Law firms are trusted with some of the most sensitive information there is: litigation strategy, merger details, family matters, financial records, and personal histories. When a firm chooses a cybersecurity provider, it's deciding who will help protect all of it.
The challenge is that many providers sound the same in a sales meeting. Everyone mentions firewalls, antivirus, and "24/7 monitoring." The right questions help you see past the buzzwords.
Here are the questions we recommend law firms ask, grouped by topic, along with what a strong answer looks like.
Understanding Legal Practice
"Which other law firms or professional practices do you support?"
Look for: Experience with firms of similar size and practice areas. Providers familiar with legal work understand practice management systems, document management, court e-filing, and the pressure of filing deadlines.
"How do you handle our confidentiality obligations?"
Look for: Clear policies about which technicians can access firm systems, how access is logged, and a willingness to sign confidentiality agreements. A good provider understands that their staff may encounter privileged material.
Protection and Prevention
"How will you protect our email from business email compromise?"
Look for: Specific controls such as multifactor authentication, email filtering, domain protection (SPF, DKIM, DMARC), and alerts for suspicious mailbox rules. Wire fraud targeting law firms is common enough that this answer should be detailed.
"What's your approach to protecting laptops and remote work?"
Look for: Endpoint protection, encryption on laptops, secure remote access, and the ability to remotely lock or erase a lost device.
"How do you train our attorneys and staff?"
Look for: Short, regular training and phishing simulations, not just a single annual video. Ask how they handle partners who are too busy for training.
Detection and Response
"What happens when you detect something suspicious at 2 a.m.?"
Look for: A clear explanation of who monitors alerts, how quickly they act, and when they contact the firm. Vague promises of "24/7 coverage" deserve follow-up questions.
"Will you help us during a breach, and how does that work with our cyber insurance?"
Look for: Understanding that insurers often require their own approved forensic firms and breach counsel. A good provider coordinates with them rather than competing.
Backup and Recovery
"How would we recover from ransomware?"
Look for: Backups that are protected from ransomware, regular restore testing, and realistic recovery timeframes for your document management and practice management systems.
"When did you last test a full restore for a client like us?"
Look for: A specific answer. Backups that have never been tested are a hope, not a plan.
Service and Accountability
"What does your service agreement commit to?"
Look for: Clear response times, defined escalation paths, and plain language about what's included. Our guide on what to look for in a managed IT SLA explains common red flags.
"How will you report to firm leadership?"
Look for: Regular reviews with partners or the firm administrator covering security status, open risks, and recommended improvements. Quarterly conversations, like those in six questions smart companies ask every quarter, keep everyone aligned.
"What happens if we decide to leave?"
Look for: A clear offboarding process that returns documentation, passwords, and administrative access without delay. Providers who make leaving difficult often make staying difficult too.
Questions to Ask Yourself
Before choosing, firm leaders should also consider:
- Did the provider explain things in plain language?
- Did they ask about our practice, or only talk about their tools?
- Would our staff feel comfortable calling them?
- Can they help us answer client security questionnaires?
Choosing With Confidence
The right cybersecurity provider becomes a long-term partner in protecting your clients and your firm's reputation. Take the time to ask detailed questions and expect detailed answers.
Maise Technology provides cybersecurity services for professional practices, including law firms throughout Utah. We're happy to answer every question on this list. Schedule A 15 Minute Discovery Call to start the conversation.
