Discuss your project

TOOLBOX · COMPLIANCE & NIS2

Maturity Check Law Firms.

Confidentiality needs secure IT. 12 questions for law firms, notary offices and tax advisors based on professional law, the GDPR and BSI IT-Grundschutz, with an immediate maturity level, measures and sources.

12 Questions for Law Firms

0 of 12 answered

Stays in your browser: your answers are neither sent nor stored. They are gone when you close the page; print the report or save it as a PDF.

Answer Yes, Partially or No for each measure. Below each question it says what “Yes” means. If you do not know, choose No: a measure that nobody can confirm does not count as implemented.

  1. Question 1: Are all employees bound in writing to secrecy and data confidentiality, and do they know which information they may pass on to whom?

    OrganizationImportant measure

    Yes means: the obligation is signed, applies beyond the employment relationship, everyone has been instructed on permitted disclosures, and it is pointed out again when someone leaves.

  2. Question 2: Do employees see only the files and folders they need for their tasks, and are accounts and permissions revoked immediately when someone leaves?

    Accounts and AccessImportant measure

    Yes means: permissions follow the task, every account belongs to exactly one person, and when someone leaves, accounts are locked and devices collected.

  3. Question 3: Is sign-in with a second factor mandatory for email, Microsoft 365 or other cloud services and for access from outside?

    Accounts and AccessKey measure

    Yes means: besides the password, all of this access requires a second factor, including remote maintenance by service providers.

  4. Question 4: Are operating systems, law firm software and network devices updated promptly according to a defined process, with clear responsibility?

    Systems and NetworkKey measure

    Yes means: it is defined who assesses and installs updates, success is checked, and devices without vendor support are replaced unless they can demonstrably still be operated securely.

  5. Question 5: Are SPF, DKIM and DMARC set up for the firm’s domain so that receiving servers should reject emails with a forged sender from your domain?

    Systems and NetworkImportant measure

    Yes means: all services allowed to send are in the SPF record, outgoing emails are signed with DKIM, and DMARC specifies that failing emails are rejected. If DMARC is still set to monitoring or quarantine, choose Partially.

  6. Question 6: Do you transmit confidential documents and credentials encrypted or via a protected exchange instead of as ordinary email attachments?

    Data and BackupImportant measure

    Yes means: it is defined through which channels confidential documents are exchanged, and the team follows this.

  7. Question 7: Are laptops, smartphones and USB drives with firm data encrypted and protected with a lock code?

    Data and BackupImportant measure

    Yes means: laptop drives and the storage of mobile devices are encrypted, smartphones and tablets have a lock code and lock themselves, and data requiring protection on USB sticks is encrypted.

  8. Question 8: Are files, law firm software and emails backed up regularly, is a copy stored separately and protected against overwriting, and do you test recovery?

    Data and BackupKey measure

    Yes means: there is a backup plan, one copy is stored at another location and cannot be overwritten, and recovery is tested regularly, most recently successfully.

  9. Question 9: Have you concluded a data processing agreement and a written confidentiality agreement with IT service providers and cloud providers that can see client data?

    Service ProvidersImportant measure

    Yes means: for each of these service providers there is a data processing agreement and a confidentiality agreement, with rules for audits and termination.

  10. Question 10: Is the team trained regularly in information security, for example on phishing and fake payment requests?

    PeopleImportant measure

    Yes means: new employees receive an introduction, and everyone is trained regularly according to their tasks.

  11. Question 11: Is it defined what counts as a security incident, who then decides and who must be informed, including notification of the Data Protection Authority?

    Incidents and EmergenciesImportant measure

    Yes means: a short arrangement known to everyone names those responsible, current contacts and the steps for a data breach.

  12. Question 12: Are there binding rules for working from home and on the move, for example on work devices, screen lock and handling documents?

    PeopleFoundation

    Yes means: the rules are in writing, handed out to everyone and updated; work devices meet defined security requirements.

0 of 12 answered

HOW THE CHECK CALCULATES

Traceable
Instead of Gut Feeling.

12 questions, at most 26 points. The measures are based on the sources named, and individual implementation examples are recommendations by TOMORIS; weights and levels are an assessment by TOMORIS based on the effect of a measure.

  • 01

    Answers Become Points

    Yes counts 1, Partially 0.5 and No 0 points, each multiplied by the weight of the question. If you do not know, choose No.

  • 02

    Weight by Effect

    Key measure (3, here 3×): Directly protects against the most serious consequences of an attack or outage: data loss, standstill or the takeover of accounts and access. Important measure (2, here 8×): Makes an incident less likely or limits its extent and duration. Foundation (1, here 1×): Organizational prerequisite that works through the other measures, such as responsibility, overview or documentation.

  • 03

    Percentage and Level

    Points reached divided by possible points, rounded down to whole percent. Level 1 Getting Started: 0 to 39 percent. Level 2 Foundations: 40 to 69 percent. Level 3 Advanced: 70 to 89 percent. Level 4 Established: from 90 percent.

  • 04

    Key Measures Set a Limit

    If a key measure is answered with No, the maturity level stays at level 2 at most, even if the percentage is higher. The report lists the open measures sorted by weight.

BASIS

What the
Questions Are Based On.

Lawyers, notaries and tax advisors are bound by professional secrecy (Section 9(2) RAO, Section 37 NO, Section 80 WTBG 2017). The obligation extends to employees: lawyers must bind their assistants, and notaries their employees, to secrecy; under the WTBG 2017, secrecy also applies accordingly to vicarious agents.

The GDPR requires appropriate technical and organizational measures to ensure a level of security appropriate to the risk and explicitly names examples such as encryption and the ability to restore data quickly after an incident (Article 32(1)).

For the technical measures, the BSI IT-Grundschutz Compendium, Edition 2023, serves as a model. It is a framework of the German Federal Office for Information Security (BSI) and not a legal obligation in Austria.

More on the Notaries & law firms industry · More on the Tax advisory industry · NIS2 Applicability Check (German) · All Downloads

QUESTIONS

Good to Know.

How is the maturity level calculated?

Each answer gives points: Yes 1, Partially 0.5, No 0, multiplied by the weight of the question (key measure 3, important measure 2, foundation 1). This checklist has 12 questions and at most 26 points. The points reached give a percentage, rounded down, which determines the level: level 1 Getting Started 0 to 39 percent, level 2 Foundations 40 to 69 percent, level 3 Advanced 70 to 89 percent, level 4 Established from 90 percent. If a key measure is answered with No, the maturity level stays at level 2 at most.

Where do the questions come from?

From professional law (Sections 9 and 12 RAO, Section 37 NO, Section 80 WTBG 2017), data confidentiality under Section 6 DSG, the GDPR, the BSI IT-Grundschutz Compendium, Edition 2023, and the BSI recommendation on two-factor authentication. The Compendium is a framework of the German Federal Office for Information Security (BSI) and not a legal obligation in Austria; it serves as a model for the technical measures. Every question names its citation.

What does professional law require of IT?

It imposes professional secrecy and includes the people around you: lawyers must bind their assistants to secrecy and make arrangements for reliable compliance (Section 9(2) RAO), notaries their employees to confidentiality (Section 37(2) NO), and under the WTBG 2017 secrecy also applies accordingly to vicarious agents (Section 80(5)). Lawyers must also provide the necessary facilities, in particular for electronic legal communication with the courts (Section 9(1a) RAO). Which technical and organizational measures fit is required by the GDPR according to the risk (Article 32); the questions describe them following the BSI model.

Is the result proof or legal advice?

No. The check is a self-assessment based on your answers. It does not replace an audit or legal advice and does not prove that legal or professional requirements are met. The weights and levels are an assessment by TOMORIS; the measures are based on the sources named, and individual implementation examples are recommendations by TOMORIS.

Are my answers transmitted or stored?

No. The questionnaire and evaluation run entirely in your browser; your answers are neither transmitted to TOMORIS nor to third parties and are not stored, not even on your device. Only when you choose “Discuss the Result” does the contact form take over industry and maturity level as the topic, not your individual answers.

How do I save the report as a PDF?

In the report, choose “Print or Save as PDF” and select “Save as PDF” or “Microsoft Print to PDF” as the printer in the print dialog. Only the report is printed, in light colors even in dark mode.

TOOLBOX

More
Tools.

YOUR NEXT STEP

You Have the Result.
What Comes Next?

We assess findings, prioritize by risk and put changes into practice on request: as a project with EXPERTS or as ongoing operations with GRID.

Discuss the Result