Law Firms
Security for law firms that hold client confidences
Your ethical duty of confidentiality now reaches your email, your document system and your vendors. We help firms take reasonable, documented steps to protect client information and respond well when something goes wrong.
- Core duty
- Reasonable efforts to protect client information
- Guidance
- ABA Formal Opinions 477R and 483
- Who asks
- Clients, insurers and state bars
- Where to start
- A risk review of email and documents
At a glance
Law firms must make reasonable efforts to prevent unauthorized access to client information under ABA Model Rule 1.6(c). CyberAccord helps firms meet that duty with managed protection for email, devices and cloud documents, independent penetration testing, and written policies and evidence that answer client security questionnaires and outside counsel guidelines.
ABA Model Rule 1.6(c)
The obligations you face
Each point below rests on a primary source. Follow the link to read the rule itself.
Confidentiality now includes your systems
Rule 1.6(c) requires reasonable efforts to prevent unauthorized access to information relating to a representation. Comment [18] weighs the sensitivity of the information, the likelihood of disclosure without added safeguards, and the cost and difficulty of those safeguards. A firm that can show it weighed these factors is better placed after an incident than one that cannot.
Electronic communication must match the sensitivity of the matter
Formal Opinion 477R says lawyers may generally use the internet to communicate with clients, but must assess the risk for each kind of information. Highly sensitive matters can call for encryption or other special precautions, and the opinion points to practices such as secure networks, strong authentication and timely patching.
A breach triggers duties to clients
Formal Opinion 483 says lawyers must make reasonable efforts to monitor their technology and vendors, act promptly to stop a breach and restore systems, find out what was accessed, and tell current clients when their information was compromised. The opinion recommends preparing an incident response plan in advance.
Competence includes the technology you use
Comment [8] to Rule 1.1 says competent lawyers keep up with the benefits and risks of relevant technology. Many states have adopted a version of this comment. In practice it means partners should understand how the firm's systems are protected, not leave it entirely to a vendor.
Sources last reviewed . This page explains obligations in general terms and is not legal advice.
Recommended services
What we recommend
Three services, most relevant first, chosen for the obligations above.
- 1 · Managed Security ServicesManaged SecurityManaged device, email, cloud app, and AWS security, with a team that monitors alerts and responds to incidents for you.
- 2 · Penetration TestingPenetration TestingManual, senior-led penetration testing of web apps, APIs, mobile apps, and networks, with prioritized findings and a re-test of fixes.
- 3 · Security QuestionnairesSecurity QuestionnairesHelp completing SIG, CAIQ, HECVAT, VSA, and custom vendor security questionnaires accurately, plus a reusable answer library.
Frameworks that apply
FAQ
Sector questions, answered
Does Rule 1.6(c) require specific security tools?
No. The rule requires reasonable efforts, judged by factors such as the sensitivity of the information and the cost of added safeguards. Your state's version of the rule governs, so check it. In practice, multi-factor authentication, managed email protection, encrypted devices and tested backups are hard to argue against.
Our clients send security questionnaires and outside counsel guidelines. Can you help?
Yes. We answer questionnaires from the controls you actually have, flag gaps honestly, and build a reusable answer library and supporting policies so the next questionnaire takes less of your time.
What should a firm do in the first hours after a suspected breach?
Contain it, preserve evidence, and bring in counsel and your cyber insurer before making statements. Formal Opinion 483 then expects you to determine what was accessed and notify affected clients. A written incident response plan makes those steps far easier to follow under pressure.
Is cloud document storage acceptable for client files?
Generally yes, if you take reasonable care choosing and supervising the provider and configure it securely. That means reviewing the vendor's security commitments, enforcing multi-factor authentication, limiting sharing links and keeping access logs.
Do small firms face the same duty as large ones?
The duty is the same; what counts as reasonable scales with the firm and the matters it handles. A small firm can meet it with a short written policy, managed protection on every device and account, and a periodic test of its defenses.
Talk to a security practitioner
Tell us what is driving the need: an audit, a client questionnaire, a contract clause or an insurance renewal. We'll recommend a scoped next step with a fixed quote.