What coverage do law firms need for data stored in the cloud?

Most law firms now store significant amounts of client data in cloud-based practice management, document storage, email, and backup systems. Your cyber liability policy should cover data breaches regardless of whether the data is stored on your local servers or in a cloud environment, but there are nuances to confirm with your carrier.

First, verify that your cyber policy covers breaches resulting from the acts or omissions of your cloud service providers. If your cloud vendor suffers a breach that exposes your client data, your firm may still bear responsibility for notification, remediation, and regulatory compliance, even though the breach was not your fault. Your cyber policy should respond to these third-party vendor breaches as if the data had been compromised on your own systems.

Second, review the contracts with your cloud service providers for insurance and indemnification provisions. Reputable cloud vendors maintain their own cyber insurance and may indemnify you for breaches caused by their negligence. However, vendor indemnification is not a substitute for your own coverage because enforcement of vendor contractual obligations can be slow and uncertain, and your obligations to affected clients and regulators are immediate.

Third, confirm that your cloud providers meet the security requirements specified by your cyber insurance carrier. If your carrier requires encryption at rest and in transit, multi-factor authentication, and SOC 2 compliance, your cloud vendors should meet these same standards. Using a cloud provider that falls below your carrier's security requirements could give the carrier grounds to dispute coverage if a breach occurs through that vendor.

Finally, consider whether your business interruption and extra expense coverage extends to cloud service outages. If your cloud-based practice management system goes offline for an extended period, the resulting business interruption may or may not be covered depending on your policy's definition of covered network interruption events.