Mitigating risks is a hot topic these days. Law firms store a great deal of sensitive information that has value to hackers who can gain access to it and profit from it. Arguably, there is no greater risk to a firm than a crippling cyberattack that can have long-lasting impacts on business operations and damage its reputation. One of the most common ways for firms to mitigate cybersecurity risks is through cyber insurance. Like other forms of insurance, this is a mitigation strategy that involves risk transference—when a third party assumes a great deal of the risk for an agreed-upon fee.

While cyber insurance will not prevent a successful cyberattack, it does provide a mechanism for firms to recover the costs of responding to such an attack. Cyber insurance is a contract between a firm and an insurer to protect against losses that relate to network or computer incidents. Firms recognize an increased responsibility for their cybersecurity, and to price policies, insurers want to know a fair amount about how each company protects itself.