ISO/IEC 27001 for professional and legal services: what client panels expect of a law firm, accountancy or consultancy

Why professional and legal services firms are asked for ISO/IEC 27001

The demand comes from clients, not regulators. Corporate legal departments, banks and insurers issue outside-counsel guidelines that set security expectations for every firm on the panel, and panel reviews often open with a questionnaire asking whether the firm holds an accredited certificate. Audit and advisory clients ask the same of the firms that see their ledgers, payroll and board papers.

A certificate rarely removes the questionnaire, but the reviewer can accept an independently audited ISMS for many answers and concentrate on matter-specific points. The difference between this certificate and a SOC 2 report is covered in ISO/IEC 27001 vs SOC 2: which one, or both?

The pressure in this sector is confidentiality and privilege. A leaked draft agreement, an email misdirected to opposing counsel or a breached ethical wall harms a client and the firm's standing more than an outage would.

Scope for a law firm, accountancy or consultancy

A sound scope names the practice areas and offices, the document management system and its matter workspaces, practice management and time recording, email and collaboration platforms, client extranets and data rooms, and the devices partners and staff use away from the office. Records management, including archived paper files and off-site storage, usually sits inside as well.

E-discovery and litigation support vendors, cloud hosting, managed IT providers and transcription services sit outside the firm's control but inside its responsibility: the ISMS shows how each is selected, contracted and monitored.

Three scope mistakes recur. Certifying the IT department alone, when clients care about how fee earners handle matter data. Leaving out a regional office or an acquired practice that shares the same document management system. And excluding the audit or tax practice from a multi-disciplinary firm when that is the service a client is assessing. The general rules are in ISO/IEC 27001 scope: boundaries, interfaces and the mistakes that cost you.

Where the requirements bite for professional and legal services

Controls are selected through the risk assessment and recorded in the Statement of Applicability; the four themes are explained in Annex A: the 93 controls by theme, explained.

Working alongside client guidelines, SOC 2 and GDPR

Outside-counsel guidelines and client security schedules become entries in the register of interested-party requirements. Each clause maps to a control, so a new guideline becomes a comparison, not a project.

Firms serving US clients, or providing outsourced finance, payroll or accounting services, may also be asked for a SOC 2 report. One risk assessment and one evidence calendar can serve both; see SOC 2 for accounting and professional services.

Where the firm is established in the EU or EEA, or offers its services to people there, the GDPR applies, usually with the firm as controller and, in some outsourced services, as processor. The ISMS supports the security obligations, not the whole regulation; see GDPR vs ISO/IEC 27701, ISO/IEC 27001 and SOC 2. The firm's professional conduct rules on confidentiality remain its own to meet.

Payment-diversion fraud, where a spoofed or compromised email changes the bank details on an invoice or completion statement, is treated as an information security risk: email authentication, call-back verification of bank details and staff awareness are recorded as controls with owners.

What a professional services engagement looks like

Duration depends on the offices and practice areas in scope, how consistently the document management system is used, whether walls are enforced in the system or by memo, and when the next panel review falls. The managing partner or COO, the risk partner or general counsel, IT, records management and practice group leaders must be involved, because fee earners handle most matter data. With Design™, Sterling guides your risk and IT teams to own the ISMS; with Drive™, Sterling carries more of the documentation, evidence and readiness work so fee earners stay on client matters.

ISO/IEC 27001 for professional and legal services: questions firms ask