Law firm cyber security incident response checklist
Law firms hold sensitive client data and are targets for ransomware, BEC, and phishing. This checklist is for firms responding to a suspected cyber security incident.
This is a 12-step cyber security incident response checklist for Australian law firms. It covers detection, containment, notification, and recovery.
The checklist
Activate incident response plan
Activate the firm's incident response plan and notify the response team.
Preserve evidence
Preserve logs, disk images, and affected systems before containment.
Contain the incident
Isolate affected systems from the network to prevent lateral spread.
Engage IT forensics
Engage internal or external forensic experts to identify scope.
Notify cyber insurer
Notify the cyber insurer within the policy notification period.
Assess data compromise
Identify what personal, client, and confidential data has been accessed or exfiltrated.
Assess privacy breach obligations
Assess whether the Notifiable Data Breaches scheme is triggered.
Notify OAIC if required
Notify the OAIC and affected individuals within 30 days of becoming aware.
Notify clients
Notify affected clients of the incident and any impact on their matters.
Notify law society
Consider notifying the law society or legal regulator if client trust funds are affected.
Recover systems
Restore systems from clean backups and verify integrity.
Conduct post-incident review
Conduct a post-incident review and update the incident response plan.
When this checklist applies
Use immediately when a cyber incident is detected or suspected.
Common pitfalls
- Containment before evidence preservation
- Insurance notification missed
- Data scoping rushed
- OAIC notification deadline missed
- Backups not verified before recovery
Run this checklist on a real matter
Quillio can help assess privacy breach obligations and prepare OAIC notification. See /practice-areas/firm-management or start a free trial.
General guidance for cyber incident response. Apply specific firm IR plan and regulatory obligations.
Use this checklist on your matter.
Quillio can run this checklist on a specific NSW conveyancing matter — confirm each item, calculate adjustments, and generate the supporting documents. The free trial requires no credit card.
Start your free trial