Law MSP
Self-assessment

Legal practice IT risk self-assessment

Eighteen questions in six areas, for a partner, practice manager or internal IT person to answer in about ten minutes. Answer yes, no or unsure, then see which areas to address first.

Published by Law MSP, operated by Jinba IT · · General information, not legal advice.

How it works. Answer each question as things stand today. Treat a control you believe is in place but can't confirm as unsure. When you finish, the page lists the areas to address first and next, with a suggested step for each gap. Everything happens in your browser. Nothing you tick is sent to us or stored.

With JavaScript turned off, this page works as a plain list: read each question, and where your answer is no or unsure, the suggested step is shown beneath it.

1. Sign-in and accounts

  1. 1.1Is multi-factor authentication enforced for every account, including partners and shared mailboxes?

    If no or unsure: Enforce MFA for everyone with no standing exceptions, and block the older sign-in methods that can skip it.

  2. 1.2Do administrator rights sit on separate accounts used only for admin work?

    If no or unsure: Move admin rights to dedicated accounts, keep the list short and review it each quarter.

  3. 1.3Is access to email, files and the practice system removed on a leaver's last day?

    If no or unsure: Write a leaver checklist covering Microsoft 365, the practice system and vendor portals, and keep the mailbox for the firm.

2. Email and payments

  1. 2.1Does the firm confirm every change to bank details by phone, on a number already on file?

    If no or unsure: Adopt a written call-back rule for any change of payment details, and tell clients early that your details won't change by email.

  2. 2.2Would someone be alerted to a suspicious sign-in or a new mail forwarding rule at a weekend?

    If no or unsure: Ask your IT provider who watches sign-in alerts and mailbox rules outside office hours, and how fast they act.

  3. 2.3Do staff get regular practice at spotting phishing?

    If no or unsure: Run simulated phishing on a regular cycle, with a short refresher for anyone who needs it.

3. Laptops and phones

  1. 3.1Is every laptop and phone that holds firm data managed and encrypted?

    If no or unsure: Enrol every device in device management with encryption and compliance checks, including phones that receive firm email.

  2. 3.2Could a lost phone or laptop be wiped remotely today?

    If no or unsure: Test a remote wipe on a spare device so the steps are known before they are needed.

  3. 3.3Are Windows and Office updates applied on a schedule?

    If no or unsure: Patch on a schedule that avoids busy hours, and get a regular report of devices that are behind.

4. Backup and continuity

  1. 4.1Is Microsoft 365 backed up somewhere a compromised admin account can't reach?

    If no or unsure: Add an independent Microsoft 365 backup held outside the tenant.

  2. 4.2Do you know the date and result of the last restore test?

    If no or unsure: Ask for a restore test now, and for the date and result to be recorded every time.

  3. 4.3Does the firm have a written plan for an outage on a filing or hearing day?

    If no or unsure: Write a short plan using our guide to business continuity for law firms.

5. Practice systems and vendors

  1. 5.1Does the firm hold the account details and support contacts for every practice system vendor?

    If no or unsure: Record each vendor's account number, support route and authorised contacts somewhere the firm controls. See practice systems and Microsoft 365.

  2. 5.2Do you know how practice system data is backed up, and how quickly it can be restored?

    If no or unsure: Ask the vendor or your IT provider for the backup and restore arrangements in writing, and file them.

  3. 5.3Is a short test run after changes to Office, Windows or the practice system?

    If no or unsure: Adopt a ten-minute test script after every change, such as the one in our practice systems guide.

6. Documents and sharing

  1. 6.1Has the firm decided which system holds the record for each kind of matter document?

    If no or unsure: Settle it on one page and tell staff. Our guide to document management in Microsoft 365 sets out the questions.

  2. 6.2Are external sharing links limited, for example with expiry dates or no anonymous links?

    If no or unsure: Review external sharing settings in Microsoft 365, and set expiry for sharing links and guest access.

  3. 6.3Is there a written retention policy, with Microsoft 365 set up to follow it?

    If no or unsure: Have the firm settle its retention policy with its advisers, then configure Microsoft 365 to match.

Limitations

This is a self-assessment, so it reflects what the person answering believes is in place. It doesn't test anything, it gives no score, and it doesn't cover every risk a firm faces. A yes is worth confirming with evidence, such as a report, a setting or the date of a test.

It is general information, not legal advice, and it says nothing about whether a firm meets any legal or professional obligation.

Want it checked properly? Our free assessment is read-only: we look at your Microsoft 365 setup, sign-in security, devices, backups and licences without changing anything, and the findings are yours either way. Ask for a free read-only assessment.

Prefer evidence to a self-assessment?

Our free assessment is read-only and changes nothing. You keep the findings either way.

Get a quote