What are Canadian law firms asked at cyber insurance renewal?
It depends which insurer is asking. In Ontario, LAWPRO’s program already includes some cyber and fraud cover. It is capped, and the fraud limit depends on steps written into your retainers. A separate cyber policy brings its own application, which asks the usual control questions and, on at least one Canadian form, whether your incident response plan was tested in the last year.
What does LAWPRO already cover?
LAWPRO provides errors and omissions insurance to Ontario lawyers in private practice. Through the end of 2026, a claim arising from social engineering fraud is covered to a sublimit of $250,000 (LAWPRO, practicePRO Social Engineering Toolkit, 2026).
A firm can lift that to $1,000,000 per claim by taking four steps LAWPRO calls mandatory. Put written instructions in the retainer for receiving, releasing and transferring funds. Say in the retainer not to expect those instructions to change. Confirm any change by telephone or in person, using contact details already confirmed. And keep in writing every updated contact detail and every updated instruction (LAWPRO, practicePRO Social Engineering Toolkit, 2026).
What changes for 2027?
On 1 October LAWPRO announced that its 2027 program adds first-party cyber coverage, meaning cover for the firm’s own losses after a cyber incident, and moves every cyber-related cover into a single endorsement. First-party and third-party claims will share a sublimit of up to $250,000. The social engineering limit can rise from $250,000 to $1,000,000 where specified risk controls set out within Endorsement 14 are met, and the cover applies firm-wide (LAWPRO, Your 2027 program, New cyber enhancements, 2026).
We have not read Endorsement 14, so we will not guess at its controls. Get the wording from LAWPRO or your broker before you rely on the higher limit.
What does a separate cyber application ask?
A separate cyber policy comes with its own application, and on at least one Canadian form the incident response question comes in two parts. Beazley’s Canadian application asks whether you have an incident response plan addressing network incidents and data breaches, then offers two boxes: Have a plan and Tested in last year (Beazley Cyber Application, Canada, 2026).
| What you are asked | Who asks | The evidence |
|---|---|---|
| Written funds transfer instructions, with changes confirmed by phone or in person | LAWPRO, for the higher fraud limit through 2026 | The retainer clause, and a written record of every updated instruction |
| Specified risk controls for the higher limit | LAWPRO, Endorsement 14, from 2027 | Whatever the endorsement lists, once you have read it |
| A written incident response plan | A cyber application, such as Beazley’s Canadian form | The plan, dated, with named roles |
| A plan tested in the last year | The same form, as its own box | A dated report naming the scenario, the roles in the room and the findings |
Where does an exercise help?
In two places. The LAWPRO steps live in a retainer, but the one that matters on the day is a person handling the trust account picking up the phone when an email looks exactly right. A payment fraud scenario tests whether they do. And the tested-plan box on a cyber application is answered by a dated report, which is what the exercise produces.
Is LAWPRO's cyber cover enough on its own?
That depends on what an incident would cost your firm, which is a conversation to have with your broker using your own numbers. The program's cyber cover is capped, and from 2027 first-party and third-party cyber claims share one sublimit.
Does any of this apply outside Ontario?
LAWPRO insures Ontario lawyers in private practice. We have not checked the programs in other provinces. Ask your own insurer how its policy treats cybercrime and social engineering fraud.