How a Mid-Size Law Firm Passed Its First Client Security Audit and Cut IT Spend 29% in the Process
6/25/20263 min read
Client-mandated security audits have become a routine part of doing business for law firms serving corporate clients, particularly in financial services, healthcare, and technology sectors. Large corporate clients increasingly require their outside counsel to complete detailed vendor security assessments before engagement — the same scrutiny they apply to any other vendor with access to sensitive corporate data. For law firms that have not previously faced this requirement, the first client security audit is frequently a difficult and revealing experience.
The client in this case study is a mid-size litigation and corporate law firm with 95 attorneys and approximately 140 total staff across two offices. A new corporate client in the financial services sector — representing a significant new business opportunity — required completion of a comprehensive vendor security assessment as a condition of engagement. The firm's managing partner, having never navigated this process, engaged us to help prepare for and pass the assessment.
Law firms are attractive targets precisely because of what they hold: privileged client communications, litigation strategy, financial data, intellectual property, and merger and acquisition details before they become public. Corporate clients increasingly recognize this and are extending their own security requirements to their outside counsel as a matter of standard vendor risk management.
The assessment findings
We conducted an internal security assessment ahead of the client's formal audit, using the client's own security questionnaire as the evaluation framework. The findings were extensive:
• Document management security: the firm's document management system had appropriate access controls for active matters but no formal process for restricting access to closed matters or implementing ethical walls between attorneys working on conflicting matters — a specific requirement in the client's questionnaire
• Email encryption: the firm had no email encryption capability for sensitive client communications, relying on standard TLS transport encryption that does not meet the end-to-end encryption requirement specified by sophisticated corporate clients for privileged communications
• Remote access security: attorneys working remotely connected via a VPN with single-factor authentication. The client's assessment explicitly required MFA on all remote access
• Vendor management: the firm used 14 different SaaS applications across practice management, billing, document review, and e-discovery, with no centralized vendor security review process and no BAAs or equivalent data protection agreements with several vendors handling client data
• IT infrastructure costs: the firm was paying $31,200 per month to its IT provider — a combination of an MSP contract and several standalone software licenses — at rates that had not been benchmarked against current market in over four years
The remediation
The remediation addressed both the specific client requirements and the broader security posture gaps the assessment revealed, executed over 16 weeks: ethical wall functionality implemented in the document management system with formal matter-closing access review procedures; email encryption deployed for privileged client communications using a client-side encryption platform integrated with the firm's existing email system; MFA deployed across all remote access points including VPN and cloud application access; vendor inventory completed across all 14 SaaS applications, with data protection agreements executed for the five vendors handling the most sensitive client data and three lower-value, redundant applications eliminated entirely.
The cost optimization that accompanied this work: the MSP contract was renegotiated using competitive bids, the three redundant SaaS applications were eliminated, and several standalone software licenses were consolidated into the firm's primary practice management platform, which included equivalent functionality the firm had been paying separately for elsewhere.
The outcome
The firm passed the client's security audit on the first submission — a outcome the client's procurement team noted was uncommon among law firms of comparable size completing the assessment for the first time. The new client engagement, representing approximately $1.8 million in projected annual billings, proceeded on schedule.
Total monthly IT spend reduction: from $31,200 to $22,150 — a 29 percent reduction. Annual savings: $108,600. The managing partner's comment: "We thought passing this audit would cost us money. It saved us money, and now we have a security posture that will make the next client audit much easier."
What law firms need to understand
Client-mandated security assessments are becoming standard practice across industries where outside counsel handles sensitive corporate information, and the trend is accelerating as corporate legal departments apply consistent vendor risk standards across all service providers, including law firms. Firms that proactively build the security posture that these assessments require — rather than discovering gaps during a time-pressured client audit — position themselves competitively for the corporate engagements that increasingly require it.
Sigma Technology Consulting helps law firms prepare for client security audits and build the underlying security infrastructure those audits assess. Contact us at sigmatechconsult.com to discuss your firm's current security posture.
Sigma Technology Consulting, Inc.
25 Years of Experience, Vetting & Procuring Technology Vendors
Contact Us
Support
© 2026. All rights reserved.
