Playbook, law firm
The questionnaire behind a corporate client's instruction
This is the one question on a law firm site where the person typing is not a member of the public. It is somebody in procurement or in a legal operations team working through a supplier onboarding pack before their business is allowed to instruct you. They want documents, not reassurance, and the useful reply is the one that names what the firm publishes and gets them to the person who signs things. Everything else on this page assumes the wrong reader.
Why this is not the general answer
The handling pattern for security questionnaires holds across every trade. What follows is the part that does not.
- The asker is a buyer running a process, so a friendly paragraph is a worse answer than a link to the document their pack requires, and they will move on to a firm that has one.
- Outside counsel guidelines are the client's own rules about how their work is handled, including billing conduct and who may touch a matter, and accepting them is a commercial commitment nobody in a chat window can make.
- Legal work is routinely subcontracted to counsel, agents and experts, so a question about who else sees the material has a real and specific answer that a generic supplier response does not cover.
- Confidentiality and privilege change the shape of the answer, because a firm cannot describe its arrangements by pointing at named clients or matters the way an ordinary supplier can.
How it arrives
- where are our matter documents stored
- do you accept our outside counsel guidelines
- can you complete our vendor security questionnaire
- if you instruct counsel do they get our documents
- how quickly would you notify us of a breach
- do you hold cyber cover and at what level
What has to be indexed for this to work
| Your published information security statement | Written to be read by a buyer: access control, encryption in transit and at rest, retention, backups, staff vetting and training. If it exists only as an internal policy, this is the pair that justifies publishing an external version of it. |
|---|---|
| Any certification or audit report you hold, with its scope | Name it, state what it covers and how a prospective client requests it, including whether a confidentiality agreement is needed first. Scope matters more than the badge, because procurement will ask which entity and which services are inside it. |
| Your standard data processing and confidentiality terms | The wording you offer, the sub processors and third parties involved in delivering legal work, and your breach notification period. Have a position rather than negotiating one for the first time in every onboarding pack. |
| Who owns supplier onboarding inside the firm | The named function that completes questionnaires and signs guidelines, and how quickly they respond. Procurement is working to a deadline of their own, and a firm without a route here fails the process rather than the question. |
The reply
Our information security statement covers access control, encryption, retention and staff vetting, and sets out our breach notification period [1]. Where we instruct counsel, an agent or an expert on a matter, they are engaged under confidentiality terms and that is described in the same document [2]. I cannot complete a questionnaire, agree outside counsel guidelines or sign anything on the firm's behalf, and those are handled by our onboarding contact. Leave me your name, your email and which pack you are working through, and it will reach them today.
It leads with the artefact rather than with an assurance, because a buyer is collecting evidence and not comfort. The line about counsel and experts is included unprompted since it is the question this trade fails and an ordinary supplier answer does not reach it. The refusal is precise about which acts are out of scope, so the reader knows exactly what still needs a person.
Where it stops
The trigger. The visitor attaches or quotes a questionnaire, asks the firm to accept a set of guidelines or terms, or asks for a certification report or a signed statement.
I cannot complete a questionnaire or agree terms for the firm. Leave me your name, your email and the pack you are working through and our onboarding contact will come back to you.
It stops answering before it guesses, says who will pick it up, and asks for the one thing that makes a reply possible. Nothing about it reads as a dead end.
Never say this here
Out of bounds
- Never state that the firm holds a certification, meets a standard or carries a level of cover unless that is in the published material, word for word.
- Never accept, agree or acknowledge outside counsel guidelines, data terms or a clause, because none of that is the assistant's to give.
- Never name a client, a matter or a sector engagement as evidence of the firm's arrangements, since that is confidential in this trade even when it would be a reference anywhere else.
- Never describe internal controls in detail beyond what the firm has chosen to publish about them.
Questions
- Is this worth the effort for a firm with mostly private clients?
- Only if you want commercial work. If your instructions come from businesses, this question sits between you and being allowed to be instructed at all, and it arrives on a deadline that belongs to somebody else's process.
- Can it fill in the spreadsheet if we index our policies?
- No. It answers from your published material with citations and can collect a name, an email and a message. It cannot open an attachment, complete a form, or send a document, so the questionnaire itself always reaches a person.
- What should it do when it is asked something we have not published?
- Refuse and route, which is why the caution setting matters more in this pair than anywhere else on a firm's site. An invented answer about encryption or a notification period goes into somebody's supplier record and is treated as a representation by the firm.
Keep reading
- Everything for a law firmFee structures, consultation terms and onboarding checks are answerable. Anything applied to a caller's own facts is legal advice.
- Handling security questionnaires in generalA buyer-side question arriving in the wrong place. Answer only what you publish, and never let an assistant improvise a claim you then own.
- The firm's insurance and the client's are unrelated thingsProfessional indemnity cover belongs to the firm. Legal expenses cover on a caller's own policy may fund the matter. Not the same question.
- Out of hours on a law firm site means something has happenedOut of hours here is rarely about opening times. It is an arrest, an injunction or a hearing in the morning, and a form is not enough.
- Locked out of the client portal, with a document waitingThe assistant cannot reset a login, confirm anybody is a client or say what is waiting inside. It can describe the route and take a name.
Try it on your own material
Upload a document or point it at your site, paste one line of HTML, then ask it something only your business could answer.