email for malicious content and whether you have implemented SPF, DKIM, and DMARC on your sending domain. The filtering question is usually a yes with any modern platform. The DMARC question is where firms get caught: many have an SPF record and nothing else, and a DMARC policy of “none” is monitoring, not protection.

For a firm that handles closings or trust funds, this matters beyond the form. Email authentication makes your domain harder to impersonate to your own clients, which is exactly how wire instructions get redirected. Some carriers also ask whether you monitor for lookalike domains registered to mimic yours. That is cheap to do and worth doing regardless of the question.

Patching cadence and end-of-life systems

The questions read something like: Are critical security patches applied within 30 days? Do you run any unsupported operating systems or software? The second one trips up firms with a time-and-billing server that still runs an old version of Windows Server because the vendor never certified the upgrade, or a practice management system two major releases behind.

If you have one of those, do not answer no to the end-of-life question and hope. List it, describe how it is isolated, and put a replacement date on it. Carriers see this constantly, and an honest exception with a plan is treated very differently from a surprise in the forensic report.

A written incident response plan

Not a policy that says you take security seriously. A document that names who declares an incident, who calls the carrier (most policies require notice quickly, and some require you to use the carrier’s approved responders), who calls outside counsel, how you reach staff when email is down, and what you tell clients. ABA Formal Opinion 483 describes the duty to notify clients after a breach involving their information, and Florida’s notification statute runs on a clock. Neither is workable without a plan that already exists.

If you do not have one, the communication plan section of our disaster recovery template is a reasonable starting point. Fill it in before you sign the application, not after.

Security awareness training and phishing simulation

Carriers ask whether staff receive training at least annually and whether you run simulated phishing. The honest yes is a program with a record: dates, who completed it, results. A lunch-and-learn in 2024 does not count. Attorneys are the hardest group to get through training and the most expensive group to have click, so build the schedule around their calendar rather than hoping they fit it in.

Funds-transfer verification

This is the question with the most money behind it. Does your firm verify changes to payment instructions by a second channel before sending funds? For a firm handling real estate closings, settlements, or trust disbursements, the carrier is asking whether a single convincing email can move client money.

The yes that holds up is a written procedure: any new or changed wiring instruction gets confirmed by phone to a number you already had on file, never a number in the email that requested the change, and the confirmation is documented. Then everyone who touches money follows it, including the partner who is in a hurry. Carriers have added separate sublimits and exclusions around social engineering losses precisely because this control is so often missing in practice while present on paper.

When the honest answer is no

Three options, in order of preference.

Fix it before you submit. Most of these controls can be put in place in weeks, not quarters: MFA, EDR deployment, a DMARC policy, a backup restore test, admin account cleanup. If renewal is 60 days out, that is enough time for the items that matter most.

Answer no and explain. Carriers quote firms with gaps every day. The premium may be higher or a specific coverage narrower, and you will likely get a conditional requirement to remediate within a set period. That is a workable outcome. A denied claim is not.

Ask your broker what the carrier weighs most. The questions are not equal. MFA, EDR, backups, and funds-transfer controls move underwriting decisions; some of the others are informational. Spend your remaining time on the ones that matter.

Who should fill out the form

A partner has to sign it, but a partner should not be the one answering technical questions from memory. Have whoever manages your systems complete it with evidence beside each answer: the MFA report, the EDR console showing device count, the backup restore log, the DMARC record, the training completion export. Keep that evidence with the application. If a claim is ever contested, those screenshots are what you want in the file.

Firms that work with us get the questionnaire completed as part of managed IT support for law firms, with the evidence pulled from the systems we already manage. If you are doing it yourself, start the process a quarter before renewal rather than the week of. The form is not the hard part. The controls behind it are, and they are the same controls that keep client data out of a leak site whether or not an underwriter ever asks.