What does a cyber tabletop exercise look like for a law firm?
Much the same as anywhere else, with three differences: the information in play is confidential and some of it privileged, the money moves through a trust account, and the people who have to be in the room bill by the hour. The scenario we would start most firms on is payment fraud rather than ransomware, because it puts trust money at risk and forces decisions that no technical team can make on its own.
Why do law firms get asked about incident response testing?
Not, on what we have read, by the law society. British Columbia’s professional conduct code imposes a confidentiality duty that is close to absolute. In its words, A lawyer at all times must hold in strict confidence all information concerning the business and affairs of a client acquired in the course of the professional relationship (Law Society of British Columbia, Code of Professional Conduct for British Columbia, rule 3.3-1, 2022).
What the code does not do is say how to keep that confidence electronically. The commentary under the rule says nothing about encryption, breach response or testing. The Law Society Rules in British Columbia go one step further: a lawyer must make reasonable security arrangements against all risks of loss, destruction and unauthorized access, use or disclosure, and must immediately notify the Executive Director on reason to believe records have been lost or improperly accessed (Law Society of British Columbia, Law Society Rules, rule 10-4 (Security of records), 2021). That is a duty to secure and a duty to report, with nothing about a plan or a test.
So the pressure comes from elsewhere. The Law Society of Alberta’s new-firm guidance asks, as a question rather than a requirement: Do you have an incident response plan in place to address potential security breaches promptly and effectively? (Law Society of Alberta Learning Centre, New Firm 7.3, Design Your Defence, 2026). Insurers can ask whether the plan has been tested: one carrier’s application has a separate box for Tested in last year (Beazley Cyber Application, Canada, 2026). And clients can ask, through outside counsel guidelines and security questionnaires.
Which scenario fits a firm?
Payment fraud, in most cases. A wire instruction changes on a closing, or a partner’s mailbox sends a request that looks exactly like the real thing, and money leaves a trust account.
It is the right scenario for three reasons. The money at risk is client money held in trust. The clock is not yours, because recall depends on a bank. And it puts the firm’s obligations into immediate conflict: you owe the client the money, you owe the client the truth about what happened, and you may owe your insurer notice before you have decided either.
In British Columbia, owing the client the money comes with a deadline. Money missing from a trust account is a trust shortage, and the rules say to put it back immediately. You must also report it to the Law Society immediately if it is over $2,500, or if you cannot pay out a client’s trust money when due (Law Society of British Columbia, Reporting a Trust Shortage, citing Law Society Rule 3-74, 2026). Outside BC, check your own law society’s rules.
Ransomware is the second choice, and it is the better one for a firm whose real fear is being unable to meet a filing deadline.
Who has to be in the room?
| Role | Why they cannot be skipped |
|---|---|
| Managing partner | Can commit the firm to repaying a client and to what gets said publicly |
| General counsel or ethics lead | Owns the privilege question and the duty to tell the client |
| Practice group leader for the affected matters | Knows which clients and which deadlines are exposed |
| Finance or trust accounting | Holds the reconciliation and the bank relationship |
| One technical lead | Answers what is possible, and no more than one |
The seat to protect is the partner whose matters are in the scenario. If it is empty on the day, that belongs in the report.
What does the report give the firm afterwards?
Evidence for the insurance renewal.
An answer for clients. When a client asks about incident response testing in outside counsel guidelines or a questionnaire, a dated report naming the scenario, the roles present and the findings is a better answer than a policy document.
And a decision record made deliberately, not under pressure. The value of settling in advance who authorizes telling a client that their funds are gone is that nobody has to work it out on the day.
Does our professional conduct code require us to test an incident response plan?
Not British Columbia's, which is the code we read at source. Its confidentiality rule imposes a strict and continuing duty, and the rule and its commentary say nothing about how you keep information electronically. The Law Society Rules there add a duty to make reasonable security arrangements for records and to report a loss or improper access immediately, and still say nothing about a plan or a test. The method is left to you, which leaves the testing question to insurers, and to any client that asks.
Will the exercise report be discoverable?
Ask your own counsel, because it can depend on how the exercise is commissioned and by whom. It is a question worth settling before the session, not after it, and it is a reason to involve your general counsel or ethics lead in scoping.
Can we run it during a trial?
You can, and the partners you most need will not be there. Book it in a quieter period and treat attendance as mandatory, because a session without the people who would actually decide produces a report that says so.