Few investments tell a law firm more about its own security posture than a cyber risk assessment, and few sit on the to-do list for longer.

Cyber insurers are asking for more evidence at renewal, and clients are asking more pointed security questions, which is why more Ontario firms are putting the topic on the agenda. The hesitation usually comes down to not knowing what the process involves or what the firm will walk away with at the end of it.

Here’s what a cyber risk assessment looks at and what law firms come away with once the report lands.

Why Law Firms Request Cyber Risk Assessments

Most firms don’t request an assessment out of nowhere. The trigger is usually external and increasingly frequent. Common ones include:

• A cyber insurance renewal questionnaire that asks for more than the firm can confidently answer
• A corporate client sending over a vendor security questionnaire before signing a new engagement
• A new managing partner or COO wanting a clear baseline of where the firm stands
• Awareness of an incident at another firm of similar size, which prompts the question of whether the same gaps exist internally
• A change of IT provider, where the new team wants documented evidence of what is in place
• Quiet pressure to meet the Law Society of Ontario's expectations on technological competence (commentary to Rule 3.1-2) and the duty of confidentiality (Rule 3.3-1).

The common thread is that someone has been asked a question the firm cannot answer with confidence. An assessment turns assumptions into evidence.

What the Assessment Typically Reviews

A good cyber risk assessment is structured, benchmarked against the Canadian Centre for Cyber Security's baseline controls (the same 13 behind CyberSecure Canada), and proportionate to the firm's size.

It aims to give a clear, defensible view of the firm’s current security posture across the areas that matter most for a legal practice. Most assessments examine the following:

• Identity and access controls. How accounts are created and managed, how multi-factor authentication (MFA) is applied across systems, and how access is removed when someone leaves.
• Email security. Whether the settings that stop criminals sending email in the firm's name (DMARC, DKIM, and SPF) are fully in place, plus anti-phishing controls and the firm's exposure to spoofing and business email compromise, a common route into trust account and real estate closing fraud.
• Devices and data. How laptops, desktops, and phones are secured and kept up to date, along with where client data lives, how it's shared, and who can reach it.
• Network and remote access. How the firewall, Wi-Fi, and remote access are set up, and what's exposed to the internet.
• Backup, recovery, and incident response. Whether backups are tested, how quickly the firm could recover from ransomware, and whether there’s a documented response plan that has been rehearsed.
• Awareness and governance. Security training history, phishing simulation records, named ownership of cybersecurity, and the policy documentation that supports them.
• Third-party risk. Which outside providers can reach firm data, from IT to practice management and billing software, and how that access is controlled.

What Firms Usually Discover

Findings rarely come as a complete surprise. Partners often have a sense of where the gaps are. What an assessment provides is specificity, evidence, and a clearer view of how those gaps interact with each other.

Common findings in mid-sized firms include:

• missing from the document management system (iManage, NetDocuments) or practice management platform (Clio, PCLaw)
• Former staff still hold active accounts months after they left, while some lawyers have administrator privileges they no longer need
• Email authentication is only partially configured, leaving the firm’s domain easier to spoof than the firm realizes
• Security awareness training was delivered once at onboarding, with no documented refresh since
• There’s no documented incident response plan, or the existing plan has never been tested
• Nobody clearly owns cybersecurity, with IT, the office manager, and the partners each holding a different piece of the picture
• There's no call-back step to verify changes to payment or trust account instructions.
• Staff use public AI tools with client information, and the firm has no policy on what’s allowed.

CDW Canada's 2026 Canadian Cybersecurity Study found that Canadian organizations keep increasing their security spending, yet foundational disciplines such as identity, third-party risk, and resilience are not advancing at the same pace. The study calls this a "maturity paradox," and it's one reason structured assessments matter: they surface the gaps that spending alone does not close.

The study calls this the “security maturity paradox,” and it is one reason structured assessments matter. They surface the gaps that spending alone doesn’t close.

What Happens After the Assessment

The output of an assessment is a report, but the value sits in what is done with it. A useful report:

• Lists each finding with a risk rating and a clear description of what is in place today
• Recommends a specific action against each finding
• Groups recommendations by priority so the firm knows what to address first
• Estimates the effort involved in each item, so the firm can decide what to take on and scope that work from there
• Provides a roadmap covering the next 90 days, six months, and twelve months

Each finding comes with a recommendation, and the firm decides whether to address it now, schedule it, or formally accept the risk.

For most firms, the first 90 days focus on closing the highest-likelihood risks. MFA, email authentication, access reviews, and a documented incident response plan often sit at the top of the list.

Longer-term work tends to cover governance and training, and, for firms that want a recognized credential, CyberSecure Canada certification.

The firm comes away with a defensible picture of where it stands, a clear plan, and the evidence to answer when an insurer, client, or regulator asks.

A Practical Outcome, Not a Rebuild

Most firms don’t need to rebuild their environment. The findings of a cyber risk assessment usually point to a handful of practical improvements that, taken together, close the routes most likely to be used against a firm of your size.

Often, the most useful outcome is knowing where to focus first and being able to provide a clear, supported answer when the next questionnaire lands.

Start with a Clear View of Where You Stand

The simplest first step is a complimentary Cyber Risk Snapshot from Manawa Networks. A few of your people run a short scan on their own computers, with no admin access and nothing installed, and you receive a plain-language report on what an attacker could reach: exposed files, weak or reused passwords, and gaps in sign-in protection. If it points to deeper questions, a full Cyber Risk Assessment provides the detailed findings and roadmap described above. If you'd rather start with what good looks like, The Law Firm’s Guide to Cybersecurity Compliance explains the controls, documentation, and governance practices Ontario law firms should review, without burying you in technical language.

FAQs

1. What is a cyber risk assessment for a law firm?

A cyber risk assessment is a structured review of a law firm’s security controls, benchmarked against a recognized framework. It covers identity and access, email security, endpoints, backups, incident response, training, and governance, and produces a prioritized list of findings.

2. How long does a cyber risk assessment take?

A cyber risk assessment for a mid-sized law firm typically takes two to four weeks, depending mostly on how quickly access and documents come together. It includes technical checks, short staff interviews, and a written report. Lawyer time is minimal: partners join a kickoff and a findings readout, and most of the work runs through IT and operations.

3. Will a cyber risk assessment disrupt the firm’s day-to-day work?

No. A cyber risk assessment is mostly observational, reviewing configurations, policies, and records, plus a few automated scans that don't affect day-to-day work.

4. Do we need to involve our current IT provider?

Usually, briefly. We ask for temporary read-only access to a few systems, such as Microsoft 365, and a few configuration reports. Nothing is changed, access is removed when we finish, and we keep your provider's time commitment small.

5. How often should a law firm have a cyber risk assessment?

Most law firms benefit from a full cyber risk assessment every year. Firms on a managed security program usually add lighter quarterly reviews in between. An annual cadence keeps cybersecurity controls current and makes insurance renewals and client questionnaires easier to answer.

6. What is the difference between a cyber risk assessment and a penetration test?

A cyber risk assessment reviews the firm’s overall security posture and governance. A penetration test is a focused technical simulation of an attacker. Most law firms start with an assessment, then add a penetration test if the findings indicate that one is needed.