Template: The Outside Counsel Data Security Questionnaire (Copy and Paste)

Your company runs vendor security reviews on the office snack supplier. Your outside counsel, who holds your M&A files, employee data, and litigation strategy, probably got a two-question email in 2021. Let's fix that.

Why now: The ABA Journal reported on September 23 that a Seyfarth Shaw employee was deceived by someone impersonating the firm's IT help desk into emailing client documents to an unauthorized account. Lawyer Monthly reported the incident occurred on August 18, 2026, and that the firm said its security controls kept the attacker out of its network and systems. The firm has said it is adding employee training and offering credit monitoring. This isn't about one firm. It's a reminder that your data is only as safe as the least-trained person holding it, including at your law firms.

Below is a copy-and-paste questionnaire. Send it with your next engagement letter or annual panel review.

How to use this template

1. Tier your firms. Full questionnaire for firms holding sensitive personal data, trade secrets, or deal information. Sections 1 and 4 only for low-risk matters.
2. Ask for evidence, not adjectives. "We take security seriously" is not an answer. Ask for certifications, policies, and dates.
3. Store answers where you manage the relationship. Attach responses to the firm's record in your enterprise legal management or matter management system, and set a renewal reminder.
4. Score it. Mark each answer Green (meets), Yellow (partial or plan in place), or Red (no). Any Red in Sections 2 or 3 triggers a follow-up call.

Section 1: Governance and certifications

• Does the firm hold a current ISO 27001 certification or SOC 2 Type II report? Provide the date of the latest audit.
• Who is accountable for information security (name and title)?
• When was the firm's last independent penetration test?
• Does the firm carry cyber insurance, and does it cover client notification costs?

Section 2: People and social engineering

• How often do all staff, including lawyers, complete security awareness training?
• Does training specifically cover help-desk and IT impersonation, phishing, and voice or video deepfakes?
• Does the firm run simulated phishing or social engineering tests? What was the most recent failure rate?
• What verification step is required before an employee sends client files to a new or external address?

Section 3: Data handling

• Are our documents stored in a document management system with matter-level access controls?
• Is outbound email scanned or blocked for sensitive data such as Social Security numbers?
• Is multi-factor authentication required for all remote and email access?
• Will the firm return or destroy our data at matter close, and certify it in writing?
• Which third parties (e-discovery vendors, AI tools, cloud providers) will touch our data? Are client documents used to train any AI model?

Section 4: Incident response

• How quickly will the firm notify us after discovering an incident involving our data? (Ask for a specific number of hours, in writing.)
• Who is our named point of contact during an incident?
• Will the firm cooperate with our breach counsel and forensic vendor, and share its investigation findings?
• Has the firm experienced a reportable incident in the last 24 months? If so, what changed afterward?

Section 5: Contract language to add

Add a short clause to your outside counsel guidelines covering: minimum security controls, a notification window, cooperation obligations, cost responsibility for notification caused by the firm's incident, and your right to request updated questionnaire answers annually.

A security questionnaire won't stop every attack. It will tell you, before an incident, which firms have thought about the problem and which are hoping you won't ask.

Quick scoring guide

• 0 Reds, 3 or fewer Yellows: Approved. Re-review in 12 months.
• 1 or 2 Reds outside Sections 2 and 3: Approved with a remediation plan and a 90-day check-in.
• Any Red in Section 2 or 3: Limit the sensitive data you share until fixed.

This article is general information, not legal advice.