For law firms
Cyber insurance for law firms: what carriers ask in 2026
The short answer
Law firms face the same cyber insurance controls as any small business, plus sharper questions in two places: the confidentiality of client matter files, and verification of any payment instruction, because real-estate closings and settlement disbursements are a standing target for wire fraud. Underwriters also ask how quickly departing staff lose access.
What's different about law firms
A firm's risk isn't really its own money. It's client money in transit and client confidences at rest. Underwriters know that, so the questions that get the hardest look are the ones about who can move funds and who can read a matter file.
Settlement and closing payments make a firm a standing target. The attack is boring and effective: an attacker sits in a mailbox, watches a closing approach, then sends revised wire instructions from a lookalike address or the real one. The FBI's IC3 reporting puts business email compromise and payment fraud among the costliest categories year after year, which is why a written call-back rule matters more here than almost any tool you could buy.
Underwriters also probe something most firms have never examined: who can open which matter. Small firms typically grew up with everyone able to read everything, because that was simpler and nobody thought about it. A carrier reads that as one compromised paralegal account away from total exposure. Role-based access in the document management system is usually a configuration afternoon, and it changes the answer on the form.
Then there's the disclosure question. Every state has its own breach-notification law and the patchwork keeps moving, so a firm that loses client data has a reporting problem on top of a recovery problem. Carriers ask about your incident response plan partly to find out whether you'd know who to call in the first 48 hours.
What already applies to you, before any insurer asks
These aren't insurance requirements. They're obligations that exist whether you buy a policy or not, and the paperwork they call for is most of what an application wants to see.
Professional confidentiality duties
Your duty to protect client information is a professional obligation, not just a business preference, and it applies to the systems holding matter files. Carriers won't assess your ethics compliance, but they will ask about the controls that make it possible, and a supplemental questionnaire is often the first time a firm has to describe them in writing.
Client and counterparty contract terms
Corporate clients increasingly push security requirements into outside counsel guidelines: encryption, breach-notification windows measured in hours, sometimes a right to audit. Those obligations arrive by contract rather than statute, and they can be stricter than anything an insurer asks of you.
State breach-notification laws
Fifty states, fifty timelines and thresholds, and the list changes every legislative session. If you hold personal data for clients in several states, assume more than one law applies and that a written plan is the only way to move fast.
General information, not legal advice. Whether a rule applies to your business turns on facts we don't know about it, so confirm with your own advisor.
The questions carriers weight hardest here
Every application covers the same ten control areas. All of them are written out here. These are the ones an underwriter reads twice for law firms.
Before changing bank details or sending an unusual payment, do you verify by phone using a known number?
Why it's weighted here: Closings and settlement disbursements mean payment instructions change often and under time pressure, which is exactly the condition wire fraud needs.
If the answer is no: Institute the call-back rule today and tell every person who can move money. It's free and it prevents the most frequent claim type outright.
Your written evidence: Funds-Transfer & Payment Verification Procedure, The verification steps
What protections sit in front of your business email?
Why it's weighted here: The mailbox is where a wire-fraud attack lives for weeks before it acts, so filtering and anti-spoofing carry extra weight.
If the answer is no: Move email to Microsoft 365 or Google Workspace if self-hosted; enable their anti-phishing protections and SPF/DKIM/DMARC.
Your written evidence: Email Security Policy §3 Technical protections (enabled and verified)
When someone leaves the company, how quickly is their access removed?
Why it's weighted here: Lateral moves are normal in legal, and an associate who left last quarter should not still reach the document management system.
If the answer is no: List every system a departing employee touches; turn it into a checklist; assign an owner. Two hours, permanent fix.
Your written evidence: Access Control & Account Management Policy §2 Account lifecycle
Do you have a written incident response plan?
Why it's weighted here: Client-data loss triggers notification duties, and carriers ask whether you could identify what was exposed and who to tell.
If the answer is no: Write the one-page version today (who to call, how to isolate, where backups are), then grow it into a full plan with the template.
Your written evidence: Incident Response Plan (Fill-in-the-Blank) §2 Roles + Incident Response Plan (Fill-in-the-Blank) §4 The first 24 hours
Evidence to have ready
- Your written call-back rule for any change to payment or trust-account instructions, and the threshold that triggers a second approver
- Evidence that matter-file access is limited by role, not open to the whole firm
- A record of access removal for the last person who left, dated the same day they left
The written half of that list is what the Readiness Pack is: Funds-Transfer & Payment Verification Procedure, Access Control & Account Management Policy, Incident Response Plan (Fill-in-the-Blank), Email Security Policy, each personalized to your business and mapped to the question it answers.
Common questions
Do we need cyber insurance if we already carry malpractice coverage?+
They cover different things. Professional liability responds to claims about your legal work. Cyber responds to the incident itself: forensics, notification, business interruption, extortion, and funds-transfer loss where the policy includes it. Ask your broker to show you where each policy stops, in writing, because the gap between them is where firms get surprised.
Our practice management software is cloud-based. Doesn't the vendor handle security?+
They handle their platform. You still control who has an account, whether those accounts use multi-factor authentication, what happens when someone leaves, and whether anyone can be tricked into moving money. Every one of those is your answer on the application, not your vendor's.
What's the fastest thing we can fix before a renewal?+
Enforced multi-factor authentication on email, then a written call-back rule for payment changes. The first is free and takes an afternoon in Microsoft 365 or Google Workspace. The second costs nothing and prevents the loss type most likely to hit a firm holding client funds.
If we're breached, do we have to tell clients?+
Probably, and from more than one direction. State breach-notification law may require it based on the data involved and where those people live, your professional obligations point the same way, and many engagement letters say so explicitly. This is why carriers ask about the incident response plan: the notification decision has to be made in days, by someone who knows which data was in the affected system.
Sources
- FBI IC3 Internet Crime Report (business email compromise and payment fraud)
- IAPP US State Privacy Legislation Tracker
- CIS Critical Security Controls v8.1, Implementation Group 1
- Carrier applications and supplemental questionnaires, 2026 forms
See where your practice stands, free
Sixteen questions, five minutes, a score across the ten control areas underwriters probe, and your three biggest gaps with the fix for each. No email needed for the score.