The New York State Department of Financial Services proposed new rules earlier this month that would require annual assessments of companies’ third-party vendors—including law firms and solo practitioners—to ensure their compliance with cybersecurity rules.

At a panel discussion in New York on Tuesday, law firm data experts described the unique challenges that small and medium-sized firms face in combating cyberattacks. They also discussed how firms can show security assessors and clients that they have adequate defenses in place.