Quantum risk, client confidentiality, and cyber insurance for law firms

Focus on the information entrusted to the firm

Our proposed first exercise is to select a few representative matters and identify how long their information could remain sensitive. Settlement documents, trade secrets, family records, and transaction materials have different lifecycles. An inactive matter can still contain information whose later disclosure would be consequential.

Keep this exercise internal and use descriptions rather than client names in general planning worksheets. A useful inventory records information categories, storage locations, permitted access, responsible partners, and relevant preservation needs. Avoid moving confidential documents into public assessment tools.

Distinguish ethical duties from a technical checklist

ABA Model Rule 1.6 includes reasonable efforts to prevent unauthorized access to or disclosure of client information. The ABA model is a reference point; binding duties depend on the jurisdiction’s adopted rules, other applicable law, and the engagement’s circumstances.

A quantum-readiness worksheet cannot establish compliance with those duties. Ask qualified counsel and the firm’s security advisers how emerging cryptographic risks fit within the firm’s existing evaluation of safeguards. Record the reasoning behind priorities without claiming that any particular technology removes every confidentiality risk.

Map collaboration and document dependencies

Consider secure email, document management, discovery platforms, virtual data rooms, remote access, archives, and outside counsel exchanges. Choose one important workflow and identify where a provider controls the technology and where the firm must make configuration or procurement decisions.

NIST’s migration project supports discovery and transition planning for vulnerable public-key cryptography. For a law firm, our practical application is to request understandable product-specific roadmaps from key providers rather than attempting to design cryptography internally.

• What exactly is included in the supplier’s migration plan?
• Will clients or outside counsel need compatible updates?
• Which archived information receives protection, and which does not?
• Can the firm export and recover its information during a service interruption?

Review the insurance program together

Ask the broker to consider cyber, lawyers’ professional liability, crime, and any other relevant policies as a connected program. Provide a scenario involving a confidential-document exposure and a separate scenario involving fraudulent payment instructions. Ask which policy provisions address each concern.

Do not assume a professional liability policy replaces cyber incident-response protection or that a cyber policy automatically covers every allegation involving legal work. The answer requires the actual definitions, exclusions, limits, endorsements, and facts. Preserve clear distinctions between defense, response expenses, and damages.

Plan a response before a client calls

Agree who coordinates incident facts, insurer contact, external legal advice, and client communications. Ask the insurer or broker how approved providers are engaged and what notice is required. Keep an accessible copy of the relevant instructions if the document system is unavailable.

Use a tabletop exercise where a supplier reports an incident but cannot yet identify every affected matter. Discuss how to preserve evidence and obtain advice without jumping to unsupported conclusions. Notification decisions should follow the applicable duties and facts rather than a generic website script.

Give one partner ownership of the next step

Our recommended deliverable is a one-page plan naming the responsible partner, technology lead, key vendors, insurance reviewer, and next decision date. Include unanswered questions and who will resolve them. A small firm can begin with one critical service.

This process makes quantum preparation manageable alongside current client work. It is an educational planning approach, not a legal opinion, security certification, or assurance of insurance coverage. Use secure professional channels when discussing actual matters or submitting insurance information.