The short answer: cyber insurers now expect law firms to show, not just claim, a core set of controls: multi-factor authentication on email, remote access and admin accounts; endpoint detection and response on every device; backups that are separate from your main systems and tested; email security; timely patching; security awareness training; and a written incident response plan. Missing any of these can mean higher premiums, exclusions, lower limits or a declined application. Answering "yes" when the truthful answer is "partly" can put a future claim at risk.

At Peak Solutions (Peak Global Solutions) we help law firms in Southern California and Nevada complete insurance applications and carrier security assessments every renewal season. This is the checklist we work from. Every carrier's form is different, so treat this as the common core, not a substitute for reading your own application.

Key takeaways

• Insurance applications have become security assessments. Some carriers also run external scans of your domain and public systems before quoting.
• MFA, EDR and tested backups are the three controls most likely to decide your outcome.
• "Enabled" and "enforced" are different answers. Insurers want enforced.
• Keep dated evidence. It speeds up renewals and supports you if you ever file a claim.
• Start 60 to 90 days before renewal so there is time to fix gaps instead of explaining them.

The checklist

1. Multi-factor authentication

• Enforced for every user on Microsoft 365 email and cloud apps
• Required for all remote access (VPN, remote desktop, remote management tools)
• Required for every administrator and privileged account, ideally with phishing-resistant methods
• Legacy authentication protocols blocked so MFA can't be bypassed

2. Endpoint detection and response (EDR)

• EDR, not just traditional antivirus, on every workstation, laptop and server
• 24/7 monitoring by a security operations team that can isolate a device
• Coverage reports showing no unprotected devices

3. Backups

• Backups of servers and Microsoft 365 (email, OneDrive, SharePoint, Teams) that are separate from production
• At least one copy that is immutable or offline, so ransomware can't encrypt or delete it
• Backup systems protected by separate credentials and MFA
• Restore tests on a schedule, with dated results

4. Email security

• Advanced filtering for phishing, malicious links and attachments
• Impersonation and business email compromise protection
• SPF, DKIM and DMARC configured for your domain, with DMARC moving toward enforcement
• External sender warnings

5. Patching and vulnerability management

• Operating systems and third-party applications patched on a defined schedule
• Critical vulnerabilities on internet-facing systems fixed quickly
• No end-of-life systems, or documented isolation for any you can't retire yet

6. Privileged access

• Separate admin accounts, not daily-use accounts with admin rights
• Local administrator rights removed from users
• Regular review of who holds admin access

7. Training and payment controls

• Security awareness training at least annually, with phishing simulations
• A written callback procedure for any change to wiring or payment instructions

8. Incident response

• A written incident response plan with names, phone numbers and decision authority
• Your insurer's breach hotline and panel requirements written into the plan
• A tabletop exercise at least once a year

9. Vendors

• A list of vendors that hold or access client data, including your IT provider
• MFA and least-privilege access for your IT provider's tools in your environment

How to approach your renewal

1. Get the application early and read every question with your IT provider.
2. Mark each control as in place, partly in place, or not in place. Be honest.
3. Fix what you can before the application is due, starting with MFA, EDR and backups.
4. Collect evidence: screenshots, policy exports, coverage reports, restore test results.
5. For anything still missing, describe a dated remediation plan instead of guessing.

Frequently asked questions

What security controls do cyber insurers require from law firms?

The most common requirements are enforced MFA, EDR with monitoring, separate and tested backups, email security, patching, privileged access controls, security training and a written incident response plan. Exact requirements vary by carrier and by firm size.

Can a cyber insurer deny a claim because of the application?

Policies and outcomes vary, and you should ask your broker or coverage counsel about your own policy. In general, inaccurate answers on an application can create problems at claim time, which is why it pays to answer precisely and keep evidence.

Who can help a law firm meet cyber insurance security requirements?

Your broker can explain what the carrier wants, and your IT provider has to implement and document it. Peak Solutions helps law firms in Southern California and Nevada close gaps, complete carrier security assessments and keep evidence ready for renewal.

Talk to us

If your renewal is coming up, send us the application. We'll tell you which answers you can support today and what to fix first.