Most law firms understand that cybersecurity is important. They invest in security software, require passwords, use multi-factor authentication, and rely on their IT provider to help protect their systems. But there is another question managing partners should be asking: If our law firm experienced a cybersecurity incident tomorrow morning, would we know what to do?
Imagine an employee reports a suspicious email. Shortly afterward, someone notices unusual activity in Microsoft 365. Another employee cannot access an important file. Is it an isolated technical problem or the beginning of a serious security incident? Who investigates? Who has the authority to disable accounts or disconnect systems? Who informs firm leadership? And what happens if the incident interrupts attorneys working on time-sensitive client matters?
Cybersecurity preparation is not only about preventing attacks. It is also about making sure the firm can respond effectively when something suspicious happens. Here are ten questions every managing partner should be able to answer before a cybersecurity incident occurs.
1. Who Do We Call First?
When an employee suspects a cybersecurity problem, the reporting process should be clear. Employees should know who to contact, how to reach them, and what information to provide. That sounds simple, but consider what happens if the suspected incident affects email or Microsoft Teams. Can employees still reach the right people? Does the firm have an emergency contact number for its IT provider? Is there an after-hours process?
A cybersecurity incident does not necessarily happen during normal business hours. The first few minutes should not be spent figuring out whom to call.
2. Who Determines Whether This Is a Serious Incident?
Not every suspicious email or unusual login represents a major cybersecurity incident. But someone needs to make that determination. Your law firm should understand who investigates suspicious activity and who decides whether additional response procedures are necessary. That may involve the firm’s IT provider, a cybersecurity specialist, internal leadership, or other designated parties. The important issue is responsibility.
If everyone assumes someone else is evaluating the problem, valuable time can be lost. A good incident response process should make it clear who is responsible for assessing the situation and escalating it when necessary.
3. Can We Quickly Contain a Compromised Account or Device?
Suppose an employee’s Microsoft 365 account is compromised. Can your IT provider quickly disable access, revoke active sessions, investigate suspicious activity, and take other appropriate containment steps? What if the problem involves a laptop rather than an account? Can the device be isolated from the network? Does anyone know which systems and applications the employee can access? These questions reveal why identity management, endpoint security, monitoring, and documentation matter.
During an incident, the firm needs more than security tools. It needs people who know how to use those tools and understand the environment they’re protecting. This is one reason Microsoft 365 security for law firms needs to be actively managed before an incident occurs. Proper identity management, administrative controls, and visibility into account activity can make a significant difference when suspicious behavior needs to be investigated.
4. Do We Know What Information Could Be Affected?
Law firms are entrusted with confidential client information, privileged communications, financial records, legal documents, and other sensitive material. If an incident occurs, leadership may need to understand what information was potentially accessed, altered, lost, or exposed. That becomes difficult when the firm does not have a clear understanding of where its information resides. Is it stored in Microsoft 365? A document management system? A practice management application? A local server? A third-party cloud platform? An employee’s personal account?
Good information management helps with everyday cybersecurity, but it also makes incident investigation more manageable. The firm should understand its important information systems before it needs to investigate a potential compromise.
5. Who Makes Decisions During the Incident?
Some incident response decisions are technical. Others are business decisions. Should an affected system be taken offline? Should employees stop using a particular application? Should the firm engage an outside incident response specialist? When should leadership involve its cyber insurance carrier, legal counsel, or other advisors? Who has authority to approve emergency expenditures?
Your IT provider may recommend technical actions, but firm leadership may need to make decisions that affect operations, clients, and legal obligations. Those responsibilities should be established before an emergency. A cybersecurity incident is not the ideal time to determine who has decision-making authority.
6. How Will We Communicate if Our Normal Systems Are Unavailable?
Many law firms depend heavily on Microsoft 365 for email, collaboration, documents, and internal communication. But what happens if those systems are affected by the incident? How will firm leadership communicate with attorneys and staff? How will the firm reach its IT provider? How will employees receive instructions?
An incident response plan should consider alternative communication methods that do not depend entirely on the systems potentially affected. That might involve designated phone numbers, emergency contact lists, or another approved communication channel.
The objective is straightforward: The firm needs a reliable way to coordinate its response even when normal technology is unavailable.
7. Do We Know When Clients, Insurers, or Other Parties Need to Be Notified?
A cybersecurity incident may create responsibilities beyond restoring technology. Depending on the circumstances, the firm may need to consider client communications, contractual requirements, insurance conditions, professional obligations, or applicable notification laws. Those determinations should involve appropriate legal, insurance, and other qualified advisors.
Your MSP should not be making legal notification decisions for the firm. However, your IT provider may play an important role in gathering technical information, preserving relevant records, documenting actions, and coordinating with incident response specialists.
Law firm leadership should know whom to involve and how those decisions will be made. Waiting until an incident occurs to locate the firm’s insurance policy or determine whom to contact can create unnecessary complications.
8. Can We Recover Our Important Systems and Information?
Containment is only part of the response. Eventually, the firm needs to resume normal operations. That raises several questions. Are backups available? Are they protected from the incident affecting the primary environment? Have recovery procedures been tested? How long would restoration take? Which systems would be restored first? And how would the firm determine that affected systems are safe to return to service?
A successful backup does not automatically mean the firm is ready to recover. That’s why law firm data backup and disaster recovery planning should address more than whether another copy of the information exists. Recovery planning needs to consider both the technology and the firm’s business priorities. For example, restoring a rarely used archive may be less urgent than restoring access to current matter files, email, or a critical practice management application. Those priorities should be discussed before an incident.
9. Have We Practiced Our Incident Response Plan?
A written plan is useful. A plan that nobody has reviewed or practiced is less reassuring. Your firm does not necessarily need an elaborate cybersecurity exercise. Even a simple discussion with firm leadership and your IT provider can reveal important gaps.
Consider walking through a realistic scenario involving a law firm employee who falls for a phishing email. The employee reports entering their Microsoft 365 credentials into a suspicious website. Shortly afterward, unusual account activity is detected. What happens next? Who receives the report? Who investigates? Who can disable the account? Who determines whether information was accessed? Who communicates with leadership? What happens if the employee is working remotely?
This type of exercise can uncover missing contact information, unclear responsibilities, undocumented systems, and unrealistic assumptions. It is much better to discover those problems during a planned discussion than during an actual incident.
10. What Happens After the Immediate Problem Is Resolved?
An incident response process should not end when the affected computer is working again. The firm should understand what happened, what information or systems were affected, what actions were taken, and what improvements may be needed.
Depending on the incident, that could involve reviewing security controls, account permissions, employee training, monitoring, backup procedures, or other parts of the technology environment. Documentation also matters. The firm may need a record of what was discovered, when important decisions were made, and how the response was handled.
The objective is not simply to restore operations. It is to reduce the likelihood of repeating the same problem and improve readiness for the next one.
Incident Response Is More Than an IT Support Ticket
One of the biggest mistakes a law firm can make is assuming that cybersecurity incident response is simply another help desk responsibility. An ordinary support request might involve a printer that stops working or an employee who cannot access an application. A cybersecurity incident may require investigation, containment, evidence preservation, communication, recovery, and coordinated decisions involving multiple parties. Those are different responsibilities.
This does not mean every law firm needs an internal cybersecurity department. It does mean leadership should understand what its IT provider is prepared to handle, what specialized capabilities may be needed, and how those resources will be coordinated. Incident response is one part of a broader cybersecurity strategy for law firms. Managing partners should understand how prevention, monitoring, incident response, and recovery work together, even when outside specialists handle the technical details.
If your firm experienced a serious cybersecurity incident, you should not have to discover the limits of your provider’s responsibilities while the incident is underway.
A Simple Cybersecurity Incident Readiness Checklist
Managing partners can use these ten questions as a starting point for a conversation with their IT provider.
| Readiness question | Can your firm answer it? |
|---|---|
| 1. Who do employees contact first? | Yes / No / Unsure |
| 2. Who investigates and escalates suspicious activity? | Yes / No / Unsure |
| 3. Can compromised accounts and devices be contained quickly? | Yes / No / Unsure |
| 4. Do we know where important client information resides? | Yes / No / Unsure |
| 5. Who has authority to make incident decisions? | Yes / No / Unsure |
| 6. How will we communicate if normal systems are unavailable? | Yes / No / Unsure |
| 7. Who evaluates notification and insurance requirements? | Yes / No / Unsure |
| 8. Can we recover critical systems within acceptable timeframes? | Yes / No / Unsure |
| 9. Have we practiced the response process? | Yes / No / Unsure |
| 10. How do we document incidents and improve afterward? | Yes / No / Unsure |
If several answers are “unsure,” that does not necessarily mean the firm has poor cybersecurity. It does suggest that leadership may not have enough visibility into how a serious incident would be handled. That is worth addressing before something happens.
Production Ready IT Means Preparing Before an Incident
At Everleap IT, we believe technology entrusted with confidential client information and critical legal work should be operated, not merely supported. That’s the idea behind Production Ready IT for law firms.
For more than 20 years, Everleap IT has operated production hosting environments where security, monitoring, availability, resilience, and recovery are everyday operational requirements. That experience shapes how we approach law firm technology.
Cybersecurity readiness isn’t simply about installing protection and hoping nothing happens. It means understanding the environment, identifying risks, maintaining security controls, preparing recovery procedures, and establishing clear responsibilities before an incident occurs.
Today, Everleap IT provides managed IT and cybersecurity services to law firms across Southern California. We work with firms throughout the Inland Empire, Los Angeles, and the San Gabriel Valley, including communities such as Rancho Cucamonga, Ontario, Upland, Chino, Claremont, Riverside, Pasadena, and surrounding areas.
Our goal is to help law firms protect confidential client information, keep attorneys productive, and maintain technology environments that are ready when the firm needs them.
Would Your Law Firm Know What to Do Tomorrow?
You cannot guarantee that your law firm will never experience a cybersecurity incident. But you can prepare for how the firm will respond. Start with one question for your current IT provider: “If we discovered a serious cybersecurity incident tomorrow morning, walk me through exactly what would happen during the first hour.” A good answer should identify responsibilities, communication procedures, containment capabilities, escalation steps, and the decisions leadership may need to make.
If you’d like to evaluate your firm’s cybersecurity readiness and understand where improvements may be needed, schedule a Technology Strategy Call with Everleap IT.
Not ready for a conversation? Download our IT Buyer’s Guide to help evaluate whether your firm’s technology is being proactively managed.
