Practice area
Cybersecurity for Corporate & M&A Practices
Corporate practices hold pre-announcement information that is directly monetizable. Attackers targeting deal teams are not looking for a ransom — they are looking to trade, or to sell to someone who will.
- Client security audits, standard
- OCGClient security audits, standard
- Highest-risk window
- Pre-closeHighest-risk window
- Applies to many client relationships
- Reg S-PApplies to many client relationships
Deal-specific exposure
Risk peaks in the weeks before announcement.
- Virtual data room access controls and stale permissions after staffing changes
- Deal-team email and mobile devices during travel-heavy diligence periods
- Third-party advisors, translators, and local counsel joining the perimeter
- Document metadata leaking counterparties, valuations, and timelines
Outside counsel guidelines are now security contracts
Corporate clients audit their firms. OCGs increasingly mandate MFA, encryption standards, annual penetration testing, breach notification within fixed hours, and the right to audit. Failing the questionnaire increasingly means losing the panel seat.
Evidence on demand
We maintain a standing security response pack so that a client questionnaire arriving on a Friday does not consume the deal team's weekend.
Frequently asked questions
Our clients send security questionnaires. Can you complete them?
We supply the technical evidence and drafted responses for each control area; your firm reviews and submits. Most questionnaires reuse the same control set, so subsequent responses take hours instead of weeks.
Do OCGs really require annual penetration testing?
Many now do, particularly from financial-services and healthcare clients. Annual third-party testing plus continuous monitoring is the common baseline.
Related reading
External Penetration Testing for Law Firms (2026): Scope, Cost, and What Insurers Now Demand
Read guide InsuranceCyber Insurance for Law Firms: 2026 Coverage, Costs, and Underwriter Checklist
Read guide GuidesCybersecurity for Law Firms: The 2026 Playbook (ABA-Aligned, Insurance-Ready)
Read guideSee what your firm is exposing today
Run a free, non-intrusive assessment of your firm's public attack surface. Results in about six minutes.
Start free assessment