Skip to main content
Based in New Jersey · Nationwide and international
GBTech.ai
Book

Resources

IT for law firms: ethics rules, security and costs (2026 guide)

Plain-English guide to law firm IT under the ABA Model Rules: MFA, EDR, vendor contracts, wire fraud controls, AI policies, breach notice and IT costs.

By GBTech.ai · Published · Last reviewed

The short answer

Legal ethics rules don't name specific security products. They require reasonable efforts. The ABA Model Rules of Professional Conduct serve as the model for the ethics rules in most U.S. jurisdictions. Model Rule 1.6(c) says a lawyer "shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client." Model Rule 5.3 and its comments require reasonable efforts to make sure outside vendors, including cloud services, work in a way that fits the lawyer's professional obligations.

In practice, a small law firm should have:

  • multi-factor authentication (MFA) on email, practice software, banking and remote access
  • endpoint detection and response (EDR) on every computer, with someone watching the alerts
  • encrypted backups that you test
  • written confidentiality terms with every vendor that holds client information
  • a phone call to a known number before any wire goes out
  • a written plan for what to do after a breach

Three things make this more pressing now:

  • In the FBI's Internet Crime Report for 2025, legal services was the most-reported industry among ransomware complaints from businesses outside critical infrastructure.
  • In 2025 the federal courts started rolling out MFA for CM/ECF and said everyone with CM/ECF-level access, including filers, would need it by the end of the year.
  • ABA Formal Opinion 512 (2024) says firms must set clear policies on generative AI, and that the client's informed consent is required before client information goes into a "self-learning" AI tool.

Each state adopts its own version of the rules, so check your state bar's rules and ethics opinions too. This guide is general information, not legal or ethics advice.

What the ethics rules require

The ABA Model Rules are a template. The ABA's own ethics opinions note that the rules, court rules and opinions of each jurisdiction are controlling. Use the national guidance below as a starting point, then confirm it against your state's version.

Confidentiality: Model Rule 1.6(c)

  • Comment 18 says a lawyer must act competently to protect client information from outside access and from accidental disclosure by people working on the matter.
  • Unauthorized access isn't a violation if your efforts to prevent it were reasonable.
  • What's reasonable depends on factors such as how sensitive the information is, how likely a disclosure is without more safeguards, the cost and difficulty of adding them, and whether they make it too hard to serve clients.
  • A client can ask for more security than the rule requires.

ABA Formal Opinion 477R (2017) says lawyers may generally send client information over the internet if they have made reasonable efforts to prevent unauthorized access. Special precautions may be needed when a client agreement or the law requires them, or when the information is highly sensitive. The opinion's practical steps include knowing where client information is stored and how it moves, using reasonable security measures, labeling confidential information, training lawyers and staff, and checking out technology vendors.

Vendors and cloud services: Model Rule 5.3

  • Rule 5.3 requires partners and managers to make reasonable efforts so the firm has measures in place giving "reasonable assurance" that nonlawyers' conduct fits the lawyer's professional obligations.
  • Comment 3 names "using an Internet-based service to store client information" as one example of an outside service. It points to the vendor's education, experience and reputation, the nature of the services, the terms that protect client information, and the legal and ethical environment where the services are performed.

In practice: keep a list of every vendor that touches client information, such as email, document storage, practice management, billing, IT support, e-filing and AI tools. Make sure each contract includes confidentiality and security terms.

Technology competence: Model Rule 1.1, comment 8

Comment 8, updated in 2012 to address technology, says a lawyer should keep up with changes in the law and its practice, "including the benefits and risks associated with relevant technology." It also says lawyers should comply with all continuing legal education (CLE) requirements that apply to them.

Some states now require CLE in technology topics. For example, New York requires experienced attorneys to complete at least one credit in cybersecurity, privacy and data protection in each two-year cycle. Check your state's CLE rules.

AI tools: ABA Formal Opinion 512

ABA Formal Opinion 512 (July 2024) covers generative AI. It says:

  • Relying on AI output without an appropriate degree of independent verification or review could violate the duty of competence.
  • Because many self-learning AI tools could reveal what you type into them, the client's informed consent is required before entering client information into such a tool. General boilerplate in an engagement letter is not enough.
  • Lawyers should read and understand the terms of use and privacy policy of any AI tool they use, or rely on an expert who has. They may need IT or security professionals to help.
  • Managers must set clear policies on how the firm may use AI, and staff must be trained.
  • Before filing anything with a court, lawyers must review AI output, including citations. Some courts require lawyers to disclose AI use, so check each court's rules and standing orders.

Remote and virtual offices: ABA Formal Opinion 498

ABA Formal Opinion 498 (March 2021) says there is no requirement in the Model Rules that a lawyer have a brick-and-mortar office. Virtual practice still has to meet the duties of competence, diligence, communication, confidentiality and supervision. The opinion also says:

  • Unless the technology is helping your practice, turn off the listening feature of smart speakers and virtual assistants while you discuss client matters.
  • Even a virtual firm needs a plan for paper mail, must still be able to handle trust account transactions and records, and must be able to file and receive court documents.

Your state may have its own office rules, so check yours.

Court e-filing, and what happens if your email is hacked

E-filing rules. Each court system sets its own e-filing rules. Check the rules for every court you file in, including who may use a login and what must be redacted. Strip metadata you don't want made public before you file.

Federal courts. The federal judiciary began rolling out MFA for PACER and CM/ECF in May 2025. It said users with filing and other CM/ECF-level access must enroll, and that everyone with CM/ECF-level access would need MFA by the end of 2025. If several people at your firm share one PACER account, plan who will enroll an authenticator. A shared account can have up to ten authentication apps enrolled.

Compromised accounts. ABA Formal Opinion 483 (2018) says lawyers must make reasonable efforts to monitor their technology for breaches. After a breach, a lawyer must act promptly to stop it, make reasonable efforts to restore systems, and work out what happened. A sound recovery usually includes:

  • resetting passwords for affected accounts, using a device that wasn't compromised
  • removing malicious software, unknown access and any mail rule quietly forwarding email to an outside account
  • turning on MFA for every account tied to your practice, not just the affected ones
  • scanning and patching every affected device
  • putting threat detection with round-the-clock monitoring in place
  • resetting e-filing and court portal passwords, and following each court's rules for reporting a compromised account

Put another way, the controls that help you recover from an incident are the same ones that help prevent one. If you already have MFA, EDR with round-the-clock monitoring and an IT provider who can document your setup, recovery is faster.

Wire fraud and trust accounts

The threat.

  • In the FBI's Internet Crime Report for 2025, business email compromise caused about $3.05 billion in reported losses, and wire or ACH transfers were the payment method in 86% of those reports.
  • The FBI received more than 1,400 ransomware complaints from businesses outside critical infrastructure. Legal services was the most-reported industry (18%).
  • In May 2025, the FBI warned that a group called Silent Ransom Group had consistently targeted U.S. law firms since spring 2023. It uses fake IT support calls. As of April 2025, it had also started sending someone in person, posing as IT support, to plug a storage device into a computer.
  • In one 2025 case in the FBI's report, homebuyers wired more than $449,000 after an email impersonating their attorneys. After a complaint to the FBI's Internet Crime Complaint Center (IC3), the receiving bank confirmed the full amount was still in the account and on hold.

The rules. Trust account rules are set by each state. The ABA's Model Rules on Client Trust Account Records are a common reference point:

  • Only a lawyer admitted in the jurisdiction, or a person under that lawyer's direct supervision, may authorize transfers from a client trust account.
  • Withdrawals may be made only by check to a named payee, not to cash, or by authorized electronic transfer.
  • For every electronic transfer, keep a record of who authorized it, the date, the recipient and the bank's confirmation.

Check your state's version. Don't assume your state's client protection fund will cover a wire fraud loss, either. Read its rules before you need them.

What to do.

  1. Never act on changed wiring instructions received by email. Call a phone number you already have, not one in the email. The FBI recommends using a secondary channel to verify any request to change account information.
  2. Tell clients at the start of every matter that you will never change wiring instructions by email.
  3. Use MFA on email and online banking. CISA calls phishing-resistant MFA, such as FIDO security keys, the "gold standard," and says text-message codes should be a last resort. Turn on bank alerts for outgoing transfers.
  4. Set email to alert you when someone creates a forwarding rule, and block automatic forwarding to outside addresses.
  5. If money goes out to the wrong account, the FBI says time is of the essence. Call your bank immediately and ask it to recall the funds. Then file a complaint at ic3.gov, whatever the amount. In 2025, the IC3's Recovery Asset Team helped freeze about $679 million of roughly $1.16 billion in attempted theft reported through this process.
  6. Train staff on how your real IT provider will identify itself, and check the identity of anyone who shows up to work on firm computers. The FBI recommends both for law firms.

After a breach: notification duties

State breach laws. According to the FTC, all states, the District of Columbia, Puerto Rico and the Virgin Islands have laws requiring notification of security breaches involving personal information. Each law sets its own definition of personal information, deadlines and who must be told. If the affected people live in several states, check each of those states' laws.

Ethics duties. ABA Formal Opinion 483 says that under Model Rule 1.4, lawyers must notify current clients when a breach involves, or has a substantial likelihood of involving, material client information. The notice should give enough detail for clients to make informed decisions. The opinion does not require notice to former clients as a matter of ethics, but data privacy laws or contracts may still require it. It also says that complying with breach notification laws does not necessarily satisfy ethics duties, and the reverse is also true. Analyze each separately.

Call your cyber insurer's breach hotline early too. See our cyber insurance checklist for what insurers expect.

Firms outside the U.S. Rules differ by country, so check with your regulator. In the European Union, the GDPR requires notifying the data protection authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to put people at risk. When the risk to people is high, they must be told without undue delay. The GDPR can also apply to a firm outside the EU that offers services to people in the EU.

Records and retention

  • Trust account records: ABA Model Rule 1.15 calls for keeping complete records of trust funds and other client property for five years after the representation ends. Your state may set a different period. The ABA's model trust account records rules accept electronic equivalents of bank statements, check registers and canceled checks.
  • Closed client files: check your state bar's rules and ethics opinions on how long to keep them and how to destroy them securely. Original documents that belong to the client, such as wills, may need special handling.
  • Keep less: ABA Formal Opinion 483 says lawyers should follow a document retention policy and look for ways to limit how much confidential or personal information they keep during and after a matter.

Your backup and retention settings in Microsoft 365 and your document system should match these periods, so records aren't deleted too early or kept with no plan.

Where small firms stand

From the ABA's 2023 Cybersecurity TechReport, the latest with these figures:

  • 29% of firms said they had experienced a security breach.
  • 40% had cyber insurance (37% of firms with 2 to 9 lawyers).
  • Only 19% of solo practices and firms with 2 to 9 lawyers had an incident response plan.

From the ABA's 2024 Solo and Small Firm TechReport, 21% of firms with 2 to 9 lawyers had no technology policies, and 31% relied on outside consultants for data security.

A practical checklist

  1. MFA on every account: email, practice management, document management, billing, banking, court e-filing and remote access. Prefer an authenticator app or hardware key.
  2. EDR on every computer and server, with alerts monitored around the clock.
  3. Email security: inbound filtering, SPF, DKIM and DMARC for your domain, alerts for new forwarding rules, and no automatic forwarding outside the firm.
  4. Backups that are encrypted, kept offline or immutable, and restore-tested on a schedule.
  5. Patching on a regular schedule, faster for firewalls and remote access tools.
  6. Encrypted laptops and phones that you can wipe remotely.
  7. Separate admin accounts that aren't used for everyday email.
  8. A vendor list with confidentiality and security terms in each contract.
  9. A written wire-verification procedure that everyone follows.
  10. A written AI policy. ABA Formal Opinion 512 is a good starting point.
  11. An incident response plan with the phone numbers you'll need: your insurer's breach hotline, your bank's fraud line, your IT provider and the clerk's office for each court you file in. ABA Formal Opinion 483 says lawyers should consider preparing one before a breach happens.
  12. Security training when people join and at least once a year, including how your IT provider will identify itself.

Our cyber insurance checklist explains each control in more detail.

What it costs

Ask each IT provider for a price per user per month, and ask exactly what it includes: EDR monitoring, backups and restore tests, Microsoft 365 security settings, after-hours support, and help with insurer and client security questionnaires. See our managed IT pricing guide for what each price level includes and which fees to ask about.

Questions to ask an IT provider

  • Will you sign an agreement that obligates you to keep client information confidential and secure?
  • Who on your team can access our systems, and is that access protected with MFA and logged?
  • Where is our data stored and backed up, and how often do you test restores?
  • Who watches EDR alerts after hours?
  • If our email were compromised, could you document what was found and fixed for our insurer, our clients and any court that asks?
  • Will our firm own all admin accounts and documentation if we leave?

How GBTech can help

GBTech's managed IT starts at $95 per user per month. It covers endpoint security, backups, Microsoft 365 hardening with Conditional Access and MFA, patching and a help desk. If your firm already has an IT person, our co-managed service adds those tools around them. We work with law firms across the U.S. and internationally.

We also resell security services such as Cloudflare and Red Access, and we compare phone systems and internet service so you don't have to deal with each vendor yourself.

See what our managed IT covers or talk to an advisor.

Frequently asked questions

Do legal ethics rules require specific security tools?

No. ABA Model Rule 1.6(c) requires "reasonable efforts," judged by factors such as how sensitive the information is, how likely a disclosure is and the cost of safeguards. ABA Formal Opinion 477R adds that highly sensitive information may call for extra precautions. Your state's version of the rules is the one that applies, so check with your state bar.

Can a law firm keep client files in the cloud?

Yes, with reasonable care. The comment to ABA Model Rule 5.3 names "using an Internet-based service to store client information" as an example of an outside service. The lawyer must make reasonable efforts to ensure the service is provided in a way that fits the lawyer's professional obligations. The terms that protect client information are one of the factors. Check your state bar's ethics opinions too.

Do lawyers need technology CLE?

It depends on your state. Comment 8 to ABA Model Rule 1.1 says lawyers should keep up with the benefits and risks of relevant technology. Some states also require specific credits. New York, for example, requires at least one credit in cybersecurity, privacy and data protection in each two-year cycle.

Can we use ChatGPT or other AI tools with client information?

Only with care. ABA Formal Opinion 512 says a client's informed consent is required before entering client information into a self-learning AI tool, and boilerplate in an engagement letter isn't enough. Lawyers must also review AI output, and they should read and understand the tool's terms of use. Use business versions with data-sharing settings turned off, and put your rules in a written AI policy.

What should we do if our email is hacked?

  • Call your IT provider and your cyber insurer's breach hotline.
  • Stop the intrusion, restore your systems and find out what happened, as ABA Formal Opinion 483 describes.
  • Reset e-filing and court portal passwords, and follow each court's rules for reporting a compromised account.
  • If personal information was exposed, check the breach notification laws of every state where the affected people live. Under Opinion 483, notify current clients if material client information was involved.
  • If money was sent, call your bank right away and file a complaint at ic3.gov.

How long do we have to keep client files and trust account records?

ABA Model Rule 1.15 calls for keeping trust account records for five years after the representation ends, but your state's rule controls and may differ. For closed client files, follow your state bar's rules and ethics opinions. Original client documents such as wills may need special handling.

Does European privacy law apply to a U.S. law firm?

It can. The GDPR can apply to a business outside the EU that offers services to people in the EU. It requires notifying the data protection authority of a personal data breach without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to put people at risk.

Does our firm need a physical office?

Not under the ABA Model Rules. ABA Formal Opinion 498 says there is no requirement in the Model Rules that a lawyer have a brick-and-mortar office. You still need a plan for mail, trust accounting and receiving court documents, and your state may have its own rules.

Sources

ABA rules and ethics opinions:

Courts:

Federal agencies:

Outside the U.S.:

Surveys:

Questions about your setup? Talk to an advisor.

Talk to an advisorSee what our managed IT covers →