- within Technology topic(s)
- in United States
- with readers working within the Banking & Credit, Business & Consumer Services and Healthcare industries
- within Technology, Government and Public Sector topic(s)
- with Inhouse Counsel
Clients are starting to ask law firms a different kind of question before approving, renewing, or expanding work. It is no longer only, “Can this firm handle the matter?” It is also, “Can this firm protect the information we are about to give them?”
Law firms are used to being trusted advisors. So now when a firm receives confidential client information, accesses client systems or manages sensitive documents, it also becomes part of the client’s third-party risk profile.
That changes the conversation.
For Sanjay Chadha, Partner at Toronto-based SAV Associates, the shift is important because it moves cybersecurity from the back office into the client relationship. A law firm may still be selected for its legal expertise, but increasingly, clients also want comfort that sensitive information will be handled with proper security, control, and accountability.
A Toronto firm being added to a bank’s external counsel panel may be asked about, multi-factor authentication, encryption, incident response, and cyber insurance before the panel appointment is finalized.
A Calgary litigation firm supporting an energy client may be asked how documents are shared, who can access them, and whether backups are tested.
A Vancouver technology lawyer helping with a SaaS transaction may see cybersecurity questions appear before the data room opens.
An Ottawa firm advising a defence supplier may be asked whether it understands CyberSecure Canada, CPCSC, or other assurance expectations before sensitive work begins.
For many firms, the first real test of cybersecurity maturity does not come from a breach. It comes from a client asking for evidence.
The Shift at a Glance
This is not about law firms becoming technology companies. It is about clients treating external advisors as part of their risk environment.
Corporate clients, public-sector organizations, financial institutions, healthcare groups, technology companies, and regulated businesses all face pressure to manage third-party risk. If sensitive information leaves the organization, or if an outside provider gets access to systems, the client needs to know how that information and access are protected.
Law firms often handle the information clients worry about most:
- privileged communications,
- personal information,
- employment records,
- transaction documents,
- litigation material,
- regulatory correspondence,
- financial records,
- intellectual property,
- and commercial strategy.
From the relationship side, the firm is counsel. From the risk side, the firm is also a third party.
That is why cybersecurity reviews are starting to appear in places that used to feel mainly legal or commercial: onboarding, RFPs, panel appointments, contract renewals, data room access, cyber insurance discussions, and procurement approvals.
Sanjay Chadha stated, “The practical concern is simple. If a law firm cannot clearly explain how it protects client information, the client may see that as a business risk even where the legal relationship is strong.”
What This Looks Like in Practice
The questions client have are purely practical.
A client may ask whether the firm has written information security policies, multi-factor authentication for email and remote access, access approval procedures, periodic access reviews, incident response procedures, secure file-sharing practices, cyber awareness training, backup testing, cyber insurance, and oversight of IT providers or cloud vendors.
Higher-risk clients may go further. A firm supporting financial services, healthcare, technology, government, defence, or critical infrastructure work may be asked about vulnerability assessments, penetration testing, vendor risk management, SOC 2, ISO 27001, CyberSecure Canada, CPCSC, or other assurance evidence.
Not every law firm needs every certification. But more firms are being asked to explain what controls they have, how those controls operate, and whether the answers are supported by evidence.
Mr. Chadha cautions that this is where firms need to be careful. A questionnaire response is not just a form. It can become a representation about how the firm protects client information
Why This Is a Relationship Issue
Most managing partners understand confidentiality. The more immediate issue is whether the firm can move through the client’s approval process without creating friction.
If a client asks for security evidence and the law firm cannot produce it, the matter may slow down. Procurement may pause approval. In-house counsel may send follow-up questions. IT or risk may ask for clarification. A panel appointment may be delayed. A regulated client may hesitate before granting system access or sharing sensitive documents.
The law firm may have the right expertise, the right relationship, and the right pricing, but still lose momentum because the security review is not ready.
That is what makes this a business issue. Client trust now increasingly needs to be documented, not just assumed.
Where Firms Often Get Stuck
The honest challenge for many law firms is not that they are careless. It is that their controls may be informal, undocumented, untested, or spread across different people and vendors.
A firm may have multi-factor authentication enabled, but no record showing when access was last reviewed. It may rely on an external IT provider but not have evidence showing how that provider is monitored. It may have backups running, but no recent restoration test. It may have policies, but those policies may not reflect how people actually work across email, remote access, mobile devices, personal devices, document-sharing platforms, and client portals.
Ownership is another common problem. A client questionnaire may land with a partner, office administrator, IT provider, operations lead, or privacy contact. No one owns the full answer. The firm responds from scratch each time.
That is where inconsistency starts. One response says training happens annually. Another says it is informal. One response says access is reviewed periodically. Another cannot confirm when the last review happened.
Inconsistency can make a firm look less prepared than it actually is.
What Firms Should Prepare Before the Next Review by Sanjay Chadha
The first step is to understand what client information and systems the firm actually touches. A litigation practice, employment practice, M&A practice, privacy practice, and technology practice may all create different exposure.
The second step is to review current controls honestly. Are access rights approved and reviewed? Is multi-factor authentication used consistently? Are backups tested? Is incident response documented? Are IT and cloud providers reviewed? Are staff trained on secure handling of client information? Do policies match daily practice?
The third step is to organize evidence before the next client request arrives. This may include policies, training records, access review logs, backup testing results, insurance documentation, vendor review records, vulnerability assessment results, penetration testing reports, or other assurance evidence.
For firms serving higher-risk clients or regulated sectors, an external cybersecurity assessment, vulnerability assessment, penetration test, or certification readiness review may help identify gaps before a client does.
The Bottom Line
Client cybersecurity reviews are not a sign that clients distrust their law firms. They are how many clients now document trust.
For law firms, the goal is not to become a technology company. The goal is to answer reasonable client security questions with confidence, evidence, and consistency.
SAV Associates helps professional services firms assess cybersecurity readiness, identify control and documentation gaps, prepare for client security reviews, support consistent questionnaire responses, perform vulnerability assessments and penetration testing, and prepare for assurance or certification requirements such as CyberSecure Canada, ISO 27001, SOC 2, CPCSC, or related frameworks where relevant.
Client trust has always been central to legal practice. The difference now is that more clients want to see how that trust is protected.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
