Cybersecurity for Lawyers and Law Firms
Cybersecurity for lawyers starts with an ethics duty. The Model Rules ask for reasonable efforts to protect client information, and corporate clients can demand proof through outside counsel guidelines and security questionnaires. We put the controls in place, keep the records, and give your managing partner a plain account of where the firm stands and what to fix next.
The short answer
Cybersecurity for lawyers means the reasonable efforts ABA Model Rule 1.6(c) requires to prevent unauthorized access to client information, with the technology competence described in Rule 1.1, Comment 8. NetSys builds and runs those safeguards for law firms: MFA, email and wire-fraud controls, device encryption, monitored endpoints, tested backups and breach readiness. This is general information, not legal advice.
Closest related page: Managed IT services for law firms. The industry page covers day-to-day IT support for firms; this page covers the security program itself, measured against the ethics rules and your clients' requirements.
ABA Model Rule 1.6(c) requires a lawyer to make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client. Comment 8 to Rule 1.1 says competence includes keeping abreast of the benefits and risks of relevant technology. New York's own Rule 1.6(c) extends the duty to former and prospective clients' information, and New York attorneys must earn CLE credit in Cybersecurity, Privacy and Data Protection.
Formal Opinion 477R says what counts as reasonable depends on the circumstances, including how sensitive the information is. Formal Opinion 483 adds a duty to monitor for breaches and to inform current clients when their material information is known or reasonably suspected to have been accessed. The rules name no products. They describe a process: know where client data lives, protect it in proportion to the risk, watch for trouble, and be able to explain what happened.
Map the client data, then close the easy doors
We start with where client information actually lives: the document management system, Microsoft 365, billing and trust accounting software, attachments saved to laptops, and the phones attorneys carry to court. Controls then go in by the harm they prevent. MFA and conditional access come first, so a stolen password alone cannot open a partner's mailbox. Payment-change callbacks, device encryption, managed endpoint detection and immutable backups follow. Ethical walls are enforced in folder and mailbox permissions, not only in a memo. We finish with an incident runbook your managing partner and outside counsel can follow at night.
What Cybersecurity for Law Firms Includes
Email and Wire-Fraud Defense
Where client funds and confidences meet the internet.
- Phishing-resistant MFA and conditional access for every attorney and staff account
- Alerts on new forwarding rules and sign-ins from unusual places
- Filtering for lookalike domains and hijacked reply chains
- A written callback rule for any change to wiring, escrow or settlement instructions
Client Confidentiality Controls
Rule 1.6(c) safeguards, set as configuration.
- Matter and ethical-wall permissions in the DMS, SharePoint and shared mailboxes
- Encryption on laptops and phones that carry client files
- Encrypted email and secure file sharing for sensitive productions
- Named, least-privilege and logged access for outside vendors
- Same-day access removal when attorneys or staff leave
Monitoring and Breach Readiness
Opinion 483 expects you to notice, then to know what happened.
- Managed endpoint detection on every firm device, part of 24/7 monitoring for managed clients
- Microsoft 365 audit logs kept long enough to rebuild an incident timeline
- An incident runbook that marks the decisions reserved for the firm and its counsel
- Immutable, tested backups of mail, documents and practice systems
Client Questionnaires and Evidence
Answers backed by records rather than memory.
- Technical answers for outside counsel guidelines and client security questionnaires
- An evidence file: MFA coverage, encryption status, training records, restore tests
- Security awareness training with phishing lures written for legal staff
- A yearly review with the managing partner or management committee
Why firms bring their security to NetSys
Fifteen minutes with a NetSys engineer, not a salesperson, and you will know where your cybersecurity for law firms stands and what it would take to fix it. Call 845-203-3914 or request a call to discuss the scope and next steps.
- Controls mapped to Rules 1.1 and 1.6(c), so the managing partner can describe the firm's reasonable efforts
- A published law-office engagement: Microsoft 365 with MFA, layered email security and independent backup
- Named engineers with logged access, who stay out of matter content
- Clear roles: we run the technical program, while ethics and notification calls stay with the firm and its counsel
- Month-to-month agreements, with no long-term contract to sign
Measured results from our case studies
Cybersecurity for Law Firms in practice
- Law firms
Elder law firm
SharePoint document organization for 28 employees, secure client file sharing, email encryption, and employee access controls.
Client names are withheld. Each card is the scope of a real NetSys engagement, as delivered.
What NetSys does, and what stays with the firm
Security work for a firm splits between technical controls and professional judgment. This is the usual split:
| Area | NetSys does | Stays with the firm |
|---|---|---|
| Email and identity | MFA, conditional access, forwarding-rule alerts and impersonation filtering | Approving any exception for an individual attorney |
| Payments | Technical controls and a written callback procedure | Making the callback on every changed instruction |
| Confidentiality | Permissions, ethical-wall enforcement and encryption | Deciding who is screened from which matter |
| Incidents | Containment, a forensic timeline from logs and a list of affected records | Client notification decisions under Opinion 483, with counsel |
| Questionnaires | Technical answers and the supporting evidence | Signing the response and any contractual commitments |
This is general information, not legal advice. Your ethics counsel decides what the rules require of your firm.
How we start with a firm
The first changes target email and payments; everything else follows a written plan.
- Intake with the managing partner or firm administrator: size, practice areas, systems and client security terms
- Access review: who can reach which matters, mailboxes and trust-account systems
- First fixes: MFA gaps, suspicious forwarding rules and unencrypted devices
- A callback procedure for payment changes, written with your bookkeeper and signed off by a partner
- Monitoring and backup brought under management, proven with a test restore
- An evidence file started, ready for the next client questionnaire
How pricing works for a law firm
Security runs inside the NetSys managed agreement, priced per user per month. We do not publish prices. The rate moves with:
- Number of attorneys and staff, and devices per person
- Document and practice-management systems in scope
- Evidence you need for client audits or questionnaires
- On-site needs across your offices
Projects such as a Microsoft 365 migration are scoped separately. Every agreement is month to month.
Cybersecurity for Law Firms FAQs
What cybersecurity rules apply to law firms?
The core rules are your state's versions of ABA Model Rules 1.1 and 1.6(c), which require technology competence and reasonable efforts to protect client information. State data-security and breach laws add duties, such as New York's SHIELD Act (GBL §899-aa and §899-bb), and client engagement terms can add more. This is general information, not legal advice.
Does ABA Model Rule 1.6 require cybersecurity?
In substance, yes. Rule 1.6(c) requires reasonable efforts to prevent unauthorized access to or disclosure of client information. It names no products; the comments list factors such as the sensitivity of the information and the likelihood of disclosure without added safeguards. In practice that means documented controls like MFA, encryption, monitoring and tested backups.
What is the biggest cyber risk for small law firms?
The two biggest risks are business email compromise and ransomware. In the FBI's 2025 IC3 report, business email compromise drew more than $3 billion in reported losses, and legal services led the list of ransomware complaints from outside the critical infrastructure sectors. For a firm, a typical case is a stolen mailbox used to redirect a settlement payment.
Do lawyers have to tell clients about a data breach?
Often, yes. ABA Formal Opinion 483 says lawyers must monitor for breaches and inform current clients when their material information is known or reasonably suspected to have been accessed. State breach laws and client contracts can add duties. We supply the facts from logs and systems; the firm and its counsel make the notification decision.
How do client security questionnaires affect a law firm?
Corporate and institutional clients can require specific controls through outside counsel guidelines and security questionnaires, and an answer the firm cannot back up becomes a liability later. We answer the technical questions from evidence we keep current, such as MFA coverage, encryption status, training records and restore tests, so the partner who signs knows each answer is true.
How is this different from managed IT for law firms?
Managed IT keeps attorneys working: help desk, devices, Microsoft 365 and the document system. This service is the security program on top of that, with controls mapped to the ethics rules, wire-fraud procedures, breach readiness and client evidence. You can get both from NetSys under one agreement, or add the security layer alongside your current IT provider.
Do New York lawyers have extra cybersecurity requirements?
Yes, a few. New York's Rule 1.6(c) extends the reasonable-efforts duty to former and prospective clients' information, and attorneys must complete at least one CLE credit hour in Cybersecurity, Privacy and Data Protection each biennial cycle. The SHIELD Act (GBL §899-bb) also requires reasonable safeguards for New Yorkers' private information, wherever the firm is based.
Sources and technical references
- ABA Model Rule 1.1, Comment 8: technology competence
- ABA Model Rule 1.6(c): reasonable efforts to protect client information
- ABA Formal Opinion 477R: securing communication of protected client information
- ABA Formal Opinion 483: lawyers' obligations after a data breach or cyberattack
- New York Rules of Professional Conduct (22 NYCRR Part 1200), including Rule 1.6(c)
- New York Courts: CLE requirement in Cybersecurity, Privacy and Data Protection
- FBI IC3 2025 Annual Report: business email compromise and ransomware complaints
Guides on this topic
- Law firm IT in New York City
- Law office case study: Microsoft 365 and layered security
- AI receptionist and intake for law firms
- IT support questions law firm owners ask
- How business email compromise works
- Phishing-resistant MFA deployment
- Incident response when a breach is suspected
- Independent Microsoft 365 backup
Show clients reasonable efforts, on paper and in practice.
Tell us your headcount, offices, document and billing systems, and any client security terms you have to meet. We will map where client information lives and propose the first fixes.