Methodology
by SecureJustice
A research-grounded, plain-language diagnostic
The Firm Shield Diagnostic translates recognized cyber and AI-governance frameworks into questions a working lawyer can answer in about 10 minutes — without IT staff or specialized vocabulary.
Foundations
Where the questions come from
Every question in the diagnostic ties back to a published source in one of these bodies of work:
- ISO/IEC 42001 — AI management systems.
- ISO/IEC 27001 — information security management.
- NIST AI Risk Management Framework — identifying, measuring, and governing AI risk.
- NIST Cybersecurity Framework — core security outcomes for law-firm environments.
- ABA Formal Opinions and Model Rules — competence (1.1), confidentiality (1.6), supervision (5.1/5.3), and the growing body of opinions addressing generative AI use in legal work.
- State supreme court AI rules and standing orders — disclosure obligations, verification duties, and sanctions precedent from federal and state courts across the U.S.
- Cyber-insurance application requirements — the control set that carriers are already using to price and underwrite law-firm policies.
What we measure
Six risk categories
- AI governance
- Shadow AI & data leakage
- Cybersecurity fundamentals
- Client data protection
- Regulatory & ethics
- Insurance & risk transfer
Each answer is scored against the underlying framework and rolled up into a category score, an overall Firm Shield rating, and an estimated economic exposure figure calibrated to firm size and practice mix.
The diagnostic also opens with a short discovery of your firm's top operational headaches and a manual-process inventory, which shape the roadmap section of your report and an estimated automation upside.
How the report reads
Executive-ready, not technical
Results are summarized into a report intended for firm leadership — managing partners, executive directors, and general counsel. The report covers:
- Prevalence of each risk relative to comparable firms
- Risk categories ranked by severity and remediation effort
- An estimated economic exposure figure with reasoning shown
- Prioritized next steps with realistic timeframes
Findings are written in plain English. Where a citation to NIST, an ABA opinion, or a specific court order sharpens the point, we include it — but the report is meant to be read, not decoded.
Confidentiality
What we collect, and what we don't
The diagnostic asks about your firm's posture — not your matters. We do not ask for, and we cannot receive, client names, matter details, documents, or communications.
Registration collects only the firm identifiers needed to prepare and deliver your report: firm name, respondent name and role, and a contact email. Responses are stored in an isolated environment and are never sold, shared, or used to train third-party models.
Data retention
Retention and privacy
Assessment responses and the generated report are retained in your client portal for 12 months so that you can revisit findings and compare against a follow-up assessment. You can request permanent deletion at any time by writing to privacy@securejustice.com and we will confirm deletion within 30 days.
Aggregate, de-identified statistics may be published to help the profession understand emerging AI and cyber risk. No firm-identifying information is ever included in aggregate reporting.
Ready to see where your firm stands?
About 10 minutes. Confidential. Yours to keep.