Cybersecurity built
for law firms.

Executive summary

Firm

Sample LLP

Primary contact

Margaret Whitcombe, Managing Partner

Report date

May 25, 2026

Report type

CyberSuite Readiness Report

Report version

v2.0

Engagement ID

ENG-20260524-sample-llp-7a3f

This report presents Sample LLP’s posture against the Law Firm Cyber Framework v2.0 as of May 25, 2026. The firm has invested in foundational tools — endpoint protection is deployed, immutable backup runs nightly, and Multi-Factor Authentication is enforced for partners and most staff — but documentation gaps and uneven coverage across personal devices and governance controls would surface in a current cyber insurance application.

Of the 22 controls assessed, the firm passes 9, partially satisfies 7, and has gaps in 6. The gaps that matter most before a renewal submission are written policy, vendor due diligence, patch management, and a written incident response plan with a tested tabletop. None require new tooling; all are addressable in 30 to 60 days.

Next step: a 30-minute walkthrough with the firm’s managing partner and administrator to align on remediation owners and sequence.

The framework

Framework explainer — condensed for this preview; the actual deliverable runs 3 pages per §3.1.5.

The Law Firm Cyber Framework v2.0 is a 22-control set crosswalked to the four frameworks a law firm is measured against — NIST CSF 2.0, CIS Controls v8 IG1, ABA Model Rule 1.6(c), and the GLBA Safeguards Rule — plus the cyber-insurance baseline. Controls also reference the data-breach statutes in NJ, NY, PA, and CT where applicable.

The 22 controls, grouped per Section 2 §2.1

Each control receives one of three findings: PASS, PARTIAL, or GAP. No numeric score, no percentage gauge — the three-state model matches how carriers and the ABA standard read evidence.

Posture at a glance

22 controls, three families

Totals: 9 PASS · 7 PARTIAL · 6 GAP across 22 controls.

Findings by control family

Selected findings (excerpt) — the full report walks all 22 controls with evidence citations.

Gaps requiring attention

Ordered by Cyber Insurance Baseline materiality. PARTIAL and GAP findings only; PASS findings are not repeated here.

Recommendations and tier mapping

How each CyberSuite tier addresses this firm’s gaps. Informational — tier recommendation happens in the proposal call.

Pattern: Defense closes 3 of this firm’s most material gaps (C-07 training, C-21 incident response, C-22 monitoring). Sentinel goes further — it takes C-15 (joiner/mover/leaver access) to full coverage and adds proactive posture on C-09 patch and C-11 devices through its SaaS Security Posture Management. Governance gaps (C-01, C-03, C-18) remain firm-led across all tiers.

What happens next

1. 1 30-minute walkthrough. Managing partner and administrator. We walk every PARTIAL and GAP finding, name the remediation owner, and answer questions. No sales pitch in the meeting.
2. 2 Proposal call (optional). If you would like CyberSuite to close the gaps, we present a tier recommendation grounded in this report.
3. 3 14-day onboarding. If we proceed, day 1 kickoff to day 14 live. The first month is included in the onboarding fee and used for stabilization.
4. 4 Or remediate independently. The report is yours to keep. Many firms use it with their existing IT to close the gaps themselves.

Scope and limitations

This is the CyberSuite Readiness Report defined in §3.1, produced under framework system v2, control library framework-system-v2-section-2.md v1.0.2 (content v2.0), against the Law Firm Cyber Framework v2.0.

Source: the firm's completed CyberSuite Assessment.

Report version v2.0 · Generated May 25, 2026

Questions: CyberSuite Account Manager — sales@cybersuite.tech