# Security for law firms that hold client confidences

> Law firms must make reasonable efforts to prevent unauthorized access to client information under ABA Model Rule 1.6(c). CyberAccord helps firms meet that duty with managed protection for email, devices and cloud documents, independent penetration testing, and written policies and evidence that answer client security questionnaires and outside counsel guidelines.

Source: https://www.cyberaccord.com/industries/law-firms · Last reviewed: 2026-10-22

Your ethical duty of confidentiality now reaches your email, your document system and your vendors. We help firms take reasonable, documented steps to protect client information and respond well when something goes wrong.

## Key facts

- **Core duty:** Reasonable efforts to protect client information
- **Guidance:** ABA Formal Opinions 477R and 483
- **Who asks:** Clients, insurers and state bars
- **Where to start:** A risk review of email and documents

## The obligations and risks you face

### Confidentiality now includes your systems

Rule 1.6(c) requires reasonable efforts to prevent unauthorized access to information relating to a representation. Comment [18] weighs the sensitivity of the information, the likelihood of disclosure without added safeguards, and the cost and difficulty of those safeguards. A firm that can show it weighed these factors is better placed after an incident than one that cannot.

Source: [ABA Model Rule 1.6, Comment [18]](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_6_confidentiality_of_information/comment_on_rule_1_6/)

### Electronic communication must match the sensitivity of the matter

Formal Opinion 477R says lawyers may generally use the internet to communicate with clients, but must assess the risk for each kind of information. Highly sensitive matters can call for encryption or other special precautions, and the opinion points to practices such as secure networks, strong authentication and timely patching.

Source: [ABA Formal Opinion 477R (2017)](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-477.pdf)

### A breach triggers duties to clients

Formal Opinion 483 says lawyers must make reasonable efforts to monitor their technology and vendors, act promptly to stop a breach and restore systems, find out what was accessed, and tell current clients when their information was compromised. The opinion recommends preparing an incident response plan in advance.

Source: [ABA Formal Opinion 483 (2018)](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-op-483.pdf)

### Competence includes the technology you use

Comment [8] to Rule 1.1 says competent lawyers keep up with the benefits and risks of relevant technology. Many states have adopted a version of this comment. In practice it means partners should understand how the firm's systems are protected, not leave it entirely to a vendor.

Source: [ABA Model Rule 1.1, Comment [8]](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_1_competence/comment_on_rule_1_1/)

## What we recommend

- [Managed Security](https://www.cyberaccord.com/services/managed-security)
- [Penetration Testing](https://www.cyberaccord.com/services/security-testing/penetration-testing)
- [Security Questionnaires](https://www.cyberaccord.com/services/advisory/security-questionnaires)

## Applicable frameworks

- [Data Privacy](https://www.cyberaccord.com/compliance/data-privacy)
- [SOC 2](https://www.cyberaccord.com/compliance/soc-2)

## Frequently asked questions

### Does Rule 1.6(c) require specific security tools?

No. The rule requires reasonable efforts, judged by factors such as the sensitivity of the information and the cost of added safeguards. Your state's version of the rule governs, so check it. In practice, multi-factor authentication, managed email protection, encrypted devices and tested backups are hard to argue against.

### Our clients send security questionnaires and outside counsel guidelines. Can you help?

Yes. We answer questionnaires from the controls you actually have, flag gaps honestly, and build a reusable answer library and supporting policies so the next questionnaire takes less of your time.

### What should a firm do in the first hours after a suspected breach?

Contain it, preserve evidence, and bring in counsel and your cyber insurer before making statements. Formal Opinion 483 then expects you to determine what was accessed and notify affected clients. A written incident response plan makes those steps far easier to follow under pressure.

### Is cloud document storage acceptable for client files?

Generally yes, if you take reasonable care choosing and supervising the provider and configure it securely. That means reviewing the vendor's security commitments, enforcing multi-factor authentication, limiting sharing links and keeping access logs.

### Do small firms face the same duty as large ones?

The duty is the same; what counts as reasonable scales with the firm and the matters it handles. A small firm can meet it with a short written policy, managed protection on every device and account, and a periodic test of its defenses.

## Contact CyberAccord

- Book a free consultation: https://www.cyberaccord.com/contact
- Phone: +1 (832) 429-5665
- Email: info@cyberaccord.com