Cybersecurity for Law Firms: A 2027 Checklist

It is 4:45 on a Friday. Your closing paralegal gets an email that looks like it came from the title company, with “updated” wiring instructions and a polite note that the old account is closed. The logo is right, the signature is right, and the money is supposed to go out before the weekend.

That one email is the whole story of cybersecurity for law firms. Attackers are not trying to beat your firewall. They are trying to fool a busy person who handles client money and confidential files. This guide gives you a plain-English checklist, tied to the ABA rules you already answer to, so you can see what “reasonable efforts” looks like in practice and where your firm stands today.

Why law firm cybersecurity is an ethics duty, not just an IT project

Most firms still file security under “IT stuff.” The ABA Model Rules put it next to competence and confidentiality, and most states follow the Model Rules in some form.

Model Rule 1.1, Comment 8: technology competence

In 2012 the ABA added language to Comment 8 of Rule 1.1 saying a lawyer should keep up with changes in practice, “including the benefits and risks associated with relevant technology.” Most states have since adopted a duty of technology competence in some form. You do not need to be a security engineer, but you do need to understand the risks well enough to make sensible decisions, or bring in someone who does.

Model Rule 1.6(c): reasonable efforts to protect client information

Rule 1.6(c) asks lawyers to make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to a client’s representation. The word that matters is “reasonable.” The comments point to factors like how sensitive the information is, how likely a disclosure is without more safeguards, and the cost and difficulty of adding them.

Formal Opinions 477R, 483 and 498

A few ABA formal opinions turn those rules into something closer to a to-do list:

• Formal Opinion 477R (2017) covers securing communication of client information. It asks lawyers to understand the threats, know where client data is stored and how it is sent, use reasonable security measures, label confidential information, train staff and vet vendors.
• Formal Opinion 483 (2018) covers what happens after a data breach or cyberattack. It describes a duty to monitor for breaches, act to stop a breach and restore systems, figure out what happened, and tell current clients when their material information is involved.
• Formal Opinion 498 (2021) addresses virtual practice, which matters if your people work from home, from the courthouse or from a laptop at the kitchen table.

You can read the full opinions on the ABA’s formal ethics opinions index. Your own state’s rules and ethics opinions, plus state breach notification laws such as Connecticut’s, may add requirements of their own, so check them alongside the ABA guidance.

Your cybersecurity for law firms checklist

Here is the short version. The sections below cover each item in more detail.

1. Turn on multi-factor authentication (MFA) for email, remote access, your practice management system and anything in the cloud.
2. Give everyone a password manager and retire shared or reused passwords.
3. Set a firm-wide rule that wire and payment changes are confirmed by phone, using a number you already have on file.
4. Encrypt laptops, phones and any file you send that contains sensitive client information.
5. Back up client files, keep at least one copy the attackers cannot reach, and test restores on a schedule.
6. Keep an up-to-date list of vendors that touch client data and review how each one protects it.
7. Write a short incident response plan and make sure people know who to call first.
8. Train staff at onboarding and through the year, including practice phishing emails.
9. Secure remote work: managed devices, updates, and no client files on personal accounts.
10. Write down what you did and when. It is your evidence of “reasonable efforts.”

Secure logins and email

Many incidents start with a stolen password or a convincing email. That makes identity and email the best place to spend your first hour and your first dollar.

Multi-factor authentication

MFA means a password alone is not enough to get in. The user also has to approve a prompt on a phone, enter a code, or tap a hardware key. If a password gets phished, the attacker still hits a wall. Turn it on for Microsoft 365 or Google Workspace, your VPN or remote desktop, your practice management and document management systems, your billing and trust accounting tools, and your banking portals.

Text message codes are better than nothing, but an authenticator app with number matching, or a security key or passkey, is harder to trick. CISA recommends phishing-resistant MFA where you can use it. Our guide to the importance of multi-factor authentication explains the options in more detail.

Passwords and shared accounts

Law firms collect shared logins, like the court filing account or the research service, and nobody changes them when someone leaves. A business password manager creates unique passwords, shares them safely, and lets you remove access in one place.

Email and wire fraud

Business email compromise is the Friday afternoon scenario at the top of this page. An attacker gets into a real mailbox or spoofs one, watches the conversation, and sends new payment instructions at the worst moment. Closings and settlement payouts are common targets.

Email filtering, domain protections like SPF, DKIM and DMARC, and warnings on outside messages all help. But the control that actually stops the wire is a process:

• Any change to payment instructions gets confirmed by phone, using a number from the file or engagement letter, never the number in the email.
• Tell clients at intake that your firm will never change wiring instructions by email, and ask them to call you if they ever get a message that says otherwise.
• Require a second person to approve outgoing wires above a threshold you set.
• Watch for mailbox rules that forward or hide messages. Attackers often add them after they break in.

Protect client data: law firm data security basics

Next, look at where client information lives and how it moves. This is the heart of law firm data security, and it lines up closely with Formal Opinion 477R.

Encryption

Turn on full-disk encryption for every laptop and require a passcode and encryption on phones that get firm email. A lost laptop then becomes an inconvenience instead of a breach conversation. For email and file sharing, 477R makes the point that the level of protection should match the sensitivity of the information. Scheduling emails are one thing. Medical records, financial statements or trade secrets deserve an encrypted portal or encrypted email.

Backups you can actually restore

Ransomware attackers often go after backups, because a firm that can restore on its own has less reason to pay. Keep at least one backup copy offline or immutable, meaning it cannot be changed or deleted for a set period. Back up your cloud data too, because Microsoft 365 and similar services do not protect you from every deletion or malicious change.

A backup you have never restored is a hope, not a plan. Pick a few files and a full system on a regular schedule and prove you can bring them back. For a deeper walkthrough, see how to safeguard your law firm’s files with backup and disaster recovery.

Vendor due diligence

Your practice management platform, e-discovery vendor, cloud storage, e-signature tool, outside IT provider and even your copier service may all touch client data. The ABA opinions expect lawyers to make reasonable efforts to confirm that these vendors protect that data too. For each one, ask:

• Where is our data stored, and who at the vendor can see it?
• Is the data encrypted in transit and at rest?
• Do you support MFA and single sign-on for our users?
• How and when will you tell us about a security incident?
• What happens to our data if we leave?

Keep the answers in a simple spreadsheet and revisit it yearly. If a vendor will not answer basic questions, that is an answer too.

Build an incident response plan before you need it

Formal Opinion 483 assumes that even careful firms can have a bad day. What it asks is that you notice, respond and communicate well. That is much easier with a plan you wrote on a calm Tuesday than one you invent during a crisis.

A useful plan for a small or midsize firm can fit on a few pages:

1. Name the team. Decide who leads, who talks to clients, who calls the insurance carrier, and who works with your IT or security provider.
2. List the first calls. Keep phone numbers for your IT provider, your cyber insurance carrier, breach counsel and your bank on paper, not only in the email system that may be down.
3. Contain the problem. Disconnect affected devices, reset compromised accounts, and preserve logs and evidence instead of wiping machines right away.
4. Figure out what happened. Work out which systems and which client information were involved, because that drives every decision that follows.
5. Notify the right people. Opinion 483 addresses telling current clients. State breach notification laws may also require notice to affected individuals or regulators. Your insurance policy may have its own notice terms.
6. Learn from it. After things settle down, write up what worked, what did not, and what you will change.

Walk through the plan once a year with a short tabletop exercise. Pick a scenario, such as a partner’s mailbox being taken over, and talk through who does what.

Train your team and secure remote work

Your people are your best alarm system. The paralegal who pauses before sending a wire, or the associate who reports a strange login prompt, will stop more attacks than any single tool. Training works best when it is short, frequent and friendly.

A realistic rhythm is a briefing for every new hire, short refreshers a few times a year, and practice phishing emails with a quick explanation when someone clicks. Celebrate reports, even false alarms, so people feel safe raising a hand.

Remote and hybrid work

Formal Opinion 498 says virtual practice is fine as long as you keep your duties of competence, confidentiality and supervision. In practice:

• Use firm-managed laptops that get updates automatically, with endpoint protection that someone actually monitors.
• Keep client files in firm systems, not personal Dropbox or Gmail accounts.
• Secure home Wi-Fi, and avoid public Wi-Fi for client work unless you are on a VPN.
• Lock screens when stepping away, even at home.

For how firms keep all of this running day to day, our post on IT support for law firms covers the basics.

Frequently asked questions

What does the ABA require for law firm cybersecurity?

The ABA Model Rules do not list specific products. They require competence, including an understanding of technology risks under Rule 1.1 Comment 8, and reasonable efforts to protect client information under Rule 1.6(c). Formal Opinions 477R and 483 explain what those duties look like for communications and for breach response. Your state’s version of the rules controls, so check it as well.

Do small law firms really need cybersecurity?

Yes. Small firms hold the same kinds of sensitive information as large ones, often with fewer safeguards, which makes them attractive targets. The good news is that the most effective steps, like MFA, a password manager, a wire call-back rule and tested backups, are affordable for firms of any size.

What should a law firm do after a data breach?

Contain it first, then work out what happened and which client information was involved. Formal Opinion 483 describes duties to stop the breach, restore systems and notify current clients when their material information is affected. Call your IT provider, your cyber insurance carrier and breach counsel early, and check your state’s breach notification law.

How often should law firm staff get security training?

Train at onboarding and then several times a year, rather than once annually. Anyone who handles wires or trust accounts should get extra attention on payment fraud.

Is cyber insurance enough to protect a law firm?

No. Insurance can help pay for response costs after an incident, but it does not stop the incident or satisfy your ethical duties on its own. Insurance applications often ask about controls like MFA, backups and training, so the checklist above also helps with coverage conversations.

Getting help with cybersecurity for law firms

You do not have to do all of this at once. Start with logins and wire procedures, then work through the rest of the list over the next few months, writing down each step as you go.

EVERNET Consulting has supported businesses as a managed service provider since 2007, and today that includes cybersecurity and managed security services alongside everyday IT. We work with law firms either as your full IT team or side by side with the people you already have. Take a look at our managed IT services for law firms and our cybersecurity services, or schedule a call and we will walk through this checklist with you, one item at a time.