An assessment your partners can read.

The obligation is not abstract once you trace it through the firm. Model Rule 1.1 Comment 8 made technological competence part of the duty of competence, which means the partnership cannot treat the IT environment as someone else's department. Rule 1.6(c) does not require any particular product or configuration; it asks for reasonable efforts, judged against what a similar firm in similar circumstances would do. That standard is the reason a documented, independent reading of the environment matters more than any single control. When a firm can show that it looked, that it understood what it found, and that it acted on it, the reasonableness question answers itself. When a firm cannot show that it looked, the absence is the finding.

Rule 5.3 is the part most firms underread. The supervisory obligation that applies to paralegals and contract reviewers applies with equal force to the managed service provider that holds standing access to the firm's systems. The MSP is a nonlawyer assistant whose conduct the firm is responsible for supervising, and supervision that exists only as a verbal understanding is not supervision a carrier or an auditor will credit. A named provider contact, a defined escalation path, and a periodic review of what the provider has actually done are the documentary form the rule expects. A Tidebreak assessment produces exactly that record, mapped to the safeguard and the rule at the same time, so the partnership can see both the control and the obligation in a single line.

What the assessment delivers, in practice, is a finding set your partners can read without translation and your IT provider can act on without a meeting to interpret it. Each finding cites the evidence behind it, the CIS Controls v8.1.2 safeguard it implicates, and the ABA Model Rule it touches, so the same document serves the managing committee, the outside auditor, and the provider who has to remediate. We test a risk-based sample rather than every control, we document why we sampled where we did, and we record what we observed against what the provider reported. The boundary is as clear as the scope. We describe exposure and recommend remediation; the firm and its counsel make every compliance and privilege determination that follows.

For a law firm, the stakes of an IT gap are rarely measured in downtime. They are measured in the partnership's standing with the people who judge it. A cyber insurance carrier that asks for control evidence at renewal is deciding whether to write the policy and at what premium; a firm that can produce an independent assessment answers the underwriter's questions before they harden into exclusions. An outside auditor reviewing the firm's controls wants workpaper-grade documentation, not assurances. A client running its own vendor diligence increasingly sends a security questionnaire before sending the next matter, and the firm that can attach a framework-mapped reading is the firm that keeps the work. And at the partner level, the risk is personal: a conduct-rule exposure that surfaces after an incident is the kind of finding that follows a name, not just a firm. An independent assessment is how the partnership converts a question it cannot answer about itself into evidence it can hand to anyone who asks.