# What does ABA Model Rule 1.6(c) require of a law firm's security?

> Model Rule 1.6(c) requires reasonable efforts to prevent unauthorized access to or disclosure of client information. It does not list specific controls. Comment [18] sets out factors for judging reasonableness, and ABA Formal Opinions 477R, 483, 498 and 512 describe what that looks like in practice: risk assessment, MFA and encryption, vendor diligence, training, monitoring, an incident response plan and client notice.

Source: https://www.cyberaccord.com/insights/aba-rule-1-6-law-firm-security · Guide by CyberAccord Security Team, CyberAccord · Published 2026-10-22 · Last reviewed 2026-10-22

The duty of confidentiality now has a technology dimension. This guide maps the ABA Model Rules and the ethics opinions that interpret them to the controls a firm can actually put in place and evidence.

![Cover graphic for the ABA Model Rule 1.6(c) guide: five circles linked to a central circle with a gold core, standing for the Comment 18 reasonableness factors.](https://www.cyberaccord.com/assets/insights/aba-rule-1-6-law-firm-security-cover.webp)

Cover image: Cover graphic for the ABA Model Rule 1.6(c) guide: five circles linked to a central circle with a gold core, standing for the Comment 18 reasonableness factors.

## Key takeaways

- Rule 1.6(c) sets a reasonable-efforts standard, not strict liability: a breach is not itself a violation if the firm made reasonable efforts to prevent it.
- Comment [18] lists the factors that decide what is reasonable, including the sensitivity of the information and the cost and difficulty of additional safeguards.
- Formal Opinion 483 adds a duty to monitor for breaches, act promptly to stop them, and notify current clients when material client information is involved.
- Rules 5.1 and 5.3 make firm leaders responsible for policies, training and the diligence applied to vendors, including generative AI providers under Formal Opinion 512.
- The Model Rules only bind lawyers once a state adopts them, so confirm your own jurisdiction's version and opinions.

ABA Model Rule 1.6(c) requires a lawyer to "make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client." The rule names no specific technology. The Comments give factors for judging reasonableness, and ABA formal opinions apply them to email, breaches, remote work and generative AI. The practical result is a documented security program a firm can explain to a client or a disciplinary authority.

> [!NOTE]
> The ABA Model Rules are a template. Each state adopts its own version, sometimes with different wording or comment numbering, and ABA formal opinions are advisory. Formal Opinion 483 states plainly that the rules and opinions of individual jurisdictions are controlling. Check your state's rules and ethics opinions. This guide is general information, not legal advice.

## What standard does Rule 1.6(c) set?

Rule 1.6(c) was added in 2012, in the same package of technology amendments that changed Comment [8] to Rule 1.1. That comment now says a lawyer should keep abreast of changes in the law and its practice, "including the benefits and risks associated with relevant technology."

Comment [18] to Rule 1.6 does two things. First, it states that unauthorized access or disclosure "does not constitute a violation of paragraph (c) if the lawyer has made reasonable efforts to prevent the access or disclosure." Formal Opinion 483 repeats the point: the standard "is not a strict liability standard and does not require the lawyer to be invulnerable or impenetrable."

Second, Comment [18] lists nonexclusive factors for judging reasonableness:

- the sensitivity of the information
- the likelihood of disclosure if additional safeguards are not employed
- the cost of employing additional safeguards
- the difficulty of implementing the safeguards
- the extent to which the safeguards adversely affect the lawyer's ability to represent clients

**Figure 1. The Comment 18 factors for judging reasonable efforts. The list is nonexclusive, and a client can require more by agreement.**

![Five factor boxes feed into one bar labelled what counts as reasonable efforts under Rule 1.6(c): the sensitivity of the information, the likelihood of disclosure without more safeguards, the cost of additional safeguards, the difficulty of implementing them, and the effect on the lawyer's ability to represent clients.](https://www.cyberaccord.com/assets/insights/aba-comment-18-factors.svg)

Image description: Five factor boxes feed into one bar labelled what counts as reasonable efforts under Rule 1.6(c): the sensitivity of the information, the likelihood of disclosure without more safeguards, the cost of additional safeguards, the difficulty of implementing them, and the effect on the lawyer's ability to represent clients.

Comment [19] addresses transmission. A lawyer must take reasonable precautions when sending client information, but special security measures are not required where the method of communication affords a reasonable expectation of privacy. Relevant considerations include the sensitivity of the information and whether privacy is protected by law or by a confidentiality agreement.

Formal Opinion 477R, adopting language from the ABA Cybersecurity Handbook, describes the standard as requiring a "process" to assess risks, identify and implement appropriate security measures, verify that they are effectively implemented, and update them as circumstances change. That is the core of a security program, and it is the part a firm should be able to show on paper.

**Figure 2. The process Formal Opinion 477R describes: assess, implement, verify and update, as a continuing cycle.**

![Four steps in a loop: assess risks, implement measures, verify that they work, and update them as circumstances change, then repeat.](https://www.cyberaccord.com/assets/insights/aba-477r-security-process.svg)

Image description: Four steps in a loop: assess risks, implement measures, verify that they work, and update them as circumstances change, then repeat.

## What do the ABA formal opinions add?

### Formal Opinion 477R (2017): securing client communications

Opinion 477R concludes that a lawyer generally may send client information over the internet after making reasonable efforts to prevent unauthorized access. It adds that special precautions may be required by client agreement, by law, or by the sensitivity of the information. Unencrypted routine email generally remains acceptable, but the opinion says it is "not always reasonable" to rely on it.

The opinion offers seven considerations: understand the nature of the threat; understand how client information is transmitted and where it is stored; understand and use reasonable electronic security measures; decide how each kind of communication should be protected; label confidential information; train lawyers and nonlawyer assistants; and conduct due diligence on technology vendors. It names specific options, including secure Wi-Fi or a VPN, firewalls and anti-malware, patching, remote wipe of lost devices, encryption of stored data, and multi-factor authentication.

### Formal Opinion 483 (2018): after a breach

Opinion 483 concludes that lawyers must make reasonable efforts to monitor technology resources, external data sources and external vendors so that a breach is not discovered only by happenstance. Once a breach is detected, the lawyer must act reasonably and promptly to stop it and mitigate damage, make reasonable efforts to restore operations, and determine what occurred.

The opinion encourages firms to develop an incident response plan before an incident, with named team members, backups for each role and defined steps. When a breach involves, or has a substantial likelihood of involving, material client information, Rule 1.4 requires notice to current clients. The opinion declines to require notice to former clients as a matter of ethics, but notes that privacy law or contracts may. It also stresses that complying with breach notification statutes does not by itself satisfy the ethics rules, and the reverse is also true.

### Formal Opinion 498 (2021): virtual practice

Opinion 498 applies the same duties to remote work. It calls for reviewing terms of service for hardware, software and meeting platforms; regular backups with secure access to them; a data breach policy; caution with smart speakers and other listening devices; and a bring-your-own-device policy covering strong passwords, VPN access, updates, phishing training and remote wipe.

### Formal Opinion 512 (2024): generative AI tools

Opinion 512 treats generative AI as another technology that engages competence, confidentiality and supervision. Because many self-learning tools could disclose information relating to one representation to other users, a client's informed consent is required before inputting such information into those tools. Boilerplate in an engagement letter is not enough. At a minimum, lawyers should read and understand the tool's terms of use and privacy policy, or consult someone who has. Managerial lawyers must set clear policies on permissible use, and the vendor diligence factors from earlier opinions apply to AI providers.

> [!QUOTE]
> The standard requires a "process" to assess risks, identify and implement appropriate security measures responsive to those risks, verify that they are effectively implemented, and ensure that they are continually updated in response to new developments. (ABA Formal Opinion 477R)

> **Next step:** Need to show a client or your partners that your safeguards are reasonable? We can help you document the program. [Explore Law Firms](https://www.cyberaccord.com/industries/law-firms) · [Book a free consultation](https://www.cyberaccord.com/contact)

## What do Rules 5.1 and 5.3 require?

Rule 5.1 requires partners and lawyers with comparable managerial authority to make reasonable efforts to ensure the firm has measures giving reasonable assurance of compliance. Rule 5.3 extends this to nonlawyer assistants, inside and outside the firm. Opinion 477R reads these rules to require security policies, periodic training and follow-up to confirm the policies are working.

For outside vendors, Opinion 477R lists diligence points drawn from Formal Opinion 08-451: reference checks and credentials, the vendor's security policies and protocols, hiring practices, confidentiality agreements, conflicts checking, and the availability of a legal forum for relief. Comment [3] to Rule 5.3 adds the vendor's reputation, the nature of the services, the terms protecting client information, and the legal environment where the work is performed.

## Which controls meet each obligation?

| Obligation | Source | Practical controls |
| --- | --- | --- |
| Assess risk by sensitivity and likelihood | Rule 1.6 Comment [18]; Opinion 477R | Data inventory, matter sensitivity tiers, documented risk assessment reviewed periodically |
| Use reasonable electronic safeguards | Opinions 477R and 498 | Multi-factor authentication, device and laptop encryption, patching, endpoint protection, VPN or secure remote access |
| Protect communications in proportion to sensitivity | Rule 1.6 Comment [19]; Opinion 477R | Email authentication and filtering, encrypted email or secure portals for sensitive matters, agreed client communication methods |
| Monitor for breaches | Opinion 483 | Centralized logging, alerting on suspicious sign-ins, monitored endpoints and email |
| Stop, restore and investigate | Opinion 483 | Written incident response plan, tested backups, forensic support arranged in advance |
| Notify affected clients | Opinion 483; Rule 1.4 | Notification decision steps in the response plan, engagement letter terms on file handling at termination |
| Supervise lawyers and staff | Rules 5.1 and 5.3; Opinions 477R and 498 | Security and acceptable-use policies, phishing training, BYOD rules, periodic compliance checks |
| Vet vendors, including AI tools | Rule 5.3; Opinions 477R and 512 | Vendor questionnaires, contract confidentiality terms, terms-of-use review, an approved AI tools list |
| Meet client-specific requirements | Rule 1.6 Comment [18]; Opinion 477R | Tracking outside counsel guidelines, answering client security questionnaires with evidence |

## What if a client requires more?

Opinion 477R notes that a client may require security measures beyond what Rule 1.6 demands, quoting Comment [18]. In practice, corporate clients express this through outside counsel guidelines and security questionnaires. Once a firm agrees to those terms, they become part of what reasonable efforts means for that client. Keep a register of what each client requires and evidence that you meet it.

## Where to start

1. Inventory where client information lives, including cloud services, personal devices and AI tools.
2. Turn on multi-factor authentication for email, document management and remote access.
3. Write and test an incident response plan that includes the client notification decision.
4. Confirm backups run, are protected from tampering and can be restored.
5. Review your top vendors against the Opinion 477R diligence points.
6. Adopt a written generative AI use policy that reflects Opinion 512.
7. Train everyone, then check that the training is followed.

For help building this into a program, see our work with [law firms](https://www.cyberaccord.com/industries/law-firms), our [virtual CISO advisory](https://www.cyberaccord.com/services/advisory/vciso) and [security questionnaire support](https://www.cyberaccord.com/services/advisory/security-questionnaires). [Penetration testing](https://www.cyberaccord.com/services/security-testing/penetration-testing) is one way to verify that safeguards work. To discuss your firm, [contact us](https://www.cyberaccord.com/contact).

## Build a security program your clients can verify

We help firms turn Rule 1.6(c) and the ABA opinions into documented controls: risk assessment, MFA and encryption, monitoring, an incident response plan, and evidence for client security questionnaires.

- Law Firms: https://www.cyberaccord.com/industries/law-firms
- Book a free consultation: https://www.cyberaccord.com/contact

## Frequently asked questions

### Is a law firm in violation of Rule 1.6(c) if it suffers a breach?

Not automatically. Comment [18] states that unauthorized access or disclosure is not a violation of paragraph (c) if the lawyer made reasonable efforts to prevent it. Formal Opinion 483 confirms the standard is not strict liability.

### Can lawyers use generative AI tools with client information?

Formal Opinion 512 says that for self-learning tools that could disclose information to other users, the client's informed consent is required before inputting information relating to the representation. Boilerplate in an engagement letter is not enough.

### Do lawyers have to tell clients about a data breach?

Under Formal Opinion 483, Rule 1.4 requires notice to current clients when a breach involves, or has a substantial likelihood of involving, material client information. Privacy law or contracts may add duties, including to former clients.

## Sources

- [Rule 1.6 Confidentiality of Information - Comment](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_6_confidentiality_of_information/comment_on_rule_1_6/), American Bar Association
- [Rule 1.1 Competence - Comment](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_1_competence/comment_on_rule_1_1/), American Bar Association
- [Formal Opinion 477R: Securing Communication of Protected Client Information](https://www.americanbar.org/content/dam/aba/administrative/law_national_security/FO%20477%20REVISED%2005%2022%202017.authcheckdam.pdf), ABA Standing Committee on Ethics and Professional Responsibility, 2017
- [Formal Opinion 483: Lawyers' Obligations After an Electronic Data Breach or Cyberattack](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-op-483.pdf), ABA Standing Committee on Ethics and Professional Responsibility, 2018
- [Formal Opinion 498: Virtual Practice](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-498.pdf), ABA Standing Committee on Ethics and Professional Responsibility, 2021
- [Formal Opinion 512: Generative Artificial Intelligence Tools](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf), ABA Standing Committee on Ethics and Professional Responsibility, 2024

Last reviewed 2026-10-22. General guidance, not legal advice.

## Contact CyberAccord

- Book a free consultation: https://www.cyberaccord.com/contact
- Phone: +1 (832) 429-5665
- Email: info@cyberaccord.com