Cybersecurity for law firms: A practical checklist

Law firms hold exactly what criminals want: confidential client files, personal details, and in many practices, large sums of money moving through trust accounts and closings. Small and solo firms face the same threats as big ones, without an IT department to lean on.

This guide covers the practical steps that matter most for a small firm. It isn't legal advice. Your obligations come from your own state's rules of professional conduct, so check your state bar's ethics guidance alongside it.

Why do law firms need strong cybersecurity?

For lawyers, security is a professional duty as well as good business sense. ABA Model Rule 1.6(c) says a lawyer "shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client." Many states have adopted similar language in their own rules.

"Reasonable" doesn't mean perfect. ABA Formal Opinion 477R explains that what counts as reasonable "is not susceptible to a hard and fast rule, but rather is contingent upon a set of factors." The comments to Rule 1.6 list those factors, including the sensitivity of the information, the likelihood of disclosure without more safeguards, the cost and difficulty of those safeguards, and whether they make it harder to represent clients. The ABA's Law Practice Today summarizes 477R, 483 and the related rules well.

In practice, that means a risk-based approach: understand where client data lives, use sensible protections, and revisit them as threats change.

Your next step: look up your state bar's technology or cybersecurity ethics opinions and save the links with this checklist.

How does wire fraud target law firms?

The most expensive threat for many small firms is business email compromise (BEC). A criminal gets into an email account, or sends emails that look like they come from one, and redirects a payment.

The FBI says these scams target every participant in a real estate transaction, including buyers, sellers, real estate attorneys, title companies and agents. Once inside a mailbox, criminals quietly watch the deal, then send a last-minute request to change the payment method or send funds to a new account.

27%

The same pattern shows up in settlement payouts, retainer refunds and vendor invoices. A few simple rules break it:

• Send wire instructions early, in a secure way, and tell clients in writing that you will never change them by email.
• Confirm every change by phone using a number you already have on file, never the number in the email.
• Call to confirm receipt after funds are sent, so a diversion is spotted quickly.
• If something goes wrong, act fast. The FBI advises contacting your bank immediately to request a recall and filing a complaint at ic3.gov regardless of the amount.

Start by adding a wire fraud warning to your engagement letters and email signature, and make phone verification a written office policy.

How do I stop scammers impersonating my firm's email?

Even if nobody breaks into your mailbox, scammers can send email that appears to come from your domain, such as yourbusiness.com. Three DNS records make that much harder: SPF, DKIM and DMARC. The FTC recommends all three for any business using its own domain for email.

• SPF lists the services allowed to send email for your domain, like Microsoft 365 and your practice management software.
• DKIM adds a digital signature that proves the email wasn't forged or changed.
• DMARC tells receiving providers what to do with messages that fail those checks: monitor, quarantine or reject.

Start DMARC in monitoring mode (p=none), review the reports for a few weeks to make sure your real email passes, then move to p=quarantine. That's when fake emails using your domain start landing in spam instead of a client's inbox.

DMARC protects your own domain. It doesn't stop look-alike domains such as yourbusines.com, so phone verification of payments still matters.

Your next step: check your domain with the free DMARC checker. If no record exists, follow how to fix a missing DMARC policy, or our GoDaddy DMARC guide if your domain's DNS is at GoDaddy.

How do I lock down accounts and devices?

Most break-ins start with a stolen password. Multi-factor authentication (MFA) means a password alone isn't enough to get in. CISA recommends MFA for all users, "starting with privileged, administrative and remote access users."

Turn on MFA for email first, whether that's Microsoft 365, Google Workspace or your host. Then add it to practice management and billing software, document storage and client portals, online banking and trust account access, remote access tools, and your domain registrar.

Next, protect the devices that hold client files. The FTC recommends encrypting laptops, tablets, smartphones and removable drives that contain sensitive information. On Windows that's BitLocker or Device Encryption; on Macs it's FileVault; most modern phones encrypt their storage once a passcode is set.

Add automatic updates, automatic screen lock, and the ability to remotely wipe a lost phone. Keep client work off personal devices that nobody manages, or set clear rules for them.

This week, check in your email admin console that every attorney and staff member has MFA turned on.

Check how your firm looks from the outside

Run a free check of your website and email records, including SPF, DKIM and DMARC, and get plain-English fixes.

• Free check
• No signup
• No changes to your website

Get your free report in seconds.

Your website address

Check my website

How should a small firm share documents with clients?

Email is convenient, but it wasn't designed for highly sensitive documents. ABA Formal Opinion 477R says lawyers generally may use the internet to communicate with clients if they make reasonable efforts to prevent unauthorized access, and that some matters call for extra precautions.

A practical approach for most small firms:

• Routine messages like scheduling can go by regular email, as long as your email account itself is well protected.
• Sensitive documents like financial records, medical records or settlement details are better shared through a client portal or encrypted email. Many practice management tools include a portal, and Microsoft 365 and Google Workspace offer encryption options on some plans.
• Ask the client. Some clients have their own requirements, and a quick conversation about how you'll communicate shows you take their confidentiality seriously.

Be careful with email addresses that autocomplete. Sending a document to the wrong "John" is one of the easiest ways to disclose something by accident.

Your next step: pick one secure sharing method for sensitive files and tell your whole team to use it by default.

What should I ask my practice management vendor?

Cloud practice management, document storage and e-billing tools hold your most sensitive data. The ABA notes that Model Rule 5.3 extends a lawyer's supervisory duties to outside services, which means reasonable diligence on vendors. The FTC also advises putting security expectations in vendor contracts.

Ask each key vendor:

• Do you support multi-factor authentication, and can we require it for all users?
• Is our data encrypted in storage and in transit?
• Where is our data stored, and who at your company can access it?
• How and how quickly will you tell us about a security incident?
• Can we export all of our data if we leave?
• Do you have an independent security audit or report you can share?

Most established legal software vendors publish answers on a security or trust page. Save a copy with your records.

List your top three vendors and check that MFA is required on each one.

What goes in a law firm incident response plan?

ABA Formal Opinion 483 says lawyers should consider "proactively developing an incident response plan" before a breach happens. It describes duties to monitor for breaches, act promptly to stop a breach and restore systems, determine what happened, and notify current clients when material client information was accessed or reasonably suspected to have been.

A one or two page plan for a small firm covers:

• Who makes decisions during an incident.
• Who to call, including your IT provider, malpractice and cyber insurers, bank, and outside counsel experienced in data breaches.
• First steps, such as disconnecting affected devices, changing passwords, preserving evidence, and contacting the bank if funds moved.
• How you'll decide whether client notification is required under the ethics rules and your state's breach notification laws.
• Where your backups are and how to restore from them.

Keep a printed copy somewhere you can reach without your computer or email. If your email is compromised, you can't rely on it to coordinate the response.

Your next step: draft the "who to call" list today, including after-hours numbers, and print it.

What's on a law firm cybersecurity checklist?

Here's the full list in one place. A small firm can work through it over a few weeks.

For broader basics like Wi-Fi, passwords and website settings, see the small business cybersecurity checklist.

What should you do next?

Start with the two steps that protect client money and your firm's name.

1. Check your domain with the DMARC checker and fix anything missing. Our guide to stopping email spoofing walks you through it.
2. Turn on MFA for every mailbox and write down your phone verification rule for payments.
3. Run the free website security scan to check your website, certificate and email records in one go.
4. Spend an hour on a cybersecurity risk assessment to decide what to tackle next.