Evidence, not a scramble.
CIS, NIST, ISO 27001, SOC 2 and CCPA don't reward a once-a-year push. We build the controls into how your environment runs day to day, and keep the documentation current — so when someone asks for proof, it already exists.
✲ The Problem.
It usually starts with an email from a client. A spreadsheet with 150 questions, a 30-day deadline, and a section on incident response that nobody at the firm can answer.
Your clients aren’t being difficult. Their own auditors require them to check every vendor that touches their data, and a law firm holding their litigation files and deal documents is a vendor with a lot of access. The same requirements are turning up in outside counsel guidelines, which firms often sign without anyone technical reading them.
Most firms treat each questionnaire as a one-off project and rebuild the evidence from scratch every time. It’s slow, it’s stressful, and it’s the part of IT that can actually cost you a client.
✲ Risk Assessment
- Risk register
- Written report
- Prioritized fixes
- Annual review
What we look at
✲ Audit Readiness
- Evidence folder
- Questionnaire support
- Policies & procedures
- Control monitoring
An evidence folder that keeps itself current
Questionnaire answers on file
Policies that match reality
A questionnaire just landed.
Firms with outside counsel guidelines.
Firms going for a framework.
Twelve years and over 150 projects for businesses that never had to think about IT.
Case Study
Litigation firm, five states.
Blog Post
The security questionnaire is coming for your firm.
✲ How it works.
-
Gap assessment.We compare your environment against the framework or questionnaire you're facing. You get a list of what's covered and what isn't.01.
-
Remediation plan.The gaps, ranked by risk and by what reviewers check first, with an owner and a date for each.02.
-
Controls built in.The fixes become part of how your IT runs every day, handled by the team that manages it. They don't wait for next year's review.03.
-
Evidence kept current.Dated evidence collected as the work happens, so the next questionnaire or audit is answered out of a folder.04.
The things people ask us first.
No. We prepare you, the auditor attests. Keeping those two roles separate is what makes an audit credible, and any provider who offers to do both should worry you.
Yes, and it's one of the most common reasons firms call us. Send it over. We'll tell you which questions you can already answer, which ones need work, and whether the client will accept a remediation timeline for the rest. Most will.
SOC 2, ISO 27001, NIST, CIS and CCPA. Most law firms don't need a framework of their own. They need to answer their clients' questions about one, and we do both.
About four weeks for the first one, and most of that is gathering information rather than waiting on us. After that it's reviewed once a year, or sooner if something big changes: a new office, a merger, or a major new client.
✲ Find out how your firm would do on its next questionnaire.
Send us the last questionnaire you received, or tell us which framework you're facing. We'll tell you where you stand and what it would take to close the gaps.