Outside counsel guidelines and client security questionnaires ask a law firm to show how it protects the client’s data, usually covering encryption, access control, multi-factor authentication, logging, vendors and incident reporting. A small firm answers them best with short written policies, a clear record of where client data lives, and file-exchange and email tools that give a direct, checkable answer. Many of the questions come down to how matter files reach the firm and who can read them once they arrive.
What are outside counsel guidelines?
Outside counsel guidelines are a client’s written terms for the law firms it hires. They cover billing, staffing and communication, and increasingly information security, meaning how the firm must store, transmit and dispose of the client’s data, which controls it must have, and how fast it must report an incident. Once accepted, the guidelines usually become part of the engagement.
Corporate legal departments often build the security section from a model. The Association of Corporate Counsel published model information protection and security controls for outside counsel in March 2017, and ACC’s announcement describes them as “Encompassing information retention/return/destruction, data handling and encryption, data breach reporting, physical security, employee background screening, and cyber liability insurance.”
The model controls ask outside counsel to encrypt company confidential information in transit (section 3.1.1) and at rest (section 3.1.2), to use “two-factor or stronger authentication for its employee remote access systems” (section 5), and to report a suspected or actual breach “within 24 hours of discovering an actual or suspected event” (section 3.2). Clients often copy these terms nearly word for word.
Why are clients sending more security questionnaires to small firms?
Clients send security questionnaires because their own regulators and boards hold them responsible for vendors that handle their data, and outside counsel is one of those vendors. A questionnaire is how the client documents its due diligence, so small firms with regulated clients now receive them regularly, not only large firms.
The ABA 2023 Cybersecurity TechReport shows the pattern by firm size. Overall, 22% of respondents said a client or potential client had asked the firm to complete a security questionnaire, rising from 14% at firms of 2 to 9 lawyers to 27% at 10 to 49 and 48% at 50 to 99. In the same survey, 27% had been asked by clients for the firm’s security requirements document or guidelines, including 41% at 10 to 49 lawyers and 59% at 50 to 99.
For financial services clients, the source is often explicit. New York’s cybersecurity regulation applies to DFS covered entities, the banks, insurers and other financial companies licensed by the state’s Department of Financial Services. 23 NYCRR 500.11(a)(3) requires them to keep written third-party service provider policies that address “due diligence processes used to evaluate the adequacy of cybersecurity practices,” and 500.11(b) adds the provider’s multi-factor authentication and encryption, to the extent applicable.
Part 500 does not name law firms; the duty runs through the client. DFS’s October 2025 guidance on third-party service providers lists “Data Encryption” and “Access Controls… including multi-factor authentication” among the contract obligations it expects.
What do client security questionnaires usually ask about email and files?
Client security questionnaires usually ask whether client data is encrypted in transit and at rest, who can access it and how that access is authenticated, whether activity is logged and reviewed, which vendors store or process it, whether the firm has an incident response plan, and how quickly it will notify the client of an incident.
File exchange and email sit in the middle of most of those questions, because that is where client data enters and leaves the firm. Clients most often send matter files to the firm, so a firm that can say exactly how those files arrive, where they are stored and who can decrypt them is usually ahead of the questionnaire.
How should a small firm answer a client security questionnaire?
A small firm should answer a client security questionnaire accurately, briefly and with evidence. That means mapping each question to an existing policy or control, answering only what the firm actually does, naming the tool that performs each control, and flagging gaps with a remediation date instead of overstating. A reusable answer library saves time on the next one.
A workable sequence:
- List where client data lives, including email, file storage, practice management, devices and backups.
- Write short policies for access control, encryption, acceptable use, vendor management and incident response, since many questionnaires ask for copies.
- Record, for each vendor that stores client data, what it encrypts, who holds the keys, and whether it signs a business associate agreement (BAA) when protected health information (PHI) is involved. A firm whose work involves a client’s PHI becomes a HIPAA business associate.
- Answer from evidence, describing what the firm does today rather than what it plans. The ABA 2023 Cybersecurity TechReport found that 34% of respondents reported having an incident response plan, so an honest “in progress” answer with a target date is common.
- Check the answers against ABA Model Rule 1.6(c), the duty to make reasonable efforts to prevent unauthorized access to client information, and ABA Formal Opinion 477R. Opinion 477R says a lawyer “may be required to take special security precautions… when required by an agreement with the client.” Once signed, the guidelines are that agreement.
Which common questionnaire items map to email and file controls?
Most questionnaire items about client data map to a handful of file and email controls: encryption in transit and at rest, strong authentication, activity logs, vendor due diligence, a BAA where PHI is involved, and incident reporting. The table shows where each item comes from, what clients typically expect, and how PreVeil supports it.
How does PreVeil help a firm answer the file and email questions?
PreVeil gives a firm a direct answer for files and email. The firm shares a PreVeil Drive folder with a client, the client uploads matter files into it, and those files are encrypted end to end with FIPS 140-3 validated cryptographic modules (certificate #5145). PreVeil also encrypts message contents and attachments inside Outlook, Gmail and Apple Mail.
PreVeil cannot access or decrypt customer data, because the encryption keys stay on users’ devices. That design turns the vendor question, what can the provider see, into a one-line answer for PreVeil customers. Clients read and reply for free from their browser after a one-time sign-up, and their replies stay encrypted. PreVeil Drive has no file size limit, and 10TB of storage per organization is included.
PreVeil has a SOC 2 Type 2 report, shared under NDA on request, signs a BAA with law firms when the work involves PHI, and includes activity logs on the Business plan. PreVeil deploys in hours, is used by 3,000+ organizations, and is a PC Magazine Editors’ Choice. PreVeil supports the file and email controls on a questionnaire, while the firm’s policies, training and incident response remain the firm’s.
The guide to law firm security obligations for regulated clients covers each client obligation in more depth, and PreVeil for law firms summarizes the product.
Frequently asked questions
Are outside counsel guidelines legally binding?
Outside counsel guidelines become binding to the extent the firm accepts them as part of the engagement. ABA Formal Opinion 477R also recognizes that a client agreement can require special security precautions.
What are the ACC model controls?
The ACC model controls are model information protection and security controls for outside counsel that the Association of Corporate Counsel published in March 2017, covering data handling and encryption, breach reporting, physical security, background screening and cyber liability insurance.
How common are client security questionnaires for small firms?
In the ABA 2023 Cybersecurity TechReport, 14% of respondents at firms of 2 to 9 lawyers and 27% at 10 to 49 lawyers said a client or potential client had asked them to complete one.
Does NYDFS require law firms to encrypt email?
Part 500 does not name law firms. DFS-regulated clients must keep vendor policies that address encryption and multi-factor authentication to the extent applicable, and they pass those terms to outside counsel with access to nonpublic information.
How can a client send matter files to the firm securely?
The firm shares a PreVeil Drive folder, and the client uploads into it for free from the browser after a one-time sign-up. The files are encrypted end to end, and there is no file size limit.
Can PreVeil read client data sent through it?
No. The keys stay on users’ devices, so PreVeil cannot decrypt message contents, attachments or files.
Talk to PreVeil before the next questionnaire
A demo shows how a shared PreVeil Drive folder and encrypted email answer the file and email items on a client questionnaire. Request a demo
