Cybersecurity Assessments for Law Firms:how Not to Screw Them Up

• Citation: Vol. 50 No. 1
• Publication year: 2024

Cybersecurity Assessments for Law Firms: How Not to Screw Them Up Vol. 50 No. 1 Pg. 35 Vermont Bar Journal March 2024

by Sharon D. Nelson, Esq., John W. Simek, and Michael C. Maschke ©2024 Sensei Enterprises, Inc.

Should You Have a Cybersecurity Assessment Every Year?

Absolutely. A fair number of firms perform cybersecurity assessments twice a year. For most firms, we'll settle for once a year. It is also true that most cyberinsurance companies will also settle for once-a-year assessments. The biggest firms may do it twice a year (or more), but most of you reading this are probably doing just fine with yearly assessments.

We have lived through 2023 - in which we saw more law firm breaches than ever before. And we saw (horrifyingly) a stream of class action lawsuits filed against breached law firms. So yes, we need to pay attention to cybersecurity assessments - not put them off or skip a year for budgetary reasons. While we often hear that budgets don't allow for a cybersecurity assessment, if you get breached, your budget is going all to hell. Better to spend the money and avoid the breach.

Do you need a penetration test which takes longer and is much more expensive? If you're big enough, yes. But for solos, small and midsize firms, a cybersecurity assessment is generally considered to be reasonable. Penetration tests are very expensive, complex and include an authorized simulated attack performed...