Outside counsel guidelines: how should law firms answer security questionnaires?

What are outside counsel guidelines, and why do they include security questionnaires?

Outside counsel guidelines are the terms a corporate client sets for how its law firms bill, staff and handle its matters, and many now include a security section with a questionnaire. The client's own regulators, auditors and insurers ask how it manages the vendors that hold its data, and outside counsel is one of those vendors. A firm handling a bank's litigation, a health system's investigations or a defense contractor's deals holds some of that client's most sensitive files, so the client's vendor risk team sends the same questionnaire it sends a payroll provider.

Some clients send an annual questionnaire; others send one at intake for each new matter. Either way, the answers become representations the client may rely on, and a firm that guesses its way through one can create a contract problem it did not have before.

Can outside counsel guidelines change a lawyer's duty of confidentiality?

Yes, they can add to it. ABA Model Rule 1.6(c) requires a lawyer to "make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client." Comment [18] lists the factors for what is reasonable: the sensitivity of the information, the likelihood of disclosure without more safeguards, the cost and difficulty of adding them, and how far they would hinder the representation.

The same comment says that "a client may require the lawyer to implement special security measures not required by this Rule or may give informed consent to forgo security measures that would otherwise be required by this Rule." The first half is the ethical footing for most outside counsel guidelines: once the firm accepts a guideline, the client's requirements sit on top of the baseline duty. The second half works in the other direction, and only through the client's informed consent.

ABA Formal Opinion 477R, issued in May 2017, adds that reasonable efforts call for a fact-based analysis and that lawyers should consider agreeing with the client at the outset on the level of security for each type of communication. A questionnaire is that conversation, written down.

California firms carry a stricter statutory baseline. Business and Professions Code section 6068(e)(1) requires an attorney to "maintain inviolate the confidence, and at every peril to himself or herself to preserve the secrets, of his or her client," and comment 1 to California rule 1.1 ties competence to keeping up with the benefits and risks of relevant technology.

What do law firm security questionnaires usually ask?

Most ask the same core questions in different words. Expect sections on:

• Identity and access: whether multi-factor authentication covers email, remote access and the document management system, and how quickly access is removed when someone leaves.
• Encryption: whether laptops, phones and backups are encrypted, and how files are sent to the client and to opposing counsel.
• Incident response: whether the firm has a written plan, who runs it, and how fast the client will be told about an incident touching its data.
• Vendors: which cloud services, e-discovery platforms and AI tools will touch the client's files, and how the firm vetted them.
• Data handling: where client data is stored, how long it is kept and how it is returned or destroyed at the end of the matter (see how long attorneys have to keep files in California).
• Testing and training: how often the firm runs vulnerability scans or penetration tests, and how often staff are trained.
• Insurance: whether the firm carries cyber liability coverage and at what limits.

Newer questionnaires add a section on generative AI: whether attorneys may put client information into AI tools, and which tools. Firms that already follow ABA Formal Opinion 512 on generative AI usually have the substance of that answer in their AI policy.

How do you answer a security questionnaire item the firm cannot fully meet?

Say what the firm does today, state the gap plainly, and give a date or a compensating control. A partial answer that is accurate protects the firm far better than a "yes" that is aspirational.

Three patterns cover most gaps:

• Partly in place: "MFA is enforced for email and remote access. Enforcement on the document management system is scheduled for completion by March 31."
• Met another way: "We do not run annual third-party penetration tests. We run monthly authenticated vulnerability scans and remediate critical findings within the window set in our policy."
• Not agreed: some guideline terms are business terms the firm may decline or negotiate, such as unlimited audit rights, very short incident notice windows, or indemnities for any security event. The managing partner should decide those, not the person filling in the form.

If the firm accepts a requirement it does not yet meet, record it as a commitment with an owner and a deadline. A firm that signs a guideline promising encrypted transfer for every document, and then emails discovery as plain attachments, has a breach of its engagement terms waiting to be found.

Who at a law firm should own security questionnaire answers?

One named person should own the questionnaire process, with sign-off from firm management. California rule 5.1 requires lawyers with managerial authority to make reasonable efforts to ensure the firm has measures giving reasonable assurance that all lawyers comply with the rules, and a management sign-off on security answers is a practical way to show that oversight.

In practice, the IT lead or managed IT provider drafts the technical answers, the office administrator or general counsel checks them against the engagement terms, and a partner signs. Whoever owns the process keeps every completed questionnaire, the date sent and the version of the answers used. When the next client asks the same question, the firm answers consistently.

Breach notice deserves special care. ABA Formal Opinion 483 says lawyers have a duty to notify current clients of a data breach involving material client information. Many guidelines go further and set a specific window. The firm should know what window it has promised to each client and whether its IT provider's own notice terms make that window achievable.

How can a law firm prepare for its next client security questionnaire?

Build one evidence file, keep it current, and answer every questionnaire from it. A practical sequence for this quarter:

• Collect the last three questionnaires the firm received and list every question, merging the ones that ask the same thing in different words.
• Write one approved answer for each, with the evidence behind it: MFA reports, encryption status, backup test results, training records, the incident response plan and the vendor list.
• Mark each answer with an owner and a review date. Review the full set at least once a year and whenever a major system changes.
• Pull the security sections from every active outside counsel guideline into one table showing the commitment, the client and the date accepted.
• Flag any commitment the firm does not meet today and assign a fix or a negotiation.
• Confirm cyber insurance limits and the incident notice terms in the policy, since questionnaires ask about both.

A firm with this file answers questionnaires faster and more consistently, and it learns where its real gaps are before a client does.

How does s90 help law firms with security questionnaires?

s90 works with law firms across Los Angeles and Orange County to keep the technical evidence behind questionnaire answers current: MFA coverage, encryption, backups, vendor inventory and incident response. Our agreements commit s90 to notify clients within 72 hours of a breach affecting their systems and to produce evidence within 24 hours of a request, which helps a firm keep the notice and audit promises it makes to its own clients. If your next questionnaire is due soon, we are happy to review it with you.