Practical guide
Cyber insurance for law firms and accounting firms
Plan cyber coverage around client confidentiality, deadlines and payment instructions at law and accounting firms. Includes a hypothetical loss example.
Updated October 2026. About a 8 minute read.
Key point
Client confidentiality, payment instructions and missed deadlines create different risks. Review cyber, professional liability and crime coverage together so response costs, professional claims and fraudulent transfers are not assumed to be the same cover.
Confidential records
Breach response and privacy liability
Professional work
Errors, omissions and missed deadlines
Client money
Fraudulent instructions and transfer coverage
| Scenario | Coverage to examine | Potential gap |
|---|---|---|
| Client files exposed | Cyber response and privacy liability | Professional liability may not fund notification |
| Deadline missed after outage | Professional liability and interruption | Different triggers and exclusions |
| Fraudulent payment instructions | Crime and any cyber transfer extension | Social engineering restrictions |
| Hosted tax or document service unavailable | Dependent interruption | Provider and event eligibility |
| Confidential communications intercepted | Cyber and professional liability | Overlapping allegations and shared limits |
Confidentiality is an operational responsibility
Law firms and accounting firms hold information that clients may never want made public. Files can include tax records, financial statements, negotiation positions and details of disputes. The exposure is not defined solely by how many employees work at the firm. The sensitivity of records, reliance on software and promises made to clients can create substantial response needs even in a small practice.
The ABA's Formal Opinion 477R discusses reasonable efforts to protect client communications and circumstances that call for stronger precautions. The IRS supplies data security resources for tax professionals. These are professional and security obligations, not promises of insurance coverage. Use them to guide operating practices, then compare insurance with the actual work and information flows of the firm. Never describe purchasing a cyber policy as satisfying every confidentiality duty.
Professional liability and cyber solve different problems
Professional liability can address allegations that your professional work caused a client financial harm, subject to the contract. Cyber coverage can fund defined response expenses and liability arising from a security or privacy event. A professional policy might contain a cyber endorsement, but the name does not establish its limits or services. The AICPA member insurance program distinguishes privacy event expenses and cyber liability in its product materials.
Request the full wording for both policies and any relevant endorsements. Ask where investigation, client notification, credit monitoring and restoration belong. Consider whether an outage leading to a missed filing deadline could raise both interruption and professional allegations. Look for exclusions that could make each insurer point to the other policy. A coordinated review is more useful than assuming a certificate showing professional liability automatically includes a full cyber response budget.
Email fraud deserves its own review
Firms regularly send invoices, tax payment instructions or settlement communications. A compromised mailbox can make a fraudulent message look credible. Cyber insurance does not automatically reimburse money transferred in response to deceptive instructions. Crime insurance or a specific cyber extension may address parts of that exposure, but social engineering conditions, sublimits and whose funds were transferred can change the result.
Review payment verification outside insurance. Use an independently confirmed contact method for changed bank details and separate authorization for sensitive transfers. Do not call a number supplied only in the suspicious message. Establish responsibilities for client funds and ask who is insured if an employee, client or outside service sends the payment. Written procedures are useful underwriting evidence, but their existence is not a guarantee that a transfer loss is covered.
Outages can threaten deadlines and client service
An accounting firm may depend on tax software and document access during a filing period. A law firm may need records and communications for urgent court or transaction deadlines. Business interruption cover addresses defined financial losses, not every professional consequence of unavailable systems. Examine waiting periods, covered causes and extra expense provisions. Ask how rescheduled work or later collected fees affect any income loss calculation.
Hosted document systems and other outside providers introduce dependent interruption questions. Identify which vendors qualify under the policy and whether a nonmalicious failure is covered. Keep a continuity process for urgent work that does not assume every digital service remains available. Record who can access essential contact details and how deadlines are tracked during an outage. Insurance can fund some losses but cannot restore a deadline that has already passed.
Hypothetical worked example: an accounting firm
This invented scenario is not a reported claim or a market cost estimate. Assume a firm faces $16,000 of eligible cyber investigation and breach advice, $9,000 of eligible notification costs and $5,000 of eligible restoration costs after a compromised document account. The assumed response total is $30,000. With an assumed single $5,000 retention and sufficient applicable limit, the assumed insurer payment is $25,000.
Now suppose a client separately alleges a missed filing caused a financial loss. That allegation is not automatically included in the $30,000 calculation. The firm must examine professional liability and cyber wording, reporting duties and any allocation issue. If a fraudulent transfer also occurred, that needs its own coverage analysis. These assumed amounts demonstrate why several exposures can follow the same incident without having identical insurance treatment. They are not typical breach expenses.
What drives the cost up or down
Underwriters can consider client information, revenue, practice areas, reliance on deadlines, transfer procedures and prior incidents. A firm handling sensitive matters or large transactions may present a different exposure from a local practice with simpler work. Controls on remote access, account recovery and file permissions matter alongside backup and monitoring evidence. Do not assume every professional firm receives the same price because its headcount matches another.
Clear procedures and tested recovery can improve the underwriting discussion, while unexplained gaps can lead to more questions or restrictive terms. They do not establish a universal discount. No like for like public premium range is verified here for a combined law or accounting firm coverage package. Request quotations with consistent limits, retentions and extensions. Use estimates as planning ranges, then evaluate the insurer's actual offer and the separate policies needed for your practice.
Build a coordinated renewal file
Keep an information inventory, professional service description, vendor list and incident response contacts together. Add records of authentication coverage, endpoint monitoring, backup tests and payment verification. Share relevant evidence securely and avoid exposing client matters in an insurance submission. Ask whether claims information needs to be disclosed across more than one application. A simple repeatable review is safer than copying last year's answers after the firm has changed.
Preserve reporting continuity when switching insurers, especially for policies using claims made terms. Review retroactive dates and notice requirements with qualified advice. Do not silently assume prior work or an already known circumstance transfers to the new policy. Assign a person to coordinate incident reporting across cyber, professional liability and crime insurers. That preparation can reduce administrative confusion while the firm is trying to protect clients and continue urgent work.
Plan your insurance budget
Use the cyber liability cost calculator for a planning range with visible assumptions. It is a model, not an insurer quotation or a guarantee of coverage.
For technology service exposure, also compare the technology E&O cost calculator. Confirm the offered policy covers the services and contracts you actually deliver.
Frequently asked questions
Does malpractice insurance include cyber response?
Not necessarily. Some professional policies have limited extensions, while others require separate cyber cover. Read the endorsements for investigation, notification, restoration and liability. A product name or certificate does not establish the breadth of response services.
Are fraudulent wire transfers covered by cyber?
Only if the wording provides applicable cover and its conditions are met. Crime coverage or a specific extension may be relevant. Check social engineering terms, sublimits, verification requirements and whether client money is included. Do not assume mailbox compromise alone guarantees reimbursement.
Do remote workers change the insurance review?
They can change account access, device management and data handling. Describe the real environment and any personal devices or outside locations. Authentication and monitoring evidence should cover relevant access paths rather than only computers in the office.
Can an outage create a professional liability claim?
It can lead to allegations about missed work or deadlines, but coverage depends on the facts and wording. Cyber interruption and professional liability respond to different types of loss. Report relevant circumstances as required and coordinate advice across the policies.
Should a firm send confidential client files to underwriters?
Send only information needed for the application through an approved secure channel. An inventory and service description may be enough to explain exposure without disclosing client substance. Ask for clarification before providing sensitive documents or personal information.
Related reading
Sources
These primary sources support the coverage distinctions and operating guidance discussed above. Security guidance is not an insurance contract. Published product descriptions illustrate possible cover, while your issued wording and applicable law control a claim.
- American Bar Association: Formal Opinion 477R. Primary professional body guidance on reasonable efforts to protect client communications and when stronger precautions may be appropriate.
- IRS: Tax professionals must protect taxpayer data. Primary guidance and resources for protecting taxpayer information and building a written security plan.
- AICPA member insurance program: Cyber liability. Published program description distinguishing privacy event expenses and cyber liability. Offered terms require a policy review.
- CISA and FBI: StopRansomware Guide. Security controls, incident response and recovery guidance. This is security guidance, not insurance wording.
All worked examples are clearly hypothetical. Their dollar amounts and percentages are assumed calculation inputs, not premium benchmarks, reported claims or statistics. No unverified market premium or control discount is presented.