Industries · Legal · Canada and USA

Cybersecurity for law firms and legal departments.

Privileged files, trust accounts and a mailbox that moves money. Sophos protection sized for firms from three lawyers to three hundred, in Canada and the United States.

In plain terms: A law firm's risk is concentrated in email and documents: a hijacked mailbox can redirect a closing payment, and stolen files break privilege. The duty of competence now includes the technology, and regulators on both sides of the border say so in writing.

Get a quote for your legal network Size a firewall in 30 seconds Call 1-833-283-7373

Sophos Silver Partner. Offices in Markham, Ontario and Dallas, Texas. Quotes in CAD and USD, shipping to Canada and the United States.

The page in 30 seconds

Three questions every law firms owner asks. Tap a card to jump to the detail.

1The problem

Closing-day wire fraud
Ransomware with file theft
One login opens every matter

See the top risks →

2The rules

ABA 477R
ABA 483
PIPEDA
Law 25

See what they ask for →

3The fix

Sophos or TrendAI for protection and 24/7 response
N-able Cove or Axcient for backup you can restore
1Password for strong, unique passwords

See the feature match →

1. The problem: your top 4 risks, the rule behind each, and what fixes it

Each row shows what can go wrong, which rule or standard expects you to control it, and the products that do. The tags under each risk show where Sophos or TrendAI name the same risk on their own industry pages or in their research.

1Closing-day wire fraud

Criminals read a matter in a compromised mailbox and send new payment instructions at closing.

62% of breaches involved the human element (all industries). Source

Rules and standards

ABA Formal Op. 477RISO 27001 A.5.14 information transfer

What fixes it

Sophos Email Sophos ITDR 1Password Business

2Ransomware with file theft

Case files are copied out, then encrypted, and the threat is to publish them.

42% of business and professional services victims paid the ransom. Source

Rules and standards

ABA Formal Op. 483Quebec Law 25

What fixes it

Sophos MDR Sophos Endpoint Axcient x360Recover

3One login opens every matter

Flat file shares mean a single stolen password exposes every client.

67% of the incidents Sophos handled were rooted in identity attacks. Source

Sophos research

Rules and standards

ABA Model Rule 1.6(c)ISO 27001 A.5.15 and A.8.5

What fixes it

Sophos ITDR Sophos Workspace Protection (ZTNA)Axcient x360Sync

4Client confidences in AI tools

Privileged details pasted into a public AI tool leave the firm's control.

ABA Formal Opinion 512 applies the duty of confidentiality to generative AI and can require informed client consent first. Source

Rules and standards

ABA Formal Op. 512ABA Model Rule 1.6(c)

What fixes it

Sophos AI Defense TrendAI ZTSA AI Service Access AI Defense guide

Orange links are Sophos, 1Password, N-able and Axcient products; blue links are TrendAI. A product supports the control; meeting a rule also takes your own policies and records.

The risk in numbers

What breach and ransomware research says about this sector. Every figure links to its source.

62%

of breaches involved the human element (all industries)

Verizon 2026 Data Breach Investigations Report

48%

of breaches involved ransomware (all industries)

Verizon 2026 Data Breach Investigations Report

48%

of breaches involved a third party (all industries)

Verizon 2026 Data Breach Investigations Report

$139,875

median ransom paid (USD) (all industries)

Verizon 2026 Data Breach Investigations Report

Figures are the all-industry 2026 DBIR baselines; Verizon groups legal within professional services.

If ransomware hits a law firm

Most common way in50%Malicious email and phishingtogether the most common way in (26% and 24%)

56%of attacks encrypted data

16%of attacks both encrypted and stole data

48%of organizations with encrypted data paid the ransom

55%recovered within a week

What it costs$769Kmedian ransom paid

And then$1.7Maverage cost to recover, ransom not included

42%of business and professional services victims paid the ransom. Source

Sophos does not publish a legal report. These are its 2026 all-industry figures (2,158 IT and security leaders, 17 countries), plus its figure for business and professional services, the closest category it breaks out. Source: Sophos

How an attack unfolds here, and where Sophos stops it

The same four stages appear in nearly every breach. Each stage below shows what it looks like in this sector and the control that breaks the chain.

1Entry

What happensPhished or spoofed mailbox

What stops itSophos Email Plus; MFA enforced; ITDR watching the directory

2Foothold

What happensA lawyer's laptop

What stops itSophos Endpoint stops exploits and ransomware behavior

3Spread

What happensToward the document management system

What stops itFirewall segmentation; least-privilege matter access; NDR

4Impact

What happensRedirected closing funds; leaked case files

What stops itMDR Plus responds 24/7; Cove restores; call-back rule on payments

What you have to comply with

The rules and expectations that shape a security purchase in this sector, in both countries. Status is as of September 2026; check the linked source before relying on a date.

Where	Rule or expectation	What it asks for
United States	ABA Formal Opinions 477R (2017) and 483 (2018)	Lawyers must make reasonable efforts to secure client communications and must monitor for, stop and disclose data breaches affecting client information. Source
Canada	Law Society technology practice management guidelines	Provincial law societies expect lawyers to understand and manage the security of the technology they use for client work. Source
Canada	PIPEDA and Quebec Law 25	Breach reporting to the commissioner and affected individuals; Law 25 adds a privacy officer and privacy impact assessments for Quebec firms. Source
Both	Client security questionnaires and cyber insurance	Corporate clients and insurers require MFA, endpoint detection, email protection and tested backups. Source

2. The rules, in plain English

What the rules above ask you to do, in everyday words. Three dates and numbers to know first, then the requirements that come up again and again.

ASAPPIPEDA

report a breach to the Privacy Commissioner and notify people as soon as feasible when there is a real risk of significant harm

Source

24months

keep a record of every privacy breach, even ones you did not have to report (PIPEDA)

Source

Notifyclients

ABA Formal Opinion 483 expects lawyers to tell current clients when their information was affected

Source

1Scramble sensitive data

Information is encrypted when it travels and when it is stored on laptops and phones, so a stolen device or intercepted message is unreadable.

ABA 477RLaw society

Covered by: Sophos Firewall VPN, Sophos Mobile, Axcient x360Sync

2Lock every login with a second step

A password alone is not enough. Staff, admins and anyone working remotely confirm each sign-in with a phone app or key.

InsurersClient questionnaires

Covered by: Sophos ITDR finds who is missing it; 1Password; Sophos Workspace Protection

3Have a plan, and report on time

A written plan for a breach, people to carry it out, and notices sent to regulators and customers within the deadline.

ABA 483PIPEDALaw 25

Covered by: Sophos MDR Plus responds 24/7 and documents the incident

4Check your vendors

Suppliers with access to your systems or data are vetted, and their access is limited and removed when no longer needed.

ABA Rule 5.3Law 25

Covered by: Sophos Workspace Protection limits vendor access; ITDR finds stale accounts

5Back up, and prove you can restore

Copies of your data that an attacker cannot delete, and a restore you have actually tested.

InsurersLaw society

Covered by: N-able Cove, Axcient x360Recover and x360Cloud

6Teach staff to spot scams

Regular training so people recognize phishing, fake invoices and impersonation.

ABA Rules 1.1 and 5.3Insurers

Covered by: Sophos Email catches most lures; a staff training program covers the rest

The tags show which rule or buyer asks for each item. Insurers, investors and large customers often ask for the same controls even where no law requires them.

Not sure which of these you already cover?Send us what you run today. A Nuformat specialist marks each requirement as covered, partly covered or missing, at no charge.

Get a free gap check Call 1-833-283-7373

Feature match: what you need, and who covers it

Each row is one job your security has to do, in plain words. Pick one product per row from the vendor you prefer: Sophos and TrendAI cover most rows; N-able Cove or Axcient cover backup; 1Password covers passwords. The last column shows the law firms rule each row helps with.

How the pieces fit together

Govern

Set the rules

Decide who is responsible, which rules apply and what is allowed.

Sophos AI Defense

Identify

Know your weak spots

List what you have and find the gaps before attackers do.

Sophos Managed Risk

Protect

Keep attackers out

Firewall, email and device protection, safe logins and remote access.

Sophos FirewallSophos EndpointSophos Endpoint for ServerSophos EmailSophos ITDR1Password BusinessSophos Workspace ProtectionAxcient x360SyncSophos Mobile

Detect

Spot what gets through

Watch accounts, networks and logs for signs of an attack.

Sophos NDRSophos ITDRSophos Next-Gen SIEM

Respond

Stop it fast

Contain an attack fast, work out what happened, and tell the people who need to know.

Sophos MDR

Recover

Get back to work

Backups you have tested, so you can restore instead of paying.

N-able Cove M365Axcient x360CloudN-able CoveAxcient x360Recover

The six steps are the functions of the NIST Cybersecurity Framework 2.0. TrendAI equivalents appear in the table below. Source

What you need	Sophos	TrendAI	Backup: N-able Cove or Axcient	1Password	Helps meet
Block attacks at your internet connectionChecks traffic coming in and going out and blocks attacks. A firewall also keeps parts of the network apart; TrendAI Network Security is intrusion prevention that works alongside a firewall. Protect	Sophos Firewall (XGS)	TrendAI Network Security (intrusion prevention, used alongside a firewall)	–	–	ABA Formal Op. 477R secure communications; ISO 27001 A.8.20 network security
Stop ransomware and malware on computers and serversProtection on each laptop, PC and server that blocks malicious software and stops files being encrypted. Protect	Sophos Endpoint Sophos Endpoint for Server	TrendAI Endpoint Security	–	–	ABA Model Rule 1.1 tech competence; ISO 27001 A.8.7 malware
Stop phishing and fake-invoice emailsChecks email before it reaches staff and blocks phishing links, malware and impersonation. Protect	Sophos Email	TrendAI Email and Collaboration Security	–	–	ABA Formal Op. 477R; ISO 27001 A.8.7 malware protection and A.5.14 information transfer
Experts watching for attacks around the clockA security team monitors your systems 24/7 and acts on attacks, including nights and weekends. Detect and Respond	Sophos MDR	TrendAI MDR	–	–	ABA Formal Op. 483 monitor and respond; Law 25 confidentiality incidents
Protect logins and passwordsSpots stolen or risky accounts and missing multi-factor authentication, and gives every person a unique, strong password. Protect and Detect	Sophos ITDR	TrendAI Identity Security	–	1Password Business	ISO 27001 A.5.15 and A.8.5; ABA Model Rule 1.6(c); ISO 27001 A.5.17 authentication information
Watch devices that cannot run security softwareWatches network traffic to spot attacks on cameras, scanners, medical or plant equipment and other devices with no protection of their own. Detect	Sophos NDR	TrendAI XDR for Networks (NDR)	–	–	ISO 27001 A.8.16
Safe remote access for staff and vendorsLets people reach only the applications they need from home or on the road, instead of the whole network. Protect	Sophos Workspace Protection (ZTNA)	TrendAI ZTSA Private Access	–	–	LSO technology guideline; ISO 27001 A.8.5
Find and fix weak spots before attackers doFinds exposed systems and missing patches, and ranks what to fix first. Identify	Sophos Managed Risk	TrendAI Cyber Risk Exposure Management	–	–	ISO 27001 A.8.8 technical vulnerabilities
Keep logs as proof for auditors and insurersCollects and keeps security records, so you can show what happened and when. Protect and Detect	Sophos Next-Gen SIEM	TrendAI Agentic SIEM	–	–	ISO 27001 A.8.15 logging; PIPEDA 4.7
Back up Microsoft 365 or Google WorkspaceKeeps a separate copy of email and cloud files, so a deleted mailbox or an attack does not mean lost data. Protect and Recover	–	–	N-able Cove for Microsoft 365 Axcient x360Cloud	–	ISO 27001 A.8.13 information backup; ABA Model Rule 1.6(c)
Back up servers and PCs, and restore fastBacks up whole machines so you can restore files or entire systems after ransomware or a hardware failure. Protect and Recover	–	–	N-able Cove for PCs, Macs and servers Axcient x360Recover	–	ISO 27001 A.8.13 and A.5.30 ICT readiness for business continuity
Share files with clients and partners securelyControlled file sharing with permissions, instead of email attachments or personal cloud drives. Protect	–	–	Axcient x360Sync	–	ABA Formal Op. 477R; ISO 27001 A.5.14 information transfer
Control the AI tools staff useShows which AI tools people use and keeps sensitive data out of the ones you have not approved. Govern and Protect	Sophos AI Defense	TrendAI ZTSA AI Service Access	–	–	ABA Formal Op. 512 (2024) on generative AI; ABA Model Rule 1.6(c)
Manage, lock and wipe phones and tabletsKeeps company phones and tablets set up securely, and locks or wipes them if they are lost. Protect	Sophos Mobile	TrendAI Mobile Security protects phones from malicious apps but does not manage, lock or wipe them.	–	–	ISO 27001 A.8.1 user endpoint devices; PIPEDA 4.7

A dash means that vendor does not sell a product for that row through Nuformat. A product supports the control; meeting a rule also takes your own policies and records.

Want this priced for your sites?Pick a column or mix them. Tell us your sites, users and servers, and we quote Sophos and TrendAI side by side in CAD or USD within two to three business days.

Quote my feature match Call 1-833-283-7373

Every Sophos product line, mapped to law firms (17 lines)

All 17 Sophos product lines Nuformat sells, what each one does in this sector, and the standard or framework control it supports. This is a high-level map: products supply the technical safeguards, and compliance still depends on your policies, people and evidence.

Sophos product line	Use in law firms	Helps meet
Sophos Firewall (XGS)Protect	Office perimeter and encrypted links between offices.	ABA Formal Op. 477R secure communications; ISO 27001 A.8.20 network security
Sophos Virtual FirewallProtect	Protects document management and practice systems in the cloud.	ABA Model Rule 1.6(c) reasonable efforts; ISO 27001 A.8.20
Webserver Protection add-onProtect	Protects client portals and online intake forms.	ISO 27001 A.8.26 application security; PIPEDA 4.7
Sophos SwitchProtect	Separates guest, staff and privileged partner networks.	ISO 27001 A.8.22 segregation of networks
Sophos AP6 wirelessProtect	Client and staff Wi-Fi kept apart in meeting rooms.	ISO 27001 A.8.22; LSO technology guideline
Sophos EndpointProtect	Protects lawyer laptops and assistant PCs from ransomware.	ABA Model Rule 1.1 tech competence; ISO 27001 A.8.7 malware
Sophos Endpoint for ServerProtect	Protects document and billing servers.	ISO 27001 A.8.7; ABA Model Rule 1.6(c)
Sophos XDRDetect	Investigation across devices, email and firewall for firm IT.	ISO 27001 A.8.16 monitoring activities
Sophos MDR and MDR PlusRespond	24/7 monitoring and the response record a breach review needs.	ABA Formal Op. 483 monitor and respond; Law 25 confidentiality incidents; ISO 27001 A.5.24-A.5.26
Sophos ITDRDetect, Respond	Finds accounts without MFA and stale access to client matters.	ISO 27001 A.5.15 and A.8.5; ABA Model Rule 1.6(c)
Sophos NDRDetect	Spots unknown devices and lateral movement on the office network.	ISO 27001 A.8.16
Sophos EmailProtect	Stops wire fraud on closings and impersonation of partners.	ABA Formal Op. 477R; ISO 27001 A.8.7 malware protection and A.5.14 information transfer
Sophos Next-Gen SIEMDetect	Logs that answer client security questionnaires and insurer audits.	ISO 27001 A.8.15 logging; PIPEDA 4.7
Sophos Managed RiskIdentify	Finds exposed remote access and unpatched systems before attackers do.	ISO 27001 A.8.8 technical vulnerabilities
Sophos Workspace Protection (ZTNA)Protect	Secure remote access for lawyers working from home or court.	LSO technology guideline; ISO 27001 A.8.5
Sophos MobileProtect	Encrypts and manages phones that hold client email; wipes lost devices.	ISO 27001 A.8.1 user endpoint devices; PIPEDA 4.7
Sophos AI Defense Quote on requestGovern, Protect	Stops privileged client information being pasted into AI tools.	ABA Formal Op. 512 (2024) on generative AI; ABA Model Rule 1.6(c)

Show all 17 product lines

Section and control numbers point to the requirement a product helps with. Your auditor or assessor decides whether the control is met. Nuformat maps a specific questionnaire or assessment to these products on request.

Cyber insurance: what it pays for and what insurers check

Cyber insurance pays for the cost of an attack or a data breach. Before quoting, insurers check a short list of security controls; missing ones raise the premium, cut the limit, or end the conversation.

Your own costs

Incident response and forensic investigators
Restoring data and rebuilding systems
Lost income while the business is down
Ransom or extortion demands, where the policy and law allow
Breach notices, call centers and credit monitoring
Funds lost to fake invoices or wire fraud (often a small sublimit, sometimes excluded)

Claims against you

Lawsuits from customers or partners whose data was exposed
Regulatory investigations, and fines where the law allows them to be insured
Card brand assessments after a payment breach (on some policies)
Liability for spreading malware to others

Policies differ. Read the exclusions, waiting period and sublimits, especially for ransomware and social engineering fraud.

The 12 controls insurers look for

MFA for remote and privileged (admin) accessSophos ITDR shows gaps; 1Password; Workspace Protection

Email filtering and web securitySophos Email; Sophos Firewall web filtering

Secured, encrypted and tested backupsN-able Cove; Axcient x360Recover and x360Cloud

Privileged access managementSophos ITDR flags admin accounts; 1Password vaults admin credentials

Endpoint detection and response (EDR)Sophos Endpoint with XDR, or MDR

Patch and vulnerability managementSophos Managed Risk; TrendAI CREM

Incident response planSophos MDR Plus includes incident response

Security awareness training and phishing testsA staff training program; Sophos Email cuts the volume

Remote desktop (RDP) lockdown and hardeningSophos Firewall; Workspace Protection replaces exposed RDP

Logging and monitoringSophos Next-Gen SIEM; MDR

Replace or protect end-of-life systemsFirewall segmentation; Sophos NDR watches what cannot be patched

Supply chain and vendor riskWorkspace Protection limits vendor access; ITDR removes stale accounts

The list follows Marsh's twelve key cyber controls. Source

Answer the application accurately. In 2022 an Illinois manufacturer's application said it required MFA for email and remote network access. After a ransomware attack, the insurer said MFA was only on the firewall and asked a court to cancel the policy. On August 26, 2022 the court entered judgment rescinding the policy, with the company's agreement, leaving it without coverage. Source

Where insurers dig deeper: Law firms are asked about wire-fraud controls on real estate and settlement payments, MFA on email, and encrypted client communication.

Renewing or applying for cyber insurance?We map your current setup to the twelve controls before you fill in the application, so the answers are accurate and the gaps are known.

Get an insurance readiness review Call 1-833-283-7373

A worked example: a 25-lawyer firm with two offices

A firm with 25 lawyers, 30 staff, two offices and a hosted document management system would typically run:

Where	What runs there
Main office	XGS 128 with Xstream, Sophos Endpoint on every device, MDR Plus
Second office	XGS 118 with Xstream, SD-WAN to the main office
Every mailbox	Sophos Email Plus plus MFA, ITDR on the directory
Home and mobile work	Sophos ZTNA to the document system; 1Password Business
Microsoft 365 and files	Cove backup with a tested restore

Licenses are sold in 1, 2 or 3-year terms or month to month through Nuformat. Hardware is bought outright or as Hardware as a Service. Every quote states the currency.

Get this sized and quoted for your organization

Send us your site list, user count and any questionnaire you have been given. A Nuformat specialist maps the products to it and returns a quote within two to three business days.

Request a quote Use the firewall sizer Call 1-833-283-7373

Available in Canada and the USA. Sophos Silver Partner.

Frequently asked questions

Which cybersecurity rules and frameworks apply to law firms?

The main ones on this page are listed by country. In the United States: ABA Formal Opinions 477R (2017) and 483 (2018). In Canada: Law Society technology practice management guidelines, PIPEDA and Quebec Law 25. In Both: Client security questionnaires and cyber insurance. Many organizations also organize the work with the voluntary NIST Cybersecurity Framework 2.0 and its six functions: govern, identify, protect, detect, respond and recover. Check the linked sources for current status and dates.

Which products cover the main cybersecurity needs for law firms?

Sophos covers the firewall, endpoint, email, identity, network detection and 24/7 managed detection and response, and TrendAI Vision One offers an alternative for most of the same needs, except the firewall itself. Neither Sophos nor TrendAI sells backup or a password manager through Nuformat, so N-able Cove or Axcient handle backup and recovery, and 1Password Business handles passwords. The feature match table on this page lists each need with the product from each vendor.

What do the ABA and Law Society require of a firm's cybersecurity?

ABA Formal Opinion 477R asks for reasonable efforts to secure client communications; Opinion 483 requires monitoring for breaches, stopping them, and telling affected clients. Canadian law societies publish technology guidelines with the same expectations under the duty of competence.

How do we stop closing-funds wire fraud?

Sophos Email Plus blocks impersonation and look-alike domains, MFA on Microsoft 365 stops stolen passwords from being used, and a call-back rule for any change to payment instructions closes the gap that technology cannot.

Is Sophos MDR reasonable for a small firm?

Yes. It is priced per user, and a ten-person firm gets the same 24/7 analysts as a large one. It is the control clients and insurers ask about most.

Can lawyers keep working from phones and home?

Yes. Sophos ZTNA grants access to one application at a time after checking the device is healthy, which is safer than a VPN and easier for the lawyer.

Do you serve firms in both countries?

Yes. Nuformat is a Sophos Silver Partner with offices in Ontario and Texas, quoting in CAD and USD.

Will Sophos help us get or renew cyber insurance?

It covers much of what insurers ask about: MFA visibility, EDR, email security, logging and 24/7 response through MDR. Backups come from N-able Cove or Axcient. Insurers decide coverage and price, so answer the application accurately; Nuformat can map your current controls to the questionnaire before you submit it.

Sources

Get a quote Call