Cyber insurers, clients and regulators have converged on a rough consensus about the security baseline every law firm should be able to demonstrate. Firms above the line renew coverage smoothly, win RFPs and quietly build reputational capital. Firms below it don't — and the delta widens each year.
Identity: MFA everywhere, phishing-resistant where possible
Enforced MFA on every user, phishing-resistant methods for privileged and partner-level accounts, and conditional access aligned with device health. Anything less is now materially below the market baseline, and increasingly below what insurers will underwrite comfortably.
Endpoints: EDR, encryption, patching cadence
Modern EDR on every device, disk encryption enforced by policy and verified in reporting, and a documented monthly patch cycle with tested rollback. This is table stakes; firms without these controls should treat closing the gap as an urgent priority.
Email: advanced protection, DMARC, training
Advanced anti-phishing, DMARC enforced at reject, and quarterly attack-simulation training with measured improvement over time. Firms whose email defenses stop at spam filtering are behind, and the exposure shows up in incidents.
Data: backup, immutability, tested restores
Backups you can prove work through recent restore evidence, immutable copies you can prove attackers can't touch, and restore drills with dated logs. Backups that succeed without being tested are not backups; they are unverified assumptions.
Network and cloud: segmentation, logging, DNS filtering
Segmented networks in offices, consolidated logging in cloud environments, DNS-layer filtering everywhere. The absence of any of these is a soft target that mature attackers now expect to find.
Governance: named owner, monthly reporting, tested response plan
A named executive owner for security, a monthly one-page report to leadership, and an incident response plan tested annually against a realistic scenario. Governance is what turns controls into a program.
We help firms get above this line — and stay there. Talk to us, or subscribe below for our next security baseline update.
Contact us
