Cyber-insurance applications are not a substitute for a security program, and no checklist can promise coverage or a particular premium. They can, however, expose a practical problem: a Sarasota law firm knows it has protections, but cannot show where they are configured, who owns them, or whether they still work.
That documentation supports more than an insurance conversation. The ABA’s discussion of attorney cybersecurity connects competent, reasonable safeguards with the duty to protect client information under Model Rule 1.6. Read the ABA’s overview of competent and reasonable safeguards for the professional-responsibility context; your firm’s counsel should interpret the rules and your policy terms.
Start with evidence, not a yes-or-no answer
Carriers’ questions and policy wording vary. Treat every application as its own document, then assign one person to collect the evidence behind each answer. A mature answer is more than “yes, we use MFA.” It identifies the systems in scope, the administrator who can demonstrate enforcement, the exception process, and the date of the last review.
Use the same approach for your broader law firm cybersecurity program. It gives partners a clearer picture of how client confidentiality, e-discovery, email, and remote access are actually protected.
Eight items to have ready before renewal
- Identity and MFA evidence. Export the current enrollment and conditional-access status for email, practice-management, remote-access, and administrator accounts. CISA explains that MFA adds a second verification step, so a stolen password alone is not enough to access an account; use stronger phishing-resistant methods where the platform supports them.
- Privileged-account inventory. List global administrators, billing administrators, backup administrators, shared mailboxes, and outside support access. Remove stale accounts and document who approves new privileged access.
- Email and domain safeguards. Keep a short record of anti-phishing settings, external-forwarding rules, domain ownership, and the mailbox-review process. Email is where a client-confidence problem can quickly become a financial one.
- Endpoint and patching records. Identify the managed workstations and servers, their protection status, and the process for urgent security updates. Include attorney home-office devices if they access firm systems.
- Backup and restore proof. A backup report shows that a job ran. A restore test shows that a matter file or essential workflow can be recovered. Keep the test date, result, responsible person, and any corrective action.
- Incident-response contacts. Maintain an offline call list for firm leadership, IT, cyber counsel, the carrier’s notification channel, and the bank. Record who may authorize containment or client communications.
- Vendor and access review. Know which cloud services, e-discovery platforms, file-sharing tools, and contractors can access confidential information. Keep agreements, access owners, and offboarding steps together.
- Security-awareness and tabletop record. Keep the training date, audience, and a brief after-action note from a realistic scenario—such as a changed wire instruction or suspicious mailbox rule.
Make MFA a documented operating control
“MFA is enabled” is not the end of the work. Verify that it covers the accounts that matter most, including cloud administrators and backup consoles. CISA’s MFA guidance describes the added verification step and urges organizations to enable it for accounts and apps that offer it. A monthly exception review is more useful than a policy sentence nobody checks.
For a small firm, named accounts, a password manager, and role-based access create a manageable baseline. Pair that with the practical controls in our ABA cybersecurity guide for Sarasota law firms so the renewal file reflects day-to-day practice rather than a one-time project.
Three things you can do this week
- Open the current application now. Highlight every question that needs a technical owner or a document; do not wait for the renewal deadline.
- Run an MFA and administrator review. Confirm enrollment, disable stale accounts, and document any approved exception with an owner and expiry date.
- Test one recovery workflow. Restore a non-production copy of a representative matter file or required template, record the result, and fix the gap before relying on the backup report.
Turn renewal prep into a stronger firm
A clear evidence folder reduces last-minute work and gives the firm a usable map during an incident. CISA’s Cyber Essentials also emphasizes leadership ownership, incident response, and disaster-recovery planning for small organizations. Those are operational practices, not a coverage determination.
Suncoast MIS helps Sarasota and Manatee legal practices review the systems behind these controls. Our Free Systems Audit is on-site, usually takes 45–60 minutes within a 60-minute booking slot, and includes a full, customized Client Threat & Architecture Report with practical findings. It is not legal advice or an insurance-coverage review.
Gregory Mathews, Systems Architect, Suncoast MIS LLC
Source Notes and Scope
This article relies on the linked ABA discussion for professional-responsibility context and the linked CISA pages for MFA and small-business security-planning guidance. Carrier applications, underwriting decisions, policy exclusions, and legal duties are fact-specific; confirm them with qualified insurance and legal advisors.
Author & technical scope review
Gregory Mathews
Gregory is the Systems Architect and founder of Suncoast MIS, with 15+ years of practical IT and systems architecture experience. He authored this article and reviewed its technical scope. Compliance, legal, and insurance conclusions remain with each organization and its qualified advisors.