Top 7 Cyber Insurance Questions for Florida Law Firms (2026)

The 7 Questions

1. Do you enforce MFA on email, remote access, and administrator accounts?

Applications commonly split this into three separate questions: one for email, one for remote access, and one for administrator accounts. Multi-factor authentication (MFA) adds a second step, such as an app approval or a hardware key, on top of the password. The ABA notes that MFA typically costs nothing, yet only 54% of surveyed attorneys said their firm even had two-factor authentication available. Microsoft’s own data, cited in the same report, says MFA stops 99.9% of credential-based account attacks.

What the insurer is really asking is whether a stolen password alone gives someone access to your email. For a law firm, that inbox holds client communications and settlement discussions. Business email compromise and funds-transfer fraud made up 58% of claims in Coalition’s 2026 report, as summarized by Uptime Legal (VERIFY against Coalition’s original report).

A good answer is “every account,” not “most.” Uptime Legal notes that MFA for most users counts as a no. In practice that means MFA enforced in Microsoft 365 (using an app such as Microsoft Authenticator) or Google Workspace (2-Step Verification), on every remote access path, and on every administrator account, for attorneys, paralegals, and staff alike. A hardware key such as a YubiKey is a common choice for administrators. The evidence to keep is an admin report showing MFA enforced on every account. Huntress, a security vendor, goes further and calls MFA the most consistently enforced item on carrier questionnaires and the most commonly cited reason for denial when it is missing.

2. How do you back up your data, and when did you last test a restore?

Applications ask two separate things. First, whether backups are offline, immutable, or otherwise separated from the main environment. “Immutable” means the backup cannot be altered or deleted for a set period, so ransomware that reaches your network cannot reach it. Second, whether you test restoring from backup. The ABA survey found that 43% of respondents use an online backup service and 32% use an external hard drive, and an external drive that stays plugged into the network sits within ransomware’s reach. The ABA’s advice is blunt: do not just trust a report of a successful backup, perform test restores.

A good answer describes encrypted backups on a defined schedule to a location apart from your main systems. Veeam, Datto, and Acronis are examples of business backup products, and it is worth asking whichever vendor you use whether it offers immutable storage. Todyl says an organization should be able to document its backup testing cadence and show evidence of a successful restore. The evidence to keep is a dated restore test log. If your last test was never, the honest answer is “no,” and the fix is to schedule one.

3. What endpoint protection do you run, and is it monitored?

Applications distinguish between basic antivirus and endpoint detection and response (EDR). Antivirus blocks known threats. EDR watches for attacker behavior that antivirus misses and alerts someone who can act. Uptime Legal phrases the application question as whether EDR runs on all endpoints and servers, and the evidence it lists is a console report showing device coverage. “All” matters: protecting five of six laptops is not a yes. Guides from Huntress and Todyl both list EDR among carrier expectations.

A good answer names the product and says who watches the alerts after hours. Microsoft Defender for Business, SentinelOne, CrowdStrike Falcon, and Huntress Managed EDR are examples of products in this category. If the answer is “we have antivirus,” say so on the form and treat it as the gap to close before renewal.

4. Do you have a written incident response plan?

Uptime Legal lists a written incident response plan (IRP) among the controls an underwriter wants proven, and Huntress notes that carriers may ask to see it. Florida attorneys have a second reason to care. The Florida Bar’s Committee on Cybersecurity and Privacy Law issued Recommendation 25-1, approved by the Board of Governors Technology Committee on March 27, 2025, recommending that all Florida Bar members and their firms prepare and annually maintain an IRP. It is voluntary and non-binding, and it suggests completing a data mapping survey and maturity assessment within 2 years and having an IRP in place within 3 years. It also says the sophistication of a plan will vary with firm size.

Most firms do not have one yet. The ABA survey found that 34% of respondents had an IRP, down from 42% the year before, and the figure was 19% for both solo lawyers and firms of 2 to 9 attorneys. The recommendation includes a sample IRP template for law firms, with assigned roles for an incident response lead, IT support, a compliance officer, and a communications lead.

A good answer is a short written plan that says who is in charge, who to call (your IT provider, your insurance carrier, and your own counsel), how you will preserve evidence, and how you will communicate with affected clients. The evidence to keep is the plan itself with a dated review.

5. Are your operating systems and software supported and patched?

Applications ask how quickly you apply critical patches and whether you run any end-of-life software or systems. Uptime Legal lists a patch compliance report and an asset list showing vendor support status as the evidence.

The clearest 2026 example is Windows 10. Support ended on October 14, 2025, and Microsoft no longer provides technical support, feature updates, or security fixes for it. PCs keep working, but without fixes. Microsoft sells paid Extended Security Updates to businesses through volume licensing at $61 per device for Year One, with the price doubling each year for up to three years. The same logic applies to an old server in a closet running software its vendor no longer patches.

A good answer is that every device runs a supported operating system or is enrolled in Extended Security Updates, with a dated replacement plan for anything that is not. Uptime Legal adds that the patching schedule should cover firewalls, remote access tools, and legal software, not just Windows.

6. Who has administrator rights and access to client files, and how do you remove access when someone leaves?

Uptime Legal lists “Do users have local admin rights?” as an application question, because one phished staff account with admin rights can install software on the machine. The evidence is a device policy report. Access control is also a law-firm issue in its own right: the data mapping guide attached to the Florida Bar’s Recommendation 25-1 gives role-based access as its example for client records and says to review access controls regularly.

A good answer has four parts: each person has an individual login (no shared “paralegal” account), access to case files follows role, admin rights are removed from everyday accounts, and a written offboarding checklist removes all of a departing employee’s access the same day. Offboarding did not appear in the application questions we reviewed, but it is the step that keeps the other three true over time. The evidence to keep is the device policy report, a list of admin accounts, and a dated record of each offboarding.

7. Do you filter email and train staff on phishing?

Uptime Legal’s list includes exactly this question, with filtering settings and training completion records as the evidence. The ABA’s report says many data breaches start with a phishing email and recommends awareness training at least once a year. The same survey found that 80% of respondents had some sort of spam filter available.

Picture a paralegal who receives what looks like a document from opposing counsel, or a message that appears to come from you with changed wire instructions for a settlement. Insurers want both layers: a technical layer that stops phishing before it reaches the inbox, and a human layer for what gets through. Microsoft Defender for Office 365, Proofpoint, and Mimecast are examples of email filtering, and KnowBe4 is one example of training with simulated phishing tests.

A good answer is that filtering is on for every mailbox and that staff completed training within the past year, with completion records. Training that happened once, two years ago, does not meet the ABA’s annual minimum.