Law firms hold exactly what attackers and enterprise clients care about: privileged, sensitive data. TRM documents a working security program that satisfies client due diligence without pulling your partners off billable work.
A client questionnaire
Continued work made contingent on credible answers, by a date.
Privileged data
Client PII, settlements and privileged communications, in one place.
Malpractice & insurance
Carriers now make MFA, backups and a plan conditions of cover.
The follow-up
The reviewer wrote back. The relationship is still waiting.
An enterprise or institutional client sent a security questionnaire, and made continued work contingent on credible answers by a specific date.
You hold client PII, financial records, settlement details, and privileged communications, a concentration of value that makes small firms frequent targets.
Cyber insurers and malpractice carriers now expect MFA, backups, an incident response plan, and training as conditions of coverage.
The first answers went out. The reviewer wrote back, and continued work is still waiting on the second set.
Every engagement is delivered personally by Teddy Mutterperl. Scope and price are agreed in writing before work begins. A full engagement runs three to seven weeks. When the questionnaire date is sooner than that, a focused engagement is scoped to the date. See the full catalog →
A scored NIST CSF 2.0 maturity report, the top ten gaps, a 12-month roadmap, and a board-ready summary. Fixed scope, $3,000–$8,000.
Questionnaire responses a client can accept, plus the policy set and incident plan those answers cite. Fixed scope, $3,500–$7,500.
A named senior advisor, quarterly board reporting, questionnaire and exam support, and on-call guidance. From $3,000 a month.
“We had no idea where to start. The assessment gave us a clear picture of where we stood and exactly what to do next, in plain English, not jargon.”
Managing Partner · Litigation firm · identity withheld under NDA
Verbatim quote used with written permission.
The engagement catalog is on Services. If the first need is the document, the Vendor Questionnaire Response Pack and the Incident Response Plan Starter Kit download in the browser after intake, and the purchase is credited in full against an engagement booked within 90 days. A directional read on the program is the readiness assessment. The same practice also serves investment advisers and SaaS companies.
A 15-minute call, no obligation. Bring whatever landed on your desk.
TRM Solutions is an independent advisory practice not affiliated with, endorsed by, or sponsored by any current or former employer. Employer names describe professional experience only. Engagements are conducted in a personal capacity and do not involve employer systems, data, clients, vendors, or confidential information. Client engagements are covered by NDA. Assessments and templates provide directional guidance and are not a penetration test, audit, certification, or guarantee of security.