Quick Cybersecurity Check-up for Law Firms (VLSB+C Basics)

1

Your law firm name* This field is required.

2

For each statement, choose the option that best describes your practice today.

Single Choice answer options:

Yes – we do this for everyone / all the time
Partly – we do this sometimes or only for some people
No – we don’t really do this yet
Not sure – I don’t know if we do this

3

All our computers, laptops and other work devices install updates automatically (for example Windows / Mac updates and main software we use for work).* This field is required.

Yes

Partly

No

Not sure

4

Myself or someone else in the firm checks at least once a fortnight that updates are successfully installed and reports any issues.* This field is required.

Yes

Partly

No

Not sure

5

All staff members use strong, unique passwords or passphrases for their work accounts (not the same as their personal passwords).* This field is required.

Yes

Partly

No

Not sure

6

We use a password manager to store and share passwords (not sticky notes, email, or Word documents etc.).* This field is required.

Yes

Partly

No

Not sure

7

Staff understand that they must not share their individual login details (username and password) with anyone else, even colleagues* This field is required.

Yes

Partly

No

Not sure

8

Where multi-factor authentication is available, we have it switched on for all our key systems, including email, practice management system, document storage and internet banking.* This field is required.

Yes

Partly

No

Not sure

9

Staff know that they must never share with anyone their security codes and must not click “approve” on login prompts they didn’t start themselves.* This field is required.

Yes

Partly

No

Not sure

10

All firm computers have security or antivirus protection turned on (at least the protection that comes with the device).* This field is required.

Yes

Partly

No

Not sure

11

Regular virus and malware scans run automatically or at least once a week, and someone checks and deals with any warnings.* This field is required.

Yes

Partly

No

Not sure

12

Each person has their own user account to log in to firm systems (we don't use shared accounts except where there is no other option).* This field is required.

Yes

Partly

No

Not sure

13

All permanent and temporary staff can only access the systems and online storage locations they need to do their job, and we remove or change their access as soon as they leave the firm or change roles.* This field is required.

Yes

Partly

No

Not sure

14

Our computers are set up so that the hard drive is encrypted (for example using BitLocker on Windows or FileVault on Mac). Encrypted here means that if a computer is lost or stolen, the data on it can’t be read.* This field is required.

Yes

Partly

No

Not sure

15

Devices automatically lock themselves after a short time not being used, and staff do not leave unlocked devices unattended in public or shared areas.* This field is required.

Yes

Partly

No

Not sure

16

Sensitive client information (for example identity documents, financial details) is stored in protected systems or locations, not on sticky notes, unprotected documents, local drives or USBs.* This field is required.

Yes

Partly

No

Not sure

17

When we dispose of an old computer, phone, USB stick, or external drive, we wipe or destroy it properly so that our data cannot be recovered.* This field is required.

Yes

Partly

No

Not sure

18

We take regular backups of important information (matter files, emails, trust and office accounting records), both in the cloud and on secure external storage.* This field is required.

Yes

Partly

No

Not sure

19

In the last 12 months we have actually tested that we can restore data from a backup, not just assumed it will work.* This field is required.

Yes

Partly

No

Not sure

20

Everyone in the firm gets basic cybersecurity training at least once a year (for example on spotting suspicious emails and safe online behaviour).* This field is required.

Yes

Partly

No

Not sure

21

Staff know what to do and who to contact in the firm if they see something suspicious (for example a strange email, ransomware screen or suspected fraud).* This field is required.

Yes

Partly

No

Not sure

22

Before sending trust money or settlement funds, we confirm the client’s bank details using a separate method (for example phoning a trusted number, not just replying to an email).* This field is required.

Yes

Partly

No

Not sure

23

We warn clients that bank details in emails can be changed by cyber criminals, and we ask them to double-check payment details with us using another trusted method.* This field is required.

Yes

Partly

No

Not sure

24

We have a written plan that sets out what to do in case of a cyber incident (for example who to contact, which systems to turn off, who speaks to clients , insurers and authorities).* This field is required.

Yes

Partly

No

Not sure

25

We feel confident that we could act quickly if there was a cyber incident.* This field is required.

Yes

Partly

No

Not sure

26

Your law firm representative

First Name

Last Name

27

Email* This field is required.Please add your email address so we can send you your results. We’ll only use it to share your assessment summary and, occasionally (very rarely), genuinely helpful cybersecurity tips for law firms – no spam, no inbox flooding.

example@example.com

28

Your firm's cybersecurity readiness score is :The score is expressed in percentages (%)