How Small Law Firms Are Answering Insurer Security Questionnaires in 2026

What Changed in Cyber Underwriting

A few years ago, cyber insurance questionnaires were largely checkbox exercises. Do you have antivirus? Check. Do you have a firewall? Check. Premium calculated, policy issued.

That's mostly over.

Carriers lost money. Ransomware claims, business email compromise payouts, and breach response costs pushed underwriters to look harder at what they were actually insuring. Munich Re projected the global cyber insurance market at $16.3 billion in 2025, and markets that large attract actuaries who do the math carefully. The result is technical underwriting: carriers now want to see that controls were deployed, used consistently, and tested — not just that someone said yes on a form.

For small law firms, this shift has practical consequences. Law firms handle privileged client data, financial records, and sensitive matters that make them attractive breach targets. They're also often under-resourced on IT. That combination makes insurers cautious, and caution now shows up as documentation requirements.

The Gap Between Controls and Evidence

Most small law firms have more security controls than they think. The problem is that controls and evidence aren't the same thing.

You might enforce MFA on Office 365. But can you produce a screenshot of the Conditional Access policy, plus a log showing it applied to all users? Your IT vendor might have deployed EDR on every endpoint. But do you have a report showing all devices covered, last active date, and alerting enabled?

What Insurers Actually Ask For

The questionnaire categories have stabilized enough that firms can prepare for them. Here is what comes up consistently:

Why Law Firms Have More at Stake Than Other Small Businesses

A data breach costs a small law firm an average of $36,000 — and that's before accounting for regulatory exposure, bar association notification requirements, and client relationship damage.

Bar rules in most jurisdictions now explicitly require lawyers to take reasonable steps to protect client information. “Reasonable steps” is increasingly being defined by reference to what security frameworks and insurers consider standard. A firm that can't satisfy a cyber insurance questionnaire is arguably having trouble satisfying its professional obligations.

This is not an IT issue dressed up in compliance language. It's a practice management issue.

What Misrepresentation Costs

If a firm answers “yes” to MFA enforcement and then has a breach where the attacker used credentials without MFA, the carrier has grounds to dispute the claim. This happens. Coverage denials after incidents frequently come back to questionnaire answers that didn't match actual practice.

The Evidence Folder: What to Build Before Renewal

This is not a long-term project. A firm that spends one afternoon gathering documentation can produce most of what a renewal questionnaire requires:

• —MFA enforcement proof — Screenshots or export showing MFA required for email, remote access, and admin accounts, with no bypass exceptions for regular users
• —EDR deployment report — Device list, coverage percentage, last-seen date, alerting configuration
• —Backup configuration — Retention settings, immutability configuration, storage location, who is responsible
• —Restore test log — Date of last test, what was restored, result, any failures or gaps identified
• —Incident response plan — Written document with roles, escalation contacts, decision criteria, and steps for the most likely scenarios
• —Tabletop exercise notes — Date, attendees, scenario tested, gaps identified, action items
• —Patch management report — Last patch run per device, operating system versions, update policy
• —Vendor list — Critical vendors, what data they access, any security documentation or contractual security clauses on file
• —Training records — Dates of security awareness sessions, who attended, any phishing simulation results

Keep this folder updated. When renewal comes, you're not assembling documentation under a deadline — you're reviewing something that already exists.

The Practical Test

If your insurer called tomorrow and asked for proof of MFA enforcement, EDR coverage, and your last backup restore test, could you produce all three in under five minutes?

If yes, you're in reasonable shape.

If you'd need to contact your IT vendor, dig through email threads, or explain that the policy exists but isn't written down anywhere — that's the gap. Not because the controls aren't there, but because the evidence isn't organized. Cyber insurance in 2026 is as much a documentation discipline as a security one.