Cyber Insurance Application Help for Small Law Firms
A practical guide for small law firms to verify application answers, gather evidence, and get technical help before renewal.
Cyber Insurance Applications for Law Firms: What to Check Before You Sign
Blog post - By Securing Your Law Firm
Your cyber insurance application asks whether the firm requires multi-factor authentication, keeps backups, and protects its computers. You know the firm uses Microsoft 365 and has security software. But can you confirm those protections cover the accounts and computers named in the application?
At a small firm, the person handling the form may also manage client work and office operations. Even with an IT provider, it can be hard to match technical settings to the insurer’s questions.
You do not need to become a cybersecurity expert. You do need to check what is in place, note what is uncertain, and get help verifying technical answers before signing.
Use the exact application you received
Applications differ, so use the version your broker or insurer sent. Read the instructions and definitions. Words such as all, required, and tested can change what a question covers.
If a question is unclear, ask your broker or insurer what it means for your application. Do not assume another insurer’s form uses the same wording.
Check the evidence behind common answers
These are common topics, not a checklist for every policy. Follow the wording of your application.
| Application topic | What to verify |
|---|---|
| Multi-factor authentication (MFA) | Which accounts require a second sign-in step? Check email, remote access, administrator logins, and any other systems the question covers. |
| Backups | What firm data is backed up? When did someone last test restoring it? Having files in the cloud does not by itself show they can be recovered. |
| Computer protection | Which computers used for firm work are covered? Is the protection active, including on remote or older devices? |
| Software updates | Who installs updates, and how do they check that the updates were completed? |
| Staff training and response planning | Who completed training, and when? Is there a current response plan with named roles and contacts? Check whether the form asks about practice exercises or phishing tests. |
“We have MFA” may be true for email but not for other accounts. A backup service does not prove files can be restored. Check the settings or records rather than relying on memory or a product name.
For help checking account coverage, see our guide to verifying MFA across law firm accounts.
If you do not know, write down what needs checking
For each question, note:
- Which accounts, computers, or people it covers
- Who can check the answer
- What record supports it, and when it was checked
- Any gap or exception that needs follow-up
You can mark each item verified, partly verified, not checked, or needs clarification. These are working notes, not answers to copy onto the insurer’s form.
Do not describe a planned fix as a protection that is already in place. If you find a gap, note it and ask your broker how to report the current situation. Keep dated records of any changes made before you submit the form.
How we can help
At a small firm, different people may manage email, case management software, file storage, computers, and backups. Start by listing the systems you use and who looks after each one.
Securing Your Law Firm can explain the cybersecurity questions, review settings you authorize us to check, and identify what needs more attention. If you work with an IT provider, we can coordinate with them and complement their work.
Our cyber insurance application support focuses on the technical questions: what they mean, what records can support an answer, and where a gap remains. Your firm reviews and submits its answers. Your broker or insurer decides how the questions apply and whether the records meet its requirements. Our help cannot guarantee coverage or a particular premium.
If the application raises questions across several areas, a Law Firm Security Baseline can help you see which safeguards are in place and what may need attention.
Before you submit
Make sure you have the right form, have checked what each answer covers, and have noted any exceptions. Keep a copy of what you submit and the records you used.
Not sure about a technical answer? Talk with us about your application. Tell us your deadline and which questions are unclear. Do not send passwords or client files through the contact form.
This article is for informational purposes only. It is not legal, insurance, or coverage advice.