A law firm’s files are a short list of everything a criminal could want: deal terms before they are public, medical and financial records, personal details from family and estate matters, and settlement funds moving through trust accounts. Firm size does not change that. A five-lawyer office holds the same kind of information as a large one, usually with less protection around it.
For lawyers, protecting that information is also a professional duty, not only an IT preference.
This is a general overview, not legal or ethics advice. Rules vary by state, so check with your state bar.
The short version
- The ABA Model Rules call for reasonable efforts to prevent unauthorized access to client information.
- Most incidents at firms start with email: a stolen password or a convincing fake message.
- A handful of basics cover most of the risk, and clients and insurers increasingly ask about them.
The ethical side
- Confidentiality. ABA Model Rule 1.6(c) says a lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, client information.
- Competence. The comments to Model Rule 1.1 say lawyers should keep up with the benefits and risks of relevant technology.
- After a breach. ABA Formal Opinion 483 discusses a lawyer’s obligations when a breach happens, including notifying affected current clients.
Most states have adopted versions of these rules, with their own wording and opinions.
Where firms get hit
- Email compromise and wire fraud. A criminal gets into one mailbox, watches a matter, and sends changed wiring instructions at the right moment.
- Ransomware. The document management system is locked days before a filing deadline.
- Lost devices. An unencrypted laptop or phone full of client email goes missing.
- Misdirected email. The wrong attachment goes to the wrong party.
- Old accounts. A former employee or contract attorney still has access.
What reasonable efforts look like in practice
- Multi-factor authentication on email, remote access, and practice and document management systems.
- Encrypted laptops and phones, with the ability to wipe a lost device.
- A call-back rule for money. Wire instructions and changes are confirmed by phone on a known number, every time.
- Access by need. People see the matters they work on, not everything.
- Tested backups of documents, email and practice management data. See how we handle data protection and backups.
- Updates applied promptly to computers, servers and network equipment.
- A secure way to share documents with clients, so sensitive files are not sitting in email.
- Training for lawyers and staff, including partners.
- An incident plan. Who calls IT, the insurer, affected clients and, where needed, the bar.
- Vendor review. Know how your cloud practice management, e-discovery and transcription providers protect your data.
Clients and insurers are asking
Corporate clients send security questionnaires before they send work. Cyber insurance applications ask whether you use multi-factor authentication and how you back up. Being able to answer yes, and show it, is becoming part of winning and keeping business.
Xceltek supports law firms with managed IT and cybersecurity, so the safeguards are in place and documented.
How would your firm answer a client security questionnaire?
We can walk through the basics with you and show you where the gaps are.
Common questions
Does a small firm really need all of this?
The duty to protect client information does not depend on firm size. What counts as reasonable can scale with the firm, but multi-factor authentication, encryption, backups and training are within reach of any office.
Can we keep client files in the cloud?
Many state bar opinions allow it when the lawyer takes reasonable care in choosing and using the provider. Check your own state’s guidance, and know how your provider secures and backs up your data.
What should we do first after a breach?
Contain it and get help. Call your IT team and your cyber insurer, work out what was accessed, and then address your notification duties under your ethics rules and state law.
