Law Firm Cybersecurity Checklist: What Your Office Manager Should Verify
A practical law firm cybersecurity checklist for verifying accounts, staff departures, email, client files, payments, training, recovery, and evidence.
A client asks which safeguards protect their matter files. Your insurer asks who enforces multifactor authentication. Leadership needs to explain what works, what needs attention, and what has not been checked.
Use this checklist to request evidence from the person responsible for each system. It is a coordination aid, not a technical audit or a claim that any control is already in place.
A practical verification checklist
For each row, name the person who will verify the item and record where dated evidence is stored. Choose one status: Working, Needs Attention, or Not Verified.
Use your browser's print command for a paper copy; the checklist table is formatted to remain readable when printed.
| Area | What to verify | Responsible role | Evidence to request | Status |
|---|---|---|---|---|
| Accounts and MFA | MFA coverage, exceptions, administrator accounts, and recovery methods | IT or identity administrator | Current policy scope, account coverage, exceptions, and review date | Working / Needs Attention / Not Verified |
| Departures | Access removal from email, file systems, matter tools, portals, and other apps | Office manager and each system owner | Dated change records, remaining access, reviewer, and record handover | Working / Needs Attention / Not Verified |
| Email-domain protection | SPF, DKIM, and DMARC configuration and authorized senders | Email administrator or provider | Current DNS records, sending services, and any enforcement exceptions | Working / Needs Attention / Not Verified |
| Client-file sharing | Recipients, guest access, link scope, expiration, and downloaded copies | Matter owner and Microsoft 365 administrator | Sites or files reviewed, permission list, share links, and review date | Working / Needs Attention / Not Verified |
| Payment changes | Independent callbacks, second review, and payment approval | Responsible attorney and payment approver | Written procedure and a dated, appropriately protected verification record | Working / Needs Attention / Not Verified |
| Staff readiness | Reporting route and practice with document, court, sign-in, and payment requests | Firm administrator or training owner | Participation, completion, follow-up, and the activity actually tested | Working / Needs Attention / Not Verified |
| Backups and recovery | Covered systems, recovery ownership, and restoration testing | IT or backup provider | Backup scope, dated restore result, exceptions, and recovery contact | Working / Needs Attention / Not Verified |
| Incident contacts | Who can make decisions and how to reach IT, counsel, insurer, and banks | Firm leadership or incident lead | Current contact list, escalation steps, and last review date | Working / Needs Attention / Not Verified |
| Client and insurer evidence | Scope, owner, dated proof, exceptions, and approved answers | Firm reviewer with control owner | Exact question, supporting evidence, limitations, and approval record | Working / Needs Attention / Not Verified |
Not Verified does not mean failed. It means the firm has not yet gathered enough evidence to make a supported conclusion. Record the next person to ask and a follow-up date rather than guessing.
Use the detailed procedure for each task
- For account coverage and MFA, see how law firms verify MFA across accounts.
- For a departure, use the law firm employee offboarding checklist and worksheets.
- For sender authentication, see the email-domain protection guide for small law firms.
- Before sharing matter files, follow the Microsoft 365 client-file sharing checklist.
- For payment changes, use the wire instruction verification checklist.
- To practice reporting and follow-up, read the phishing readiness guide for law firms.
- For recovery and incident response, review the ransomware protection guide and incident response plan template.
- When a client requests proof, use the security questionnaire evidence map.
The Microsoft 365 security checklist covers identity, sharing, forwarding, logging, and recovery evidence in more depth.
Choose the right next step
An authorized Law Firm Security Baseline can review agreed internal controls and evidence alongside your existing IT provider. It is an assessment; remediation requires separate scope.
The public Free Zero-Access Exposure Review checks externally observable conditions. It does not test whether internal safeguards work or whether access to client files is appropriate.
Start with one row, name an owner, and record what evidence would support the answer. A clear unknown is more useful than an unsupported yes.