Law firm IT
IT that protects the client file.
A law firm’s technology is part of how it keeps client confidences. This page explains what that duty looks like on an ordinary Tuesday: sign-ins, laptops, email, file sharing, wires and backups.
Sample data · “Your Business”
Quick answer
What is a law firm responsible for when it comes to IT security?
A lawyer’s duty of confidentiality extends to how client information is stored and sent. In practice that means reasonable safeguards: multi-factor sign-in, encrypted laptops, protected email, secure file sharing, tested backups and prompt removal of access when someone leaves. The firm stays responsible even when a vendor does the work.
The duty, in plain words
Reasonable care, kept current.
The American Bar Association’s Model Rule 1.6(c) says a lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client. Each state adopts its own rules, and Alabama’s wording differs from the model.
The Alabama State Bar has addressed electronic files directly. Its Formal Opinion 2010-02 says a lawyer may store client files electronically, including with a third-party or “cloud” provider, if the lawyer uses reasonable care. Files must be kept secure from outside intrusion and backed up so they can be restored, the lawyer should understand how a provider stores and secures the data, and the duty to keep up with security safeguards continues as technology changes. The same opinion says the client’s file should be kept at least six years, and some files far longer.
Notice what that standard does not say: it names no product and no checklist. It asks whether the firm’s precautions were reasonable for the sensitivity of what it holds. For what applies to your practice, ask the Alabama State Bar’s Office of General Counsel.
What reasonable looks like
Six safeguards a small firm can act on.
None of these is exotic. Together they answer most of what a client, a malpractice carrier or a cyber insurance application will ask.
Multi-factor sign-in
A password plus a second step for email, the document system and remote access. A stolen email password is one of the most common ways into a small firm, and a second step stops it from being enough.
Encrypted laptops and phones
Full-disk encryption means a laptop left in a car is a lost machine, not a disclosure of every matter stored on it. Phones that carry firm email need a passcode and the ability to be wiped remotely.
Email protection
Filtering for phishing and fake sign-in pages, plus SPF, DKIM and DMARC records so others cannot easily send mail that appears to come from your firm.
Secure file sharing
Send sensitive documents through a client portal or an expiring, access-controlled link instead of as an attachment. An attachment lives forever in every inbox it touches.
Departing-staff access
The day someone leaves: account disabled, email forwarded to a supervising attorney, shared passwords changed, firm data removed from personal devices. Keep a record that it was done.
Document management and backup
One organized home for matter files, with access by role. Follow the 3-2-1 rule: three copies, two kinds of storage, one off site. Test a restore; an untested backup is a hope.
Wire fraud
Settlements and closings are the target.
- 01
How it works
A criminal gets into an email account, or imitates one, watches a transaction, and sends changed wire instructions at the moment money is about to move. The message looks routine and often arrives in an existing thread.
- 02
Verify by voice, every time
Before sending any wire, and whenever instructions change, call a phone number you already had on file. Never use a number from the email that carried the instructions.
- 03
Tell clients at the start
Put it in the engagement letter and the email footer: the firm will never change wire instructions by email, and the client should call before sending funds.
- 04
Watch for mailbox rules
Intruders often create a hidden rule that forwards or hides messages. Monitoring that flags new forwarding rules and unusual sign-ins catches this early.
- 05
If it happens
Call the sending bank immediately to request a recall, report it to law enforcement, and notify your carrier. Speed matters more than anything else.
What it costs
One plan, in writing.
Managed IT for a law firm is $175 per user, per month with a 5-user minimum. Attorneys and staff each count as a user.
The same single plan every client gets. Microsoft 365 licenses billed separately at Microsoft’s price.
- Unlimited remote help desk (phone & email)
- 24/7 monitoring and alerting
- Patch management
- Microsoft 365 administration and support
- Multi-factor sign-in setup
- Backup monitoring and management
- Advanced security monitoring
- Network & firewall management
- Security awareness training
- Onboarding and same-day offboarding
- Quarterly on-site visits
- Vendor management
Priced in writing before any work starts.
- IT and security assessment with plain-English findings
- Written security policies and an incident response plan
- Help answering client and insurer security questionnaires
- vCIO strategy sessions
- Document system migrations
This page is general information, not legal advice. We put security controls in place and document them; we do not certify anyone or make an organization compliant. Ask your attorney or your regulator what applies to you.
Questions
Law firm IT questions, plainly answered.
Does our firm need a written security policy?
It is strongly worth having. A short written policy shows what the firm decided was reasonable and gives staff something to follow. Cyber insurance applications and larger clients commonly ask for one. We can draft it with you as quoted documentation work.
Is cloud storage acceptable for client files in Alabama?
The Alabama State Bar’s Formal Opinion 2010-02 says a lawyer may use cloud or third-party providers to store client data if the lawyer uses reasonable care, which includes understanding how the provider secures the data. Read the opinion and ask the Bar about your situation.
Do you work with legal practice management software?
Yes. We support the computers, sign-ins and integrations around the practice management and document systems a firm already uses, and handle the vendor calls as part of vendor management.
What should we do when a lawyer or paralegal leaves?
Disable the account that day, forward email to a supervising attorney, change shared passwords, remove firm data from personal devices and keep a dated record. Offboarding with a record is part of managed IT.
How much does IT cost for a small law firm?
$175 per user, per month with a 5-user minimum, covering the help desk, 24/7 monitoring, security, Microsoft 365 administration, backups and quarterly on-site visits. Microsoft 365 licenses are billed separately at Microsoft’s price.
Can you also build the firm’s website?
Yes. A Standard website is $2,495 and a Pro website is $3,995, with Care at $149 a month. A Pro site gives every practice area and every town its own page.
Will using you make the firm compliant with the ethics rules?
No vendor can promise that. The duty belongs to the lawyers. We put safeguards in place, document them and tell you plainly what is still open.
Contact
Request an IT assessment.
A hands-on review of your computers, network, security and backups, quoted up front, with findings in plain English.