You've got to love report card season. LogicForce, a legal IT consulting company, released the results from its most recent Law Firm Cybersecurity Scoreboard, and it seems that some firms are just not applying themselves.

The survey indicates that while cybersecurity practices across the legal industry are generally improving, many firms have yet to deploy important protocols such as multi-factor authentication or putting a security executive on the payroll. Still, this might say more about the state of client expectations than it does about how willing their lawyers are to adapt to evolving cyber threats.

“I think that what we see is firms will say, 'This is not a priority for us because this is not a priority for our clients right now,'” said Gulam Zade, a partner and general counsel at LogicForce.

Which is not the same thing as saying that corporations don't care about the state of their partner firms' cybersecurity protocols. They do. A lot. Gulam said that most corporate clients expect their vendors to at the very least replicate the same measures that they use to safeguard their data back at company headquarters.

There are also mandates by various cyber insurance carriers to consider as well as the risk that firms face courtesy of hackers who have identified them as the path of least resistance. The nature of the data many firms hold, be it trade secrets or just highly sensitive personal information, can be a factor too.

“There's some driving business force behind the decision that the corporation is making and what they're doing is they're making all of their vendors do it,” Zade said.

To be sure, the majority of law firms surveyed are investing their resources in areas such as penetration and vulnerability testing, 88 percent, or password management tools, 99 percent. But far fewer have formal cybersecurity policies, 45 percent, or are implementing multi-factor authentication, 47 percent.

So why not get ahead of the next security audit and order invested in every cyber protocol on the menu? Usually it comes down to the usual concerns: money and practicality. Performing a risk assessment, for example, is an investment of time and effort that in a best-case scenario yields absolutely nothing.

“If someone comes in and evaluates it, they're going to tell you what's wrong and now you know it's wrong. Now you have to fix it,” Zade said.

Only 34 percent of firms surveyed are placing cybersecurity management responsibilities in the hands of employees with specialized knowledge. Most have opted to incorporate those duties into IT director positions or hand them off to executives, a cheaper alternative to having another salary on the books.

As Zade pointed out, earning money drives spending money—meaning that if clients suddenly became keen on their law firms having a dedicated cybersecurity manager or regularly scheduled risk assessments, the wind could change direction fast.

“What's been a big driving force that we've seen behind firms investing into cybersecurity protocols is their clients saying, 'This is how we do it, this is how you're going to do it—or you're not going to get paid,'” Zade said.