Who We Insure
Insurance for Law Firms
Law firms sell judgment, and judgment can be second-guessed. A missed filing deadline, a conflict of interest that surfaces mid-engagement, or advice a client later blames for a bad outcome can each turn into a malpractice claim — and defending one costs real money even when the firm did nothing wrong.
Why law firms carry specialized insurance
Layer on what firms hold: privileged communications, deal terms, escrow and trust-account funds, and personal information for clients and adverse parties. That combination makes law firms persistent targets for wire-fraud schemes and ransomware, and it is why underwriters look at a firm's security controls almost as closely as its claims history. A OnePark Risk advisor builds the program around the firm's practice mix — litigation, transactional, real estate, IP — because carriers price and underwrite each differently. The goal is a stack where the malpractice, cyber, and crime pieces meet without gaps at exactly the places claims actually arrive.
The risk profile of a law firm
Most malpractice claims trace back to a handful of recurring failure modes rather than exotic legal errors — and the firm's technology and money-movement practices now sit alongside them as primary exposures. Key exposures: Missed deadlines and statute-of-limitations errors — among the most common sources of legal malpractice claims; Conflicts of interest and engagement-scope disputes; Wire-fraud and social-engineering schemes targeting closings and settlement funds; Ransomware and breach exposure on privileged client files; Employment claims as the firm hires staff and associates; Trust-account (IOLTA) theft or misapplication by an insider.
Lawyers Professional Liability (Legal Malpractice) for law firms
The core policy for any firm. It responds when a client alleges your legal work caused them financial harm — negligence, missed deadlines, conflicts, bad advice — and it funds defense counsel from the first demand letter, not just at judgment. Claims-made structure means continuous coverage and tail planning matter enormously when attorneys move firms or the firm winds down. Typically responds to: defense costs for malpractice allegations; settlements and judgments up to the limit; disciplinary-proceeding defense sublimits on many forms.
Cyber Liability for law firms
Firms hold privileged material that attackers can monetize twice — once as ransom, once as extortion over disclosure. Cyber coverage funds forensics, breach notification, client notification obligations, extortion response, and liability defense if client data is exposed. Underwriters will ask about MFA, backups, and email controls before quoting. Typically responds to: breach response: forensics, notification, credit monitoring; ransomware and cyber-extortion response; third-party liability if client data is compromised; funds-transfer fraud coverage on many forms (often sublimited).
Crime / Employee Dishonesty for law firms
Trust accounts concentrate client money under the firm's control, and both insider theft and outside social engineering aim straight at them. A crime policy covers employee theft and, with the right endorsements, funds-transfer fraud — filling the gap where cyber sublimits run out.
General Liability & Office Package (BOP) for law firms
Slip-and-fall claims from visiting clients, damage to leased office space, and the firm's own property — laptops, servers, furniture — sit here. Landlords almost always require a certificate showing general liability before handing over keys.
Workers' Compensation for law firms
Required by law in the states where the firm employs anyone — including remote staff. Beyond compliance, it is the coverage that responds to employee injury claims that would otherwise land on the firm directly.
Employment Practices Liability (EPLI) for law firms
Law firms are not immune to the claims they defend for others — discrimination, harassment, wrongful termination, and retaliation allegations from associates and staff. EPLI funds defense and settlements, and many carriers pair it with HR-risk resources.
Contract and certificate requirements
Institutional clients, insurance-defense panels, and lender referral programs increasingly set minimum malpractice limits before they will send work — $1 million per claim is a common floor, with larger engagements requiring more. Real-estate lenders and title underwriters may also require crime or fidelity coverage where the firm handles closing funds. Office leases require general liability certificates, and any engagement touching regulated data — healthcare clients, financial-services clients — may contractually require cyber coverage at stated limits. Your advisor should review these requirements before renewal so the program matches what your engagement letters actually promise.
What coverage costs
Malpractice premiums are driven by practice-area mix, attorney headcount, revenue, claims history, and limits. High-severity practice areas — plaintiff-side contingency work, securities, IP litigation, real estate — price higher than general transactional work. As of 2026, small firms commonly structure primary limits at $1 million per claim / $2 million aggregate and scale up as client requirements demand. Cyber pricing reflects the controls conversation: firms with MFA everywhere, tested backups, and email-security tooling see materially better terms. For context on why underwriters push, IBM's Cost of a Data Breach Report 2026 put the global average cost of a breach at $4.99 million — and law-firm breaches carry the added weight of privilege and client-notification duties. Rather than quoting a single number, a OnePark Risk advisor benchmarks the firm across multiple carriers and shows you how limits, deductibles, and practice-area classifications move the premium.
Illustrative example: The missed limitations period
A two-partner litigation firm takes on a personal-injury matter through a referral. A calendaring handoff fails during a paralegal transition, and the statute of limitations runs before the complaint is filed. The client sues the firm for the value of the lost claim. The lawyers professional liability policy assigns defense counsel and funds the defense; because liability is difficult to contest, the carrier negotiates a settlement reflecting the underlying claim's realistic value, paid within the policy limit less the deductible.
Illustrative example: The diverted closing wire
A real-estate practice handles a commercial closing. An attacker who has quietly monitored the firm's email for weeks sends spoofed wiring instructions from a lookalike domain days before closing, and a six-figure payoff wire goes to the fraudster's account. The firm's cyber policy triggers funds-transfer-fraud and social-engineering coverage for the recoverable portion and funds the forensic investigation of the mailbox compromise; the crime policy's endorsements respond where the cyber sublimit is exhausted. The malpractice policy stands behind any client claim that the firm's procedures fell short.
Illustrative example: Ransomware on the document management system
A mid-size firm's document management system is encrypted overnight; the attackers exfiltrate a sample of privileged files and threaten publication. Matters stall and courts grant only short extensions. Cyber coverage funds the incident-response firm, negotiation specialists, restoration from backups, notification to affected clients, and business-interruption loss for the downtime — plus defense if any client alleges the firm's safeguards were inadequate.
How much does insurance cost for a law firm?
There is no flat rate. As of 2026, pricing is driven by practice-area mix, revenue, headcount, claims and disciplinary history, and the limits selected — high-severity areas like plaintiff securities, IP, or real estate closings price above general practice. Many small firms start malpractice coverage at $1 million per claim / $2 million aggregate and layer cyber and crime alongside it; the right way to size premium is to benchmark the specific firm across several carriers rather than rely on a single quoted number.
Is malpractice insurance legally required for law firms?
In most states it is not mandatory, but the practical answer is that firms carry it anyway: courts, clients, referral panels, and partnership agreements expect it, and defending even a meritless claim without coverage is expensive. Some states add disclosure rules — California, for example, requires attorneys to disclose in writing to clients when they lack professional liability coverage.
What limits do law firms typically carry?
A $1 million per-claim / $2 million aggregate structure is a common starting point for small firms, with higher limits driven by practice area severity and client or panel requirements. Firms handling large transactions or high-stakes litigation often layer excess coverage above the primary policy.
What does 'claims-made' mean for my malpractice policy?
The policy responds to claims made while it is in force, not when the work was done. That makes continuous coverage critical: a gap can strip coverage for past work. When attorneys retire or a firm dissolves, an extended reporting period ('tail') preserves coverage for claims that surface later.
Does cyber insurance cover a stolen client wire?
Often partially — through social-engineering or funds-transfer-fraud coverage — but these are frequently sublimited well below the full cyber limit. A crime policy with the right endorsements fills the remainder. This is exactly the kind of gap a coverage review is designed to catch before an incident, not after.
Do solo attorneys and small firms really get targeted by attackers?
Yes. Attackers follow the money and the friction: small firms move large sums at closings and settlements with fewer verification layers than banks. The Sophos State of Ransomware 2025 report put the median ransom payment near $1 million and average recovery costs at $1.53 million excluding any ransom — figures that don't scale down just because the victim firm is small.
What will underwriters ask before quoting our firm?
Expect questions about practice-area mix, revenue, claims and disciplinary history, calendaring and conflict-check systems, and — for cyber — MFA, backups, email security, and wire-verification procedures. Firms with documented controls consistently see better pricing and fewer exclusions.
Can OnePark Risk work with our existing malpractice carrier?
Yes. A coverage review does not require moving your program. We benchmark your current terms against the market, flag gaps — tail exposure, cyber sublimits, missing crime coverage — and you decide whether a move is worth it.
Frequently asked questions
How much does insurance cost for a law firm?
There is no flat rate. As of 2026, pricing is driven by practice-area mix, revenue, headcount, claims and disciplinary history, and the limits selected — high-severity areas like plaintiff securities, IP, or real estate closings price above general practice. Many small firms start malpractice coverage at $1 million per claim / $2 million aggregate and layer cyber and crime alongside it; the right way to size premium is to benchmark the specific firm across several carriers rather than rely on a single quoted number.
Is malpractice insurance legally required for law firms?
In most states it is not mandatory, but the practical answer is that firms carry it anyway: courts, clients, referral panels, and partnership agreements expect it, and defending even a meritless claim without coverage is expensive. Some states add disclosure rules — California, for example, requires attorneys to disclose in writing to clients when they lack professional liability coverage.
What limits do law firms typically carry?
A $1 million per-claim / $2 million aggregate structure is a common starting point for small firms, with higher limits driven by practice area severity and client or panel requirements. Firms handling large transactions or high-stakes litigation often layer excess coverage above the primary policy.
What does 'claims-made' mean for my malpractice policy?
The policy responds to claims made while it is in force, not when the work was done. That makes continuous coverage critical: a gap can strip coverage for past work. When attorneys retire or a firm dissolves, an extended reporting period ('tail') preserves coverage for claims that surface later.
Does cyber insurance cover a stolen client wire?
Often partially — through social-engineering or funds-transfer-fraud coverage — but these are frequently sublimited well below the full cyber limit. A crime policy with the right endorsements fills the remainder. This is exactly the kind of gap a coverage review is designed to catch before an incident, not after.
Do solo attorneys and small firms really get targeted by attackers?
Yes. Attackers follow the money and the friction: small firms move large sums at closings and settlements with fewer verification layers than banks. The Sophos State of Ransomware 2025 report put the median ransom payment near $1 million and average recovery costs at $1.53 million excluding any ransom — figures that don't scale down just because the victim firm is small.
What will underwriters ask before quoting our firm?
Expect questions about practice-area mix, revenue, claims and disciplinary history, calendaring and conflict-check systems, and — for cyber — MFA, backups, email security, and wire-verification procedures. Firms with documented controls consistently see better pricing and fewer exclusions.
Can OnePark Risk work with our existing malpractice carrier?
Yes. A coverage review does not require moving your program. We benchmark your current terms against the market, flag gaps — tail exposure, cyber sublimits, missing crime coverage — and you decide whether a move is worth it.
This material is general educational information, not legal, tax, or insurance advice. Coverage availability, policy terms, and regulatory requirements vary by state, carrier, and applicant.