Cybersecurity Readiness — Questions 1–5 Q1. Is MFA required for your firm's email, remote access, and important business applications?
Q1. Is MFA consistently enforced across all offices, cloud applications, privileged accounts, and remote access, with exceptions monitored?
Q2. Is employee access promptly removed when someone leaves the firm?
Q2. Does your firm have a standardized process for granting, reviewing, changing, and removing access across systems and offices?
Q3. Are administrator accounts limited to your IT provider or designated personnel?
Q3. Are privileged accounts separated, restricted, monitored, and periodically reviewed across the organization?
Q4. Do all firm-owned computers and servers have centrally managed security protection?
Q4. Is endpoint detection and response consistently deployed and monitored across workstations, servers, and offices?
Q5. Is someone responsible for monitoring your firm's computers, email, and systems for suspicious activity?
Q5. Does your firm centrally monitor and correlate security activity across endpoints, networks, identity systems, email, and cloud platforms?
Cybersecurity Readiness — Questions 6–10 Q6. If a cyberattack begins overnight or on a weekend, will someone receive and investigate the alert?
Q6. Does your firm maintain 24/7 security monitoring with documented escalation, investigation, and response responsibilities?
Q7. Does your firm know who to contact and what to do immediately if a computer or account is compromised?
Q7. Can designated personnel promptly isolate affected systems, disable accounts, coordinate response, and preserve evidence?
Q8. Are your firm's files and critical systems backed up, with copies protected from ransomware?
Q8. Are critical workloads protected by isolated or immutable backups with documented recovery dependencies?
Q9. Has your firm successfully restored important files or systems from backup during the past year?
Q9. Has your firm tested recovery of critical systems and business operations against defined recovery objectives within the past year?
Q10. Are computers, servers, and network equipment regularly updated to address security vulnerabilities?
Q10. Does your firm use a documented, risk-based vulnerability and patch management process across its technology environment?
Cybersecurity Readiness — Questions 11–15 Q11. Does your firm have safeguards to reduce the risk of confidential client information being sent to the wrong person or outside the firm?
Q11. Does your firm classify sensitive information and use controls to monitor or restrict unauthorized data transfers across email, cloud, and other channels?
Q12. Has your firm reviewed the security responsibilities of its primary IT provider and other critical technology vendors?
Q12. Does your firm formally assess and periodically reassess cybersecurity risks associated with critical vendors and outsourced services?
Q13. Does your firm have a written plan identifying whom to contact and what to do during a cybersecurity incident?
Q13. Does your firm maintain and exercise a documented incident response plan covering technical, legal, executive, and external communications?
Q14. Has your firm reviewed its cyber insurance coverage and incident reporting requirements during the past year?
Q14. Has your firm coordinated cyber insurance requirements, notification obligations, and approved response resources with its incident response process?
Q15. Do the firm's owners or managing partners periodically review cybersecurity concerns and planned improvements?
Q15. Does firm leadership regularly review documented cybersecurity risks, assigned ownership, remediation progress, and accepted residual risk?
Cybersecurity Readiness — Questions 16–17 Q16. Does your firm have clear rules about which AI tools attorneys and staff may use for firm business?
Q16. Does your firm maintain a formal process for approving, governing, and monitoring the use of AI tools across the organization?
Q17. Does your firm have safeguards to prevent confidential client information from being entered into unapproved AI tools?
Q17. Does your firm enforce controls to protect confidential client information when attorneys and staff use approved or unapproved AI services?
