This is a control-by-control readiness kit for Canadian law firms facing a cyber insurance application or renewal. It maps every question an underwriter is likely to ask to a specific security control, tells you what "yes" actually requires, and lists the evidence you should keep on file to survive a claims investigation. Work through it before you apply, not after.
Law firms are priority targets. The Canadian Anti-Fraud Centre reported over $58M in losses to spear phishing in 2023, much of it through business email compromise targeting professional services. The American Bar Association's 2024 survey found that 71% of law firms reported a cyber incident in the prior year. NetDiligence reports that 23% of all cyber claims involve business email compromise — and law firms, with their routine wire transfers and privileged communications, are disproportionately affected.
What's in this kit
- 15-control readiness checklist in three tiers — baseline eligibility, submission strengtheners, and claims-survival — with underwriter questions, what "yes" requires, and evidence to keep
- Trust account and wire fraud prevention addendum: verbal call-back verification, dual authorization, first-hour funds-recall sequence
- Law society compliance crosswalk: how each control maps to LSBC, LSO, and LSUC technology competence requirements
- Incident readiness one-pager, plus T-90/60/30 renewal checklist and six broker questions
Why insurers look harder at law firms
Law firms hold exactly what attackers want: client matter files, personal data subject to provincial and federal privacy law, trust funds, and the reputation that keeps clients coming back. A breach at a law firm doesn't just cost money — it triggers professional duty, law society notification, and in many cases, client notification obligations that can dwarf the IT remediation cost.
The threat surface is specific. Trust wire transfers are the highest-value single transaction in most firms' daily operations, and they're the target of choice for business email compromise attackers. Matter files encrypted by ransomware can halt billable work for weeks. Opposing party email chains are easy to spoof because they involve parties outside the firm's domain. And many firms still run legacy practice management software — PC Law, Amicus, Unity — on underpatched servers that underwriters now flag on sight.
When a law firm applies for cyber insurance, underwriters ask about MFA on all accounts, endpoint detection and response, immutable or offline backups, patch management cadence, and payment verification procedures. They're not asking to tick boxes. They're asking because the answers determine whether the firm is likely to file a claim — and whether that claim will be payable.
"The key rule: every 'yes' on your application must be true on the day you sign it and on the day you file a claim."
Baseline Eligibility Controls
These five controls are table stakes. If any one of them is missing or unverifiable, most cyber insurers will decline the application or quote a premium that makes coverage uneconomic. Get these in place before you apply.
1. Multi-Factor Authentication on All Accounts
Why it matters: Law firm email accounts are the primary entry point for BEC attacks targeting trust wire transfers. A compromised mailbox lets an attacker monitor matter correspondence, insert fake wiring instructions, and delete sent messages to cover their tracks. MFA stops the overwhelming majority of credential-based attacks dead.
What "yes" requires: MFA enforced on 100% of accounts — not just lawyers, but assistants, accounting, and any shared or service accounts. Conditional access policies blocking logins from unsupported locations. Legacy authentication protocols (IMAP, POP, SMTP AUTH) disabled. Admin accounts require phishing-resistant MFA (hardware key or authenticator app, not SMS).
Evidence to keep: Screenshots of Microsoft 365 (or Google Workspace) conditional access policies showing MFA enrollment status for all users. Export of authentication methods report. Documentation of any exceptions with business justification and compensating controls.
2. Endpoint Detection and Response (EDR)
Why it matters: Antivirus alone doesn't catch fileless malware, living-off-the-land attacks, or ransomware that uses legitimate administrative tools. EDR provides behavioral detection, automated isolation, and forensic evidence — all of which reduce incident severity and demonstrate to insurers that the firm is actively monitoring its endpoints.
What "yes" requires: EDR agent installed on every endpoint and server, including any remaining on-premises infrastructure. Solution must provide behavioral detection, automated response (not just alerting), and centralized logging. Microsoft Defender for Endpoint, CrowdStrike, or SentinelOne are commonly accepted. Coverage must include personal devices used for firm work under BYOD policies.
Evidence to keep: Console screenshot showing all devices enrolled and actively reporting. Alert summary report from the past 90 days. Policy export showing automated isolation on threat detection.
3. Immutable or Offline Backups with Tested Restores
Why it matters: Ransomware targeting law firms doesn't just encrypt files — it seeks out and destroys backups. If your backups are on the same network as your production data, they're not backups. Immutable storage (cannot be altered or deleted, even by an admin) or offline backups are the difference between a quick recovery and a ransom negotiation.
What "yes" requires: Backup solution with immutability (e.g., Azure Blob immutable storage, Veeam hardened repository) or offline rotation (tape, disconnected external drives). Backups must cover all critical systems: file shares, practice management databases, email, and trust accounting systems. A documented restore test within the last 6 months, with results retained.
Evidence to keep: Backup configuration report showing immutability or offline rotation settings. Restore test report with date, systems tested, data restored, and success confirmation. Screenshots of backup job history showing successful completion.
4. Email Security and Anti-Phishing Controls
Why it matters: Email is the delivery mechanism for the majority of law firm breaches. BEC attackers exploit missing or misconfigured email authentication (DMARC, SPF, DKIM) to spoof domains. Inbox forwarding rules set up by attackers can exfiltrate sensitive matter correspondence for months without detection.
What "yes" requires: SPF, DKIM, and DMARC records published in DNS with DMARC at enforcement mode (reject or quarantine). Microsoft Defender for Office 365 or equivalent providing safe links, safe attachments, and anti-phishing policies. Automated scanning for and alerting on suspicious inbox forwarding rules. Outbound spam filtering configured.
Evidence to keep: DMARC report showing enforcement policy. Email security policy export from Microsoft 365 or Google Workspace. Screenshot of safe links and safe attachments policies. Log of forwarding rule audit results from the past quarter.
5. Patch Management and Vulnerability Scanning
Why it matters: Underwriters know that law firms running PC Law, Amicus, or Unity on legacy Windows Server installations are sitting on unpatched vulnerabilities. Routine scanning and a documented patching cadence demonstrate that the firm is actively managing its attack surface — not waiting for an auditor or insurer to find the gaps.
What "yes" requires: Documented patching SLA (e.g., critical patches within 7 days, important within 30 days). Automated patch deployment via Intune, WSUS, or equivalent. Vulnerability scanning at least quarterly on all external and internal IP ranges. Remediation tracking for identified vulnerabilities.
Evidence to keep: Patch management policy document. Vulnerability scan reports from the past two quarters with remediation status. Screenshots of patch deployment dashboard showing compliance rates.
Submission Strengtheners
These five controls won't necessarily get you declined if missing, but they materially improve your submission. They signal to underwriters that the firm treats security as an ongoing practice, not a renewal checkbox. Strong submissions get better terms, higher sublimits, and fewer exclusions.
6. Privileged Access Management
Why it matters: Law firms typically have too many people with too much access. IT admins, managing partners, and accounting staff often hold standing admin privileges that aren't needed for day-to-day work. Privileged access management limits exposure by granting admin rights only when needed and recording what's done with them.
What "yes" requires: Privileged Identity Management (PIM) or equivalent enabling just-in-time admin access. Role-based access control (RBAC) mapped to job functions, not individual ad-hoc grants. Admin actions audited and reviewed at least quarterly. Standing admin privileges eliminated or minimized.
Evidence to keep: PIM configuration export showing eligible vs. active admin roles. RBAC role definitions document. Admin audit log sample from the past quarter. Quarterly access review report.
7. External Sharing and Client Portal Controls
Why it matters: Law firms share documents externally more than almost any other industry — with clients, opposing counsel, experts, and courts. Uncontrolled SharePoint or OneDrive sharing can expose matter files to anyone with a link. Client portals need access controls, expiry, and audit trails.
What "yes" requires: SharePoint and OneDrive external sharing restricted to specific domains or authenticated guests. Default sharing link setting set to "specific people" not "anyone with the link." Client portal (e.g., NetDocuments, iManage) configured with per-matter access controls. Matter close-out procedure that revokes external access and archives shared links within 30 days of file closing.
Evidence to keep: SharePoint sharing policy export. Client portal access configuration screenshot. Matter close-out checklist template with external access revocation step. Sample of completed close-out records from the past quarter.
8. Device Compliance and Mobile Device Management
Why it matters: Lawyers work from everywhere — home, court, client offices, coffee shops. Firm data on personal phones, unencrypted laptops, or devices without remote wipe capability is a breach waiting to happen. MDM ensures that only compliant, encrypted, and manageable devices can access firm resources.
What "yes" requires: Intune or equivalent MDM enrollment for all devices accessing firm data, including BYOD. Conditional access policies requiring device compliance before email or file access. BitLocker (Windows) or FileVault (macOS) encryption enforced. Remote wipe capability for lost or stolen devices. Non-compliant devices blocked automatically.
Evidence to keep: Intune compliance policy export. Device enrollment report showing compliance status. Conditional access policy screenshot requiring compliant device. Encryption status report for all enrolled devices.
9. Security Awareness Training
Why it matters: The human element is the weakest link in any law firm's security posture. Generic security awareness training doesn't work — lawyers need training that reflects the specific threats they face: matter-related spear phishing, fake opposing counsel emails, fraudulent trust wire requests. Phishing simulation catches the gaps.
What "yes" requires: Annual security awareness training for all firm personnel, including partners. Quarterly phishing simulation campaigns with matter-specific lures (e.g., fake trust wire instructions, fake opposing counsel attachments). Remedial training for repeat clickers. Training completion tracked and documented.
Evidence to keep: Training platform report showing completion rates by user. Phishing simulation results from the past four campaigns. Remedial training records for repeat clickers. Training curriculum outline showing legal-sector specific content.
10. Incident Response Plan
Why it matters: When a breach happens at a law firm, the clock starts immediately. Law society notification deadlines, insurer notification deadlines, client notification obligations — all have different timelines and different triggers. A written, tested incident response plan is what separates a controlled response from a regulated disaster.
What "yes" requires: Written IR plan with defined roles (incident lead, legal counsel, communications, IT response). Notification procedures for law society (LSBC, LSO, or applicable provincial body), cyber insurer, affected clients, and privacy commissioner. Tabletop exercise conducted within the last 12 months. Plan reviewed and updated annually.
Evidence to keep: Incident response plan document (current version). Tabletop exercise after-action report from the most recent exercise. Notification contact list with law society, insurer, and privacy commissioner details. Plan review sign-off with date.
Claims-Survival Controls
These five controls are what save your claim when an incident happens. Insurers investigate whether the controls you said you had on the application were actually in place and functioning when the loss occurred. Gaps between what you claimed and what was true are the most common reason for claim denial or coverage disputes.
11. Unified Audit Logging
Why it matters: When a law firm files a cyber claim, the insurer's forensics team will ask for logs. If you can't produce them, the claim slows down — or worse, the insurer questions whether the controls were ever in place. Unified audit logging across Microsoft 365, on-premises systems, and practice management tools provides the evidence chain that makes a claim payable.
What "yes" requires: Microsoft 365 Unified Audit Log enabled and exported to a storage account or SIEM independent of the tenant admin's control. On-premises server, firewall, and practice management system logs centralized. Minimum 12-month retention. Access to log storage restricted and audited.
Evidence to keep: Audit log configuration report showing retention period and storage location. Sample log export demonstrating completeness. Access control list for log storage. Screenshot of Microsoft Purview audit configuration.
12. Continuous Configuration Monitoring
Why it matters: Security configurations drift. An admin enables legacy auth to troubleshoot a printer and forgets to turn it back off. A new hire gets added to a group with broad permissions. Continuous monitoring catches this drift before it becomes the gap an attacker exploits — or the gap an insurer finds during a claims investigation.
What "yes" requires: Microsoft Secure Score (or equivalent) monitored with alerts on score drops of 5+ points. Configuration drift detection on critical policies (MFA, conditional access, external sharing). Quarterly configuration audit documented with findings and remediation. Baseline configuration documented and version-controlled.
Evidence to keep: Secure Score trend report from the past 12 months. Drift alert configuration and sample alerts. Quarterly audit reports with remediation tracking. Current baseline configuration document.
13. Trust Account Wire Fraud Prevention
Why it matters: Trust account wire fraud is the single most devastating cyber risk a law firm faces. A fraudulent wire from a trust account can exceed the firm's entire annual revenue, and the recovery window is measured in hours. This control is the one underwriters scrutinize most closely — and the one most likely to trigger a claim.
What "yes" requires: Written wire transfer verification policy requiring verbal call-back to a pre-established phone number (not a number provided in the wire request email). Dual authorization for any wire over a defined threshold (typically $10,000). First-hour funds-recall sequence documented and rehearsed with the firm's bank. Banking contact list verified annually.
Evidence to keep: Wire transfer verification policy document. Call-back verification log template with sample entries. Bank recall procedure documentation. Annual banking contact verification record. Staff training records on wire fraud prevention.
14. Data Loss Prevention for Client Confidential Information
Why it matters: Law firms handle social insurance numbers, financial statements, health records, and litigation strategy — all subject to professional confidentiality obligations and privacy law. DLP policies prevent this data from leaving the firm through email, USB, or cloud uploads, and they provide evidence that the firm took reasonable steps to protect client information.
What "yes" requires: Microsoft Purview DLP (or equivalent) policies configured for Canadian SIN patterns, credit card numbers, bank account numbers, and health record identifiers. Legal-specific DLP patterns for matter numbers and privileged communication markers. Policies enforced in block mode (not audit-only) for outbound email and external sharing. DLP alerts routed to IT and managing partner.
Evidence to keep: DLP policy configuration export showing patterns and actions. DLP alert history from the past 90 days. Policy review sign-off. Sample alert remediation record.
15. Vendor and Third-Party Risk Management
Why it matters: Law firms rely on IT vendors, cloud providers, court filing systems, and e-discovery platforms — each one a potential entry point. Underwriters increasingly ask about vendor due diligence because third-party breaches are a leading cause of law firm incidents. If your IT provider has access to your systems and gets compromised, you're compromised.
What "yes" requires: Vendor inventory with access levels documented. Due diligence checklist completed for each vendor with system access (SOC 2 report review, security questionnaire, insurance verification). Access revocation procedures documented and tested. Annual vendor risk review.
Evidence to keep: Vendor inventory spreadsheet with access levels and review dates. SOC 2 report acknowledgments for critical vendors. Vendor security questionnaire templates and completed samples. Access revocation procedure document. Annual vendor review report.
Law Society Compliance Crosswalk
Several controls in this kit map directly to law society technology competence requirements. This crosswalk helps you demonstrate compliance while completing your cyber insurance readiness work — two obligations, one effort.
- LSBC Technology Compliance Checklist: Controls 1 (MFA), 3 (Backups), 4 (Email Security), and 13 (Wire Fraud Prevention) map directly to the Law Society of British Columbia's cloud computing and technology requirements. See our LSBC Cloud Computing Checklist guide for a detailed mapping.
- LSO Technology Competence Requirements: The Law Society of Ontario requires lawyers to understand and manage technology risks. Controls 1, 4, 9 (Training), and 10 (IR Plan) address the core LSO technology competence obligations.
- LSUC / LSA Guidelines: The Law Society of Upper Canada (now LSO) and provincial law societies across Canada increasingly require demonstrated technology competence. Controls 5 (Patching), 7 (External Sharing), and 11 (Audit Logging) support compliance with evolving provincial requirements. See our work with regulatory colleges and professional associations for broader compliance support.
T-90/60/30 Renewal Checklist
T-90 Days
Run a full control audit against all 15 controls. Identify drift — policies changed, devices unenrolled, backups not tested. Schedule remediation with deadlines before the renewal date. Assign owners for each gap.
T-60 Days
Complete all remediation. Gather evidence for every control: screenshots, policy exports, test results, training records. Brief your broker with a completed control summary and evidence package. Identify any controls that can't be fully remediated and prepare an explanation.
T-30 Days
Submit the application with documented "yes" answers backed by evidence. Confirm coverage terms, sublimits, and exclusions with the broker. Review the policy wording for maintenance obligations that apply during the policy term — not just at application.
Six Questions to Put to Your Broker
- What sublimits apply to wire fraud and social engineering? Many policies cap social engineering coverage well below the policy limit. For a law firm, this is the coverage that matters most — know the number before you bind.
- Is there a waiting period before first-party coverage responds? Waiting periods of 8–12 hours are common. For a trust wire fraud incident, 12 hours is the difference between recovery and total loss.
- Does the policy require continuous control maintenance or just at-application accuracy? Some policies require controls to be maintained throughout the term. If you let MFA enforcement lapse mid-policy, a claim could be denied even if it was in place at application.
- What are the notification obligations and timelines after an incident? Most policies require notification within 48–72 hours. For law firms, law society notification may have separate, shorter deadlines. Know both.
- Are there exclusions for unpatched systems or legacy software? If your firm still runs PC Law or Amicus on Windows Server 2016, confirm whether the policy excludes incidents involving unsupported or end-of-life software.
- Does the policy cover regulatory investigation costs and law society notification expenses? A breach at a law firm often triggers law society investigation. Confirm that defence costs, investigation response, and notification expenses are covered — not just third-party damages.
Who is this for?
This kit is written for managing partners, firm administrators, and controllers at Canadian law firms buying or renewing cyber insurance. It's for firms that don't have a dedicated security team — firms where the managing partner or firm administrator is also the person answering the insurer's questionnaire. If your firm has a CISO and a dedicated security operations team, you're beyond this kit. And to be clear: this is not insurance advice. Coverage decisions belong with your broker, who can assess your specific risk profile and market conditions.
The Bottom Line
Cyber insurance readiness starts before the application and continues through the policy term. Trust wire fraud is a known law firm risk — it's the claim that gets filed most often and costs the most per incident. A written call-back rule and dual authorization reduce that risk. This kit puts the controls, evidence list, and renewal steps in one document your firm administrator can start working through today.
Want help implementing these controls?
Cloud Collective works with law firms across Vancouver and Ottawa on MFA, EDR, immutable backups, and law society compliance.
Free IT Assessment →Related articles
- Wire Transfer Policy: Protect Your Business from Email Compromise
- How to Spot a Malicious Email in 2026 — 4 Steps That Still Work
- Immutable Backups — Managed Cybersecurity Strategy
- Cyber Claims Are Up 30% — Here's What Every Canadian SMB Needs to Know
Sources: Canadian Anti-Fraud Centre (2023 fraud report), American Bar Association 2024 Cybersecurity Survey, NetDiligence Cyber Claims Study 2025. This article is for informational purposes only and does not constitute insurance or legal advice.
Free IT Assessment
Not sure where your IT stands? Get a free, no-obligation assessment of your infrastructure, security, and cloud setup.
Get Your Free Assessment →
