A law firm holds what attackers want: client identities, financial records, deal terms and privileged files. It also has a professional duty to protect them. This guide explains what the American Bar Association’s opinions expect of a small practice and turns that into a short action list.
Key takeaways
- The standard is “reasonable efforts,” not a fixed list. The more sensitive the matter, the more is expected.
- Process matters. ABA Opinion 477R describes assessing risk, applying safeguards, verifying them and keeping them updated.
- Plan before an attack. ABA Opinion 483 says lawyers should have an incident response plan and must tell current clients about a breach affecting their information.
- Small firms lag. In the ABA’s 2023 survey, only 37% of firms with 2 to 9 lawyers had cyber insurance.
On this page: What the rules say · Why firms are targeted · What to do first · Breach duties · Insurance · Vendors and cloud · FAQ
What do the ABA ethics opinions require?
Two opinions set the baseline. They are guidance on the Model Rules; each state adopts its own rules, so confirm yours.
ABA Formal Opinion 477R (2017) says lawyers may send client information over the internet if they make reasonable efforts to prevent unauthorized access. The standard is “not susceptible to a hard and fast rule.” It lists factors: how sensitive the information is, the likelihood of disclosure without extra safeguards, the cost and difficulty of those safeguards, and how much they would hinder the representation.
The opinion also warns that “it is not always reasonable to rely on the use of unencrypted email,” and says very sensitive material may need encryption or other enhanced protection. Staff supervision falls under Rules 5.1 and 5.3: adopt policies, train personnel and follow up.
ABA Formal Opinion 483 (2018) covers what happens after an incident. It says lawyers should make reasonable efforts to monitor their technology and vendors, should have an incident response plan decided in advance, must investigate a breach and must keep current clients reasonably informed. It declined to require notice to former clients as a matter of ethics, and suggests a document retention schedule to limit the old data you keep.
Why are law firms targeted?
Firms hold sensitive data, handle large payments and work to deadlines, which makes fake wire instructions and urgent requests effective. The FBI’s Internet Crime Complaint Center reported 24,768 business email compromise complaints and about $3.05 billion in losses in 2025 across all industries. Small firms often have no security staff, so their defenses depend on a few good habits.
For context on how common incidents are, the ABA’s 2023 Legal Technology Survey found 29% of respondents said their firm had experienced a security breach (not necessarily a data breach) and 19% did not know. In the same survey, 54% said two-factor authentication was available at their firm, and 48% had file encryption available. “Available” does not mean “used.”
What should a small law firm do first?
Our editorial order, mapped to the ABA’s process:
- Turn on MFA on email, case management, document storage and remote access. See what MFA is.
- Use a password manager so nobody reuses or shares passwords: best cybersecurity software for small business.
- Encrypt laptops and phones, and use encrypted email or a secure client portal for sensitive documents.
- Protect every device with endpoint protection that someone monitors: endpoint protection vs antivirus.
- Back up and test restores. Keep an isolated copy: backup strategy.
- Lock down payments. No change to wire or bank details without a call-back on a known number: business email compromise.
- Train everyone, including partners, and keep a record: security awareness training.
- Write a one-page incident plan with who to call (IT, insurer, counsel, and clients): incident response plan template.
- Set a retention schedule so you do not keep client data longer than needed.
You can tick through the basics with our 12-step checklist and draft policies with the security policy generator.
What must a law firm do after a breach?
Under Opinion 483 the sequence is: stop the breach and restore operations, investigate what happened and what data was affected, and tell current clients whose confidential information was involved. Separate legal obligations may also apply, such as state breach notification laws and your insurer’s notice requirements. Call your insurer early, because many policies require prompt notice. Ask your own counsel or your state bar about the rules in your state.
Does a small law firm need cyber insurance?
The ABA’s 2023 survey found 40% of firms had cyber liability coverage overall, down from 46% the year before, and 37% of firms with 2 to 9 lawyers. Cyber insurance is separate from a professional liability (malpractice) policy and often covers different things, so check both. Insurers usually ask about MFA, endpoint protection, backups and training: see cyber insurance requirements, the cost guide and our free readiness check.
What about cloud tools and outside IT providers?
Opinion 477R tells lawyers to vet vendors: review their security practices, confidentiality terms and how they handle your data, and reassess periodically. That applies to cloud storage, practice management software and your IT provider. If you use a managed provider, ask what it covers and who owns the incident: MSP vs MSSP vs MDR vs vCISO and small business cyber security services.
Frequently asked questions
Are lawyers required to use encryption?
Not in every case. ABA Opinion 477R says unencrypted email is often acceptable but not always reasonable, and that sensitive information may need encryption or other enhanced protection. Your state rules and client agreements may add requirements.
What is ABA Formal Opinion 483?
It describes a lawyer’s obligations after a data breach: monitor, have an incident response plan, investigate, and keep current clients informed. It does not require notice to former clients as a matter of ethics.
What cybersecurity does a small law firm need?
MFA, a password manager, encryption, endpoint protection, tested backups, staff training, payment-verification rules and a written incident plan.
Do law firms need cyber insurance?
It is not an ethics requirement, but many firms buy it. In the ABA’s 2023 survey, 40% of firms had cyber coverage. Check whether your malpractice policy covers cyber events.
How common are breaches at law firms?
In the ABA’s 2023 survey, 29% of respondents reported a security breach at their firm, and 19% did not know whether there had been one.
Where do I find my state’s rules?
Your state bar’s ethics opinions and rules of professional conduct. The ABA opinions are persuasive guidance, but each state decides its own rules.
Sources
- ABA Formal Opinion 477R (revised May 2017)
- ABA Formal Opinion 483 (Oct 17, 2018), as summarized by LA Legal Ethics
- ABA 2023 Cybersecurity TechReport (survey of lawyers; results are self-reported)
- FBI IC3: 2025 Internet Crime Report
Last updated October 9, 2026. SMB Security HQ provides general information, not legal, financial or professional security advice, and is not a law firm. Ethics rules vary by state; consult your state bar or counsel. See our Affiliate Disclosure and How We Test.
Written by SmbSecurity team. Reviewed by Nhon Dang, CTO.
