200-attorney law firm, IOLTA-compliant security from day one, vCISO program

Engagement at a glance

Industry: Litigation law firm, multi-practice. Size: 200 attorneys, ~380 total staff. Trigger: Lateral partner group joining brought IOLTA-handling and cyber-insurance-renewal pressure into focus. Engagement type: CaaS + vCISO. Duration: Initial 30-day stand-up, ongoing engagement (currently year 2). Status: IOLTA-compliant from day one of post-stand-up operations; cyber-insurance renewal completed cleanly.

The situation

A 200-attorney multi-practice litigation firm in West Michigan added a 12-partner lateral group with a substantial IOLTA-handling practice. The lateral group's prior firm had been the subject of a state-bar inquiry into trust-account handling several years earlier; the partners were specifically attuned to the cybersecurity baseline around client funds.

The firm's existing security posture was, by industry standards, average: MFA was deployed on email but not on the document management system; EDR was deployed on workstations but not on the file server hosting trust-account-adjacent documents; the firm had a written security policy that hadn't been updated in 18 months; the cyber-insurance policy had begun asking for documented controls at the last two renewals.

The lateral group's joining accelerated three conversations the firm had been deferring: a comprehensive security baseline aligned to ABA and state-bar trust-account-handling guidance, a vCISO relationship to own the security program going forward, and a cyber-insurance renewal that would test whether the policy actually paid out under the new controls-based underwriting model.

What we did

Engagement structure: a 30-day stand-up of CaaS for managed-cybersecurity operations, paired with a vCISO retainer for governance, ABA-guidance mapping, and ongoing board-equivalent reporting. CaaS at $95/user/month scaled across the firm. vCISO retainer at $8,500/month given the firm's size and complexity.

Days 1-10, inventory and gap closure for IOLTA-adjacent systems. The trust-account-handling systems (the IOLTA bank's secure portal, the firm's document management system folders related to trust matters, the email accounts of attorneys with trust-handling authority) were inventoried and mapped against ABA cybersecurity guidance and the relevant state-bar formal opinions. MFA was deployed firmwide. Conditional access policies were configured for trust-account-adjacent systems specifically, multi-factor required, geographic restrictions enforced, anomaly-triggered re-authentication.

Days 11-20, broader security baseline. EDR coverage extended to 100% of endpoints and the file server. Encrypted backups tested with a documented restore. The 18-month-stale security policy rewritten and re-issued. Incident response plan written. Vendor risk assessments completed for the firm's seven principal SaaS vendors.

Days 21-30, cyber-insurance renewal preparation. The renewal questionnaire's controls section, which the firm had previously filled out from memory, was now answered from documentation. MFA coverage 100% (was 78%). EDR coverage 100% (was 92%). Tested backup restore (was untested). Written incident response plan (was placeholder). Named security executive (the vCISO).

Ongoing, monthly vCISO operations. Monthly board-equivalent reporting to the firm's management committee. Quarterly tabletop exercises (covering scenarios including a partner-account-takeover during a trust transfer). Annual ABA-aligned risk assessment. Vendor risk review program. The vCISO attends carrier-renewal calls and partner-meeting security briefings.

Outcomes

The 30-day stand-up delivered an IOLTA-compliant baseline that matched the lateral group's expectations from the prior firm's remediation work.

MFA coverage 100% firmwide (from 78%, with the missing 22% covering the document management system and several SaaS vendors that hadn't required it).

EDR coverage 100% endpoints and file server (from 92% endpoints, 0% file server).

First tested backup restore in firm history. Recovery time objective measured at 4 hours; recovery point objective measured at 1 hour.

Cyber-insurance renewal completed at 22% below the carrier's initial quote based on documented controls evidence. The prior year's renewal had no controls documentation; the new year's had a documented vCISO-attended program.

Two ABA-formal-opinion-related gaps closed in the trust-account-handling workflow, addressing the lateral group's specific concerns.

What to do next

If your firm handles client funds, regulated client data, or has cyber-insurance renewal pressure: the Scorecard maps your current state against the ABA cybersecurity guidance and the most-common state-bar formal opinions, plus your applicable regulatory frameworks.

Run the Scorecard →, 5 minutes.

Book a vCISO scoping call →, 20 minutes with a named human within four business hours.

For full vCISO engagement details: /vciso.