Industry · LegalLaw firms · legal teams

Prove client security to every client.

Law firms and legal teams hold their clients’ most sensitive information, and clients now demand proof of it. Compyl maps one control library to the security frameworks and outside counsel guidelines you’re held to, so you answer every security questionnaire with current evidence.

Last reviewed September 2026 by the Compyl GRC team

Request a demo See how it works →

Every client questionnaire125+ integrationsSOC 2 and ISO 27001

Your client-assurance year · legalLive evidence status · every control checked hourly

JanFebMarAprMayJunJulAugSepOctNovDec

JanClient OCG attestationsOutside counsel guidelines12 due · 9 answered

MarSOC 2 Type II reportClient assuranceIssued

MayISO 27001 surveillance auditCertification cycleEvidence current

Jul – AugClient security questionnairesNew matters and renewalsAI-drafted

SepAccess review · DMS and emailPrivilege and confidentialityCurrent

OctVendor and co-counsel reviewsE-discovery and DMSScheduled

Always on · confidentiality controls, privacy obligations (GDPR, CCPA), and vendor monitoringContinuous evidence, not a scramble before each client review

The challenge

Why GRC is harder for legal

Every major client sets its own security requirements, the data is privileged, and it lives in more places than any one team controls.

Client security demands

Outside counsel guidelines and client security questionnaires now require proof, often different requirements from every major client.

Confidentiality and privilege

You hold privileged, highly sensitive client data, and a single exposure can end relationships and trigger ethics obligations.

Matter-based data sprawl

Client data spreads across document management, email, and co-counsel, making consistent control hard to prove.

Who you answer to

Every requirement that governs legal work

Clients, bar rules, privacy law, and assurance frameworks, one control library. Each tile shows who sets it, what it asks, and the shared control Compyl evidences once.

Outside counsel (OCG)

Clients

Each major client

Security requirements clients impose as a condition of engagement.

Shared controlEncryption · MFA · access reviews

Different per client

SOC 2

Assurance

AICPA

The report clients most often request as proof of security.

Shared controlShared with every requirement here

Type I / Type II

ISO 27001

Assurance

Accredited bodies

A certifiable ISMS, often required by international clients.

Shared controlAnnex A controls

3-year cycle

ABA Model Rule 1.6

Ethics

State bars

Reasonable efforts to prevent unauthorized disclosure of client information.

Shared controlConfidentiality controls

Rule 1.6(c)

GDPR

Privacy

EU supervisory authorities

Personal data of EU clients, employees, and matter parties.

Shared controlArt. 32 security · Art. 30 records

72-hour breach clock

CCPA / CPRA

Privacy

California AG · CPPA

Reasonable security and privacy rights for California residents.

Shared controlSafeguards · data inventory

2026 CPPA regulations

HIPAA

Sector

HHS · OCR

Applies when you act as a business associate to healthcare clients.

Shared controlEncryption · access control

BAA required

PCI DSS v4.0.1

Card networks

PCI SSC

Client payments and trust-account card transactions.

Shared controlMFA · encryption · logging

Annual SAQ

One control library

Map one control library to every client requirement

Define controls once and cross-map them to SOC 2, ISO 27001, GDPR, CCPA, and each client’s outside counsel security requirements.

No duplicate work across clients, frameworks, or audits
Each new client requirement reuses controls you already have
Every artifact mapped to every requirement it satisfies
Coverage visible per client, not buried in spreadsheets

One control library · every client requirementCross-mapped automatically

Encryption at rest enabledPulled automatically from Microsoft 365 / AWS

5requirements

SOC 2CC6.6

Satisfied

ISO 27001A.8.24

Satisfied

Outside counsel guidelinesEncryption clause

Satisfied

GDPRArt. 32

Satisfied

HIPAA§164.312(e)

Satisfied

CCPA / CPRAReasonable security

Also covered

Each new client requirement reuses controls you already haveNo duplicate work

Questionnaire Assist

Answer client security questionnaires in minutes

Compyl drafts questionnaire responses from your live control evidence, so security reviews stop slowing down client onboarding and new matters.

AI-drafted answers from your current evidence
Reuse one knowledge base across every client review
Partners approve, Compyl keeps the audit trail
Turnaround measured in days, not weeks

Questionnaire readinessAnswered from live evidence

Client · global bank OCG186 questions

Drafted by AI171 · 92%

Awaiting review15

Turnaround2 days, not 3 weeks

Encryption and key managementAnswer cites AWS KMS evidence · refreshed 4 min ago

Answered

Access control and MFAAnswer cites Okta policy evidence · SOC 2 CC6.1

Answered

Subprocessor listVendor register export attached · partner review requested

Review

One knowledge base across every client reviewEvidence Health 97

Third-party risk

Watch co-counsel and vendor risk

Continuously assess the document platforms, e-discovery vendors, and co-counsel who touch client data, and quantify exposure in dollars.

Continuous third-party monitoring and questionnaire automation
FAIR-based risk reporting for firm leadership
Expiring SOC 2 reports and DPAs surface before they lapse
Co-counsel and vendors tiered by the data they touch

Third-party riskVendors & co-counsel · FAIR

E-discovery platformHolds privileged client data · SOC 2 on file · reviewed Q3

Critical

Document managementMatter files · questionnaire sent · monitored continuously

Medium

Practice management SaaSBilling data only · annual review

Low

Loss exposure$1.8M → $0.7M

Top scenarioVendor breach

Risk in dollars for firm leadershipFAIR-based

Collect once, satisfy every regulator

One piece of evidence. Every client it satisfies.

Compyl maps each control and its evidence across every framework and client requirement, so a single artifact, pulled automatically from your stack, answers every review at once.

One control library mapped to 70+ frameworks and every OCG
Collect evidence once and reuse it across every client review
See instantly how SOC 2 work translates to ISO 27001 or an OCG
Add the next client requirement without starting over

One controlEncryption at rest enabledPulled automatically from Microsoft 365 and AWS · scored 97 by Evidence Health1 piece of evidence

Satisfies at once

SOC 2CC6.6 Protection of data at rest

Satisfied

ISO 27001A.8.24 Use of cryptography

Satisfied

Outside counsel guidelinesEncryption clause, every client

Satisfied

GDPRArt. 32 Security of processing

Satisfied

+ 70 more frameworks cross-mapped automatically

Coverage

Frameworks that govern legal

All cross-mapped to one control library. Explore each, or see the full library of 70+.

SOC 2 ISO 27001ISO 27701GDPRCCPA / CPRAHIPAA PCI DSS NIST CSF 70+ frameworks

SOC 2 ISO 27001 GDPR Questionnaire Assist

Recognized by users on G2 · Rated a leader by the teams who use it G2 Momentum Leader, Summer 2026

Knowledge base for every client questionnaire

125+

Native integrations feeding evidence automatically

Real-time

Evidence collection, no manual screenshots

Year-round

Review readiness instead of a pre-onboarding scramble

“It has brought a sense of relief to my life because, for the first time, we have a real solution in place that is proactively keeping us protected.”

JSJon SeniorCTO · via G2

Why Compyl for legal

Built for the way legal GRC actually works

Plenty of tools store a policy. Compyl runs the whole program, controls, evidence, questionnaires, and vendors, across every client you answer to.

One source of truth

Controls, evidence, risk, and vendors in one connected system, across every client and framework.

Continuous, not point-in-time

Evidence refreshes automatically and is scored for health, so you are review-ready every day of the year.

125+ integrations

Document management, identity, cloud, and email systems feed evidence automatically.

Agentic AI, human approved

AI drafts questionnaire answers, maps controls, and triages risk; your partners approve every decision.

Risk in dollars

FAIR-based quantification turns client-data and vendor risk into numbers firm leadership can act on.

What does compliance for legal require?

Law firms and legal departments must protect client confidentiality and privilege while increasingly proving it to clients through outside counsel guidelines (OCG) and security questionnaires. Most pursue SOC 2 and ISO 27001 for client assurance, and handle GDPR, CCPA, HIPAA (for health clients), and PCI where payments are involved. Compyl maps one control library to all of them and answers client security questionnaires from your live evidence.

Obligations

What does each requirement expect you to prove?

The recurring obligations behind legal-sector compliance, with the source that sets each one.

Obligation	Source	Cadence	With Compyl
Attest to client security requirements	Outside counsel guidelines	On engagement and annually	Answers drafted from live evidence, per client
Complete security questionnaires	Clients and prospects	Every new matter or renewal	Questionnaire Assist with one knowledge base
Maintain a SOC 2 report	AICPA SOC 2	Annual Type II period	Continuous evidence for every criterion
Hold ISO 27001 certification	ISO/IEC 27001	Annual surveillance, 3-year cycle	Annex A controls monitored continuously
Protect client confidentiality	ABA Model Rule 1.6	Continuous	Access, encryption, and monitoring evidenced
Notify after a personal-data breach	GDPR Art. 33	72 hours to the regulator	Incident workflow with the notification record

Legal FAQ

Legal questions, answered

What compliance do law firms and legal teams need?

Law firms and legal departments must protect client confidentiality and privilege, and increasingly prove security to clients through outside counsel guidelines and security questionnaires. Most pursue SOC 2 and ISO 27001 for assurance, plus GDPR, CCPA, HIPAA, and PCI depending on clients and payments. Compyl maps one control library to all of them.

How does Compyl help with client security questionnaires?

Compyl maintains one knowledge base of your controls and live evidence, and drafts questionnaire answers automatically. Instead of re-answering each client’s review from scratch, your team approves AI-drafted responses backed by current proof, so security reviews stop delaying onboarding and new matters.

Can Compyl help meet outside counsel guidelines (OCG)?

Yes. Compyl maps your controls to the security requirements clients impose through outside counsel guidelines, and continuously collects the evidence that proves them, so you can demonstrate compliance to each client with current data rather than point-in-time attestations.

Does Compyl support SOC 2 and ISO 27001 for legal tech and firms?

Yes. SOC 2 and ISO 27001 are the frameworks clients most often require. Compyl automates evidence collection and continuous monitoring for both, and cross-maps shared controls so achieving the second framework reuses most of the work from the first.

Does Compyl cover co-counsel and vendor risk?

Yes. Compyl continuously assesses and monitors the document platforms, e-discovery vendors, and co-counsel who touch client data, automates their security questionnaires, and quantifies exposure in dollars for firm leadership.

What does ABA Formal Opinion 512 require when lawyers use generative AI?

Issued July 29, 2024, it applies the duties of competence, confidentiality, communication and reasonable fees to generative AI. Lawyers must understand a tool’s risks, protect client information, may need informed consent before entering confidential data, and may not bill for time spent learning the tool.

Must a law firm notify clients after a data breach?

Yes. ABA Formal Opinion 483 says lawyers must monitor for breaches, act promptly to stop them, restore systems and tell current clients when material confidential information is involved. Rule 1.6(c) separately requires reasonable efforts to prevent unauthorized access.

Are ISO 27001:2013 certificates still valid?

No. The transition to ISO/IEC 27001:2022 ended on October 31, 2025, and 2013-version certificates are no longer valid. Clients reviewing outside counsel now expect a 2022 certificate.

GRC your way

See Compyl mapped to your client security demands

One control library, every client requirement, continuous evidence, and agentic AI that removes the busywork, with your experts in control.

Request a demo All industries →