Guides

Does a small law firm need cyber liability insurance?

I am not an insurance agent, and this guide will not tell you what to buy. What it will do is explain, in plain English, what a cyber liability policy actually pays for, where firms discover gaps after it is too late to fix them, and which questions are worth bringing to a licensed agent. I bought technology errors and omissions plus cyber coverage for my own business this year, so I have sat on the buying side of this application recently, reading the same fine print.

What does a cyber liability policy actually cover?

Most policies bundle two different kinds of protection. The first-party side pays your own costs after an incident: the forensics team that works out what happened, legally required notification to the people whose data was exposed, recovering systems after ransomware, and often some of the income lost while the office could not work. The third-party side covers claims made against the firm by others, which for a law office usually means clients whose information was in the files. The two sides carry separate limits and separate conditions, which is the first thing worth mapping with an agent rather than assuming.

Is malpractice insurance enough?

The most common reason a firm skips cyber coverage is the belief that professional liability already covers it. It usually does not. Malpractice insurance responds when your legal work allegedly harmed a client. A ransomware weekend, a breach notification bill, or a stolen wire is not a legal work error, and a malpractice carrier can decline it on exactly that ground. The reverse is also true: a cyber policy will not defend your legal judgment. A breach that delays a filing can end up touching both policies at once, which is why the right person to map the boundary is the agent who can read both documents side by side.

The sublimit that matters most at a law firm

Here is the detail I would check before any other. The single most likely way a law firm loses real money is a rerouted wire, the fraud described in how wire fraud happens to law firms. On many policies that loss does not fall under the big headline limit. It falls under a social engineering or funds transfer fraud sublimit, and that sublimit is often a fraction of the number on the front page. A firm can hold a policy measured in millions and find that the coverage for the loss it was most likely to suffer is a small fraction of the stolen amount. Ask your agent for the sublimit number in dollars, and whether it requires you to have verified payment instructions by phone. Some policies pay only if the call-back habit existed and failed, not if it never existed at all.

So does a small firm actually need it?

That decision belongs to you and a licensed agent, so here is the shape of it rather than an answer. A law office concentrates three things attackers value: money in motion through trust accounts, confidential files clients assumed were safe, and deadlines that make paying quickly tempting. Firms that hold any of those are the reason this product exists. Corporate clients increasingly settle the question for you, since outside counsel guidelines now routinely require proof of cyber coverage, a pattern covered in the client security questionnaire guide. And the Florida Bar expects firms to take reasonable steps around client data and to understand the risks of the technology they use; what that means for your practice is a question for the Bar or your ethics counsel, not for me.

What moves the premium

Carriers price the policy off the application, and the application is mostly an IT questionnaire: enforced multi-factor authentication, backups separated from the systems they protect and actually tested, patching, endpoint protection, and email authentication. Every one of those is walked through in how to answer a law firm cyber insurance questionnaire. The controls do double duty: they make the incident less likely, and they make the coverage cheaper and easier to bind. The reverse matters more. Answers the carrier later finds were not accurate are what an insurer points at when a claim is disputed, so the cheapest premium strategy that actually works is making the answers true before you sign, not rounding up.

Questions to bring your agent

Walk in with these and the meeting will be worth the hour: What is the social engineering or funds transfer fraud sublimit in dollars, and what does it require of us? Where does this policy stop and our malpractice policy start? What must we maintain during the policy year for coverage to hold, and what happens if a stated control lapses? Who do we call first on the day something happens, and does using our own IT provider or forensics firm need the carrier's approval? An independent local agent who works with several carriers can compare answers across them, and the good ones enjoy being asked.