Security questionnaires now reach firms of every size, and here is what the ABA's 2023 survey shows and how a small firm can answer one honestly.
A client sends a spreadsheet asking how you encrypt files, who can see them and what you would do after a breach. You worry that some answers will not be comfortable, and you came to practice law, not to fill in forms for someone else's procurement team. I understand both reactions, and how a firm handles its first questionnaire says more about it than any single answer inside.
What the ABA's 2023 survey shows
In the ABA's 2023 survey of lawyers, a national survey and not a Texas one, 22% of respondents said clients or potential clients had asked them to complete a security questionnaire. By firm size, that was 50% at firms of 100 or more lawyers, 48% at firms of 50 to 99, 27% at firms of 10 to 49, 14% at firms of 2 to 9, and 4% of solo practitioners.
Another 27% said clients had asked for security requirements documents or guidelines, and 14% said clients had asked for a security audit or review. On insurance, 40% of respondents overall said they had cyber liability insurance, down from 46% the year before, with 37% of firms of 2 to 9 lawyers and 31% of solo firms. The evidence you gather for a client is the same evidence worth having in hand for any conversation about coverage.
A small firm is less likely to be asked than a large one, but it happens at every size, so it is sensible to prepare before the first one arrives.
What I would do first
First, I would write a one or two page description of how your firm protects client information today: where files live, who can reach them, how they are backed up, how devices and email are protected, how staff are trained, and what you would do after an incident. Second, I would read the whole questionnaire before answering anything and ask the client what prompted it, since a short summary or written policy sometimes does the job. Third, I would answer from that page and tell the truth. If a control is not in place, say so, name the plan and the owner. A column of confident yeses invites follow-up questions, and your answers are statements the client may rely on. Finally, I would attach evidence where I can, such as a policy or a training record, and have one senior person own the final version.
Why honesty beats a perfect score
Tools matter, but most of these questions are about habits and people, and that is what the page captures. A good outcome is not a perfect score. It is a client who sees a firm that knows where its client information lives, can describe how it is protected and is honest about what it is still improving.
If you have one on your desk now, I am glad to look at it with you on a call with AssureRidge Cyber.