New Jersey · New York · Pennsylvania
GBTech.ai

Resources

IT for law firms in New Jersey: ethics rules, security and costs (2026 guide)

What New Jersey's ethics rules and courts expect from a law firm's technology, how to protect trust accounts and eCourts access, what to do after a breach, and what small firms should budget.

By GBTech.ai · Published · Last reviewed

The short answer

New Jersey's ethics rules don't name specific security products. They require reasonable efforts. Since 2016, RPC 1.6(f) has required lawyers to "make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client." RPC 5.3 makes the firm responsible for the outside vendors it uses, including cloud services.

In practice, a small New Jersey firm should have:

  • multi-factor authentication (MFA) on email, practice software, banking and remote access
  • endpoint detection and response (EDR) on every computer, with someone watching the alerts
  • encrypted backups that you test
  • written confidentiality terms with every vendor that holds client information
  • a phone call to a known number before any wire goes out
  • a written plan for what to do after a breach

Two things make this more pressing now:

  • If the Judiciary thinks your firm's email has been compromised, it can quarantine your email and suspend your eCourts access until you certify that the problem is fixed.
  • New Jersey lawyers will need one CLE credit in technology-related subjects in each two-year cycle, starting with the cycle that ends December 31, 2027.

This guide is general information, not legal or ethics advice.

What New Jersey's rules require

Confidentiality: RPC 1.6(f)

  • The official comment says the duty covers electronically stored information.
  • Unauthorized access isn't a violation if your efforts to prevent it were reasonable.
  • What's reasonable depends on factors such as how sensitive the information is, how likely a disclosure is without more safeguards, and the cost and difficulty of adding them.

Vendors and cloud services: RPC 5.3 and Opinion 701

  • RPC 5.3 requires every firm to "adopt and maintain reasonable efforts" so that the conduct of nonlawyers, including outside vendors, is compatible with the lawyer's obligations. Its 2016 comment specifically covers "using an Internet-based service to store client information," and points to the vendor's reputation, contract terms that protect client information, and the vendor's jurisdiction.
  • Opinion 701 (2006) of the Advisory Committee on Professional Ethics allows electronic storage of client files with "reasonable care." For outside providers, it looks for two things: an enforceable obligation to keep the information confidential and secure, and use of available technology to guard against reasonably foreseeable intrusions.
  • Opinion 734 (2018) applies the same approach to e-filing vendors, including protecting the lawyer's login credentials.

In practice: keep a list of every vendor that touches client information, such as email, document storage, practice management, billing, IT support, e-filing and AI tools. Make sure each contract includes confidentiality and security terms.

Technology competence and the new CLE credit

New Jersey's RPC 1.1 is worded differently from the ABA's model rule, and New Jersey has no equivalent of the ABA comment on technology competence. In 2025 the Supreme Court declined to adopt one and chose a CLE requirement instead:

  • One of the 24 credits in each two-year cycle must be in "technology-related subjects."
  • Reporting starts with the cycle that ends December 31, 2027. Lawyers in the cycle that ends December 31, 2026 don't have to report it.
  • Topics that count include AI, cybersecurity, privacy, data breach prevention and response, and oversight of outside vendors.

AI tools

The New Jersey Supreme Court's preliminary guidelines on AI (January 2024) say:

  • The Rules of Professional Conduct don't change because a lawyer uses AI.
  • Lawyers must "check and verify all information generated by AI."
  • "A lawyer is responsible to ensure the security of an AI system before entering any non-public client information."
  • Supervision duties extend to AI use by lawyers and staff.

A March 2026 notice encourages firms to adopt an AI policy and update it regularly, and includes a starter template. The template covers vetting AI vendors, human review of AI output, checking citations, and turning off data-sharing settings, including in AI features built into everyday software. The notice also says a policy "is not a 'safe harbor.'"

Remote and virtual offices

Court Rule 1:21-1(a) doesn't require a fixed office. You must still be promptly reachable, and you must designate a physical location where your files and financial records can be inspected on short notice.

eCourts, and what happens if your email is hacked

Electronic filing. Attorneys must file through eCourts where it's available and through JEDS for other trial-court matters. The court rules also make filers responsible for removing any metadata they don't want made public (R. 1:32-2A(d)).

Compromised accounts. Under Directive #11-23 (June 2023):

  • When the Judiciary detects that a user's account may be compromised, it blocks incoming email from that user and temporarily disables their accounts, including eCourts access.
  • If an entire office or firm may be compromised, it may suspend all accounts at that firm.
  • If you discover an incident first, call the Superior Court Clerk's Office at (609) 421-6100. Don't email, because the message could carry malware.

Getting access back. The attorney files a certification, form CN 13263 (published February 2025). Among other things, it confirms that:

  • passwords for affected accounts were reset, using a different device than the ones normally used
  • malicious software, unauthorized access points and compromised credentials were removed, and vulnerabilities were patched
  • MFA is mandatory on all affected accounts "and any other accounts associated with my practice"
  • a full scan of affected devices was completed. The form's example of a problem to look for is a mail rule that was quietly redirecting incoming email to another account.
  • "advanced threat detection software and 24/7 monitoring" has been put in place

Put another way, the controls the court asks for after an incident are the same ones that help prevent one. If you already have MFA, EDR with round-the-clock monitoring and an IT provider who can document your setup, recovery is faster.

Wire fraud and trust accounts

The threat.

  • In the FBI's Internet Crime Report for 2025, business email compromise caused about $3.05 billion in reported losses, and wire or ACH transfers were the payment method in 86% of those reports.
  • Among ransomware complaints outside critical infrastructure, legal services was the most-reported industry (18%).
  • New Jersey ranked fifth among states in reported losses, at about $660 million.
  • In May 2025, the FBI issued an alert about a ransomware group targeting law firms.
  • In March 2025, New Jersey's cybersecurity agency, the NJCCIC, warned that "threat actors targeted numerous New Jersey title agencies and real estate attorneys."

The rules. Under Court Rule 1:21-6(c)(1), every electronic transfer out of a trust account needs signed written instructions from the attorney and a confirmation from the bank, and only attorneys admitted in New Jersey may authorize transfers. Don't count on the Lawyers' Fund for Client Protection to cover a wire fraud loss, either. It covers a lawyer's dishonest conduct, not negligence or carelessness.

What to do.

  1. Never act on changed wiring instructions received by email. Call a phone number you already have, not one in the email. The NJCCIC recommends verifying by phone with independently obtained numbers.
  2. Tell clients at the start of every matter that you will never change wiring instructions by email.
  3. Use app-based or hardware-key MFA on email and online banking, as the NJCCIC recommends. Turn on bank alerts for outgoing transfers.
  4. Set email to alert you when someone creates a forwarding rule, and block automatic forwarding to outside addresses.
  5. If money goes out to the wrong account, call your bank immediately and report it to the FBI's IC3 and the NJCCIC. The NJCCIC notes that funds are hard to recover after about 48 hours.

After a breach: what New Jersey law requires

New Jersey's data breach law (N.J.S.A. 56:8-161 to -166) applies when "personal information" is exposed. That means a name together with a Social Security number, a driver's license or state ID number, an account or card number with the code needed to use it, or a username or email address with its password or security question. Encrypted data is excluded.

  • Report the breach to the Division of State Police before notifying the people affected.
  • Notify affected New Jersey residents "in the most expedient time possible and without unreasonable delay."
  • If more than 1,000 people are notified, also notify the nationwide consumer reporting agencies.
  • If you conclude that misuse of the information is "not reasonably possible," document that decision and keep it for five years.

Separately, ABA Formal Opinion 483 (2018) says lawyers must notify current clients of a breach involving material client information. Call your cyber insurer's breach hotline early too. See our cyber insurance checklist for what insurers expect.

The New Jersey Data Privacy Act (effective January 15, 2025) is a different law. It applies to businesses that process the personal data of 100,000 or more New Jersey consumers, or of 25,000 or more if they earn revenue or discounts from selling personal data. People acting in a commercial or employment context don't count as consumers. A small firm that doesn't sell personal data may fall below those thresholds, but the breach notification law applies regardless of size.

Records and retention

  • Trust and business account records: keep them "for a period of seven years after the event that they record" (R. 1:21-6). Electronic bookkeeping is allowed if printouts and files in industry-standard formats can be produced on demand.
  • Closed client files: keep them seven years, unless the client agrees otherwise (ACPE Opinion 692). Original documents that belong to the client, such as wills, may need to be kept longer. When you destroy files, protect confidentiality. As the opinion puts it, "simply placing the files in the trash would not suffice."

Your backup and retention settings in Microsoft 365 and your document system should match these periods, so records aren't deleted too early or kept with no plan.

Where small firms stand

From the ABA's 2023 Cybersecurity TechReport, the latest with these figures:

  • 29% of firms said they had experienced a security breach.
  • 40% had cyber insurance (37% of firms with 2 to 9 lawyers).
  • Only 19% of solo practices and firms with 2 to 9 lawyers had an incident response plan.

From the ABA's 2024 Solo and Small Firm TechReport, 21% of firms with 2 to 9 lawyers had no technology policies, and 31% relied on outside consultants for data security.

A practical checklist

  1. MFA on every account: email, practice management, document management, billing, banking and remote access. Prefer an authenticator app or hardware key.
  2. EDR on every computer and server, with alerts monitored around the clock.
  3. Email security: inbound filtering, SPF, DKIM and DMARC for your domain, alerts for new forwarding rules, and no automatic forwarding outside the firm.
  4. Backups that are encrypted, kept offline or immutable, and restore-tested on a schedule.
  5. Patching on a regular schedule, faster for firewalls and remote access tools.
  6. Encrypted laptops and phones that you can wipe remotely.
  7. Separate admin accounts that aren't used for everyday email.
  8. A vendor list with confidentiality and security terms in each contract.
  9. A written wire-verification procedure that everyone follows.
  10. A written AI policy. The court's March 2026 template is a starting point.
  11. An incident response plan with the phone numbers you'll need: your insurer's breach hotline, the Superior Court Clerk's Office and your IT provider.
  12. Security training when people join and at least once a year.

Our cyber insurance checklist explains each control in more detail.

What it costs

Prices published by managed IT providers in New Jersey, New York City and the Philadelphia area mostly fall between about $100 and $250 per user per month for fully managed IT. Compliance-focused plans cost more. For a 10-person firm, that's roughly $1,000 to $2,500 a month. See our managed IT pricing guide for what each price level includes and which fees to ask about.

Questions to ask an IT provider

  • Will you sign an agreement that obligates you to keep client information confidential and secure?
  • Who on your team can access our systems, and is that access protected with MFA and logged?
  • Where is our data stored and backed up, and how often do you test restores?
  • Who watches EDR alerts after hours?
  • If our email were compromised, could you document the fixes the court's certification form asks for?
  • Will our firm own all admin accounts and documentation if we leave?

How GBTech can help

GBTech's managed IT starts at $95 per user per month. It covers endpoint security, backups, Microsoft 365 hardening with Conditional Access and MFA, patching and a help desk. If your firm already has an IT person, our co-managed service adds those tools around them.

We also resell security services such as Cloudflare and Red Access, and we compare phone systems and internet service so you don't have to deal with each vendor yourself.

See what our managed IT covers or talk to an advisor.

Frequently asked questions

Do New Jersey's ethics rules require specific security tools?

No. RPC 1.6(f) requires "reasonable efforts," judged by factors such as how sensitive the information is, how likely a disclosure is and the cost of safeguards. The court's breach certification form (CN 13263) shows what the Judiciary expects after an incident: MFA on all practice accounts, scans and patching, and threat detection with 24/7 monitoring.

Can a New Jersey law firm keep client files in the cloud?

Yes, with reasonable care. ACPE Opinion 701 allows electronic storage and outside providers, provided the provider has an enforceable obligation to keep the information confidential and uses available technology against foreseeable intrusions. The comment to RPC 5.3 covers internet-based storage specifically.

When does the technology CLE requirement start?

One of the 24 credits in each two-year cycle must be in technology-related subjects, starting with the reporting cycle that ends December 31, 2027. Lawyers in the cycle that ends December 31, 2026 don't need to report it.

Can we use ChatGPT or other AI tools with client information?

Only with care. The New Jersey Supreme Court's guidelines say a lawyer must ensure an AI system is secure before entering non-public client information, and must check and verify AI output. Use business versions with data-sharing settings turned off, and put your rules in a written AI policy.

What should we do if our email is hacked?

  • Call the Superior Court Clerk's Office at (609) 421-6100. Don't report it by email.
  • Expect the Judiciary to quarantine your email and suspend eCourts access, possibly for the whole firm, until you file form CN 13263.
  • If personal information was exposed, New Jersey law requires reporting to the Division of State Police before notifying the people affected. ABA Formal Opinion 483 also calls for notifying affected clients.
  • Call your cyber insurer's breach hotline.

How long do we have to keep client files and trust account records?

Trust and business account records: seven years after the event they record (R. 1:21-6). Closed client files: seven years, unless the client agrees otherwise (ACPE Opinion 692). Original client documents such as wills may need to be kept longer.

Does the New Jersey Data Privacy Act apply to a small law firm?

It applies to businesses that process the personal data of 100,000 or more New Jersey consumers, or of 25,000 or more if they earn revenue or discounts from selling personal data. A small firm that doesn't sell personal data may fall below those thresholds. The data breach law applies regardless of size.

Does our firm need a physical office?

No fixed office is required (R. 1:21-1(a)). You must be promptly reachable, and you must designate a physical location where files and financial records can be inspected on short notice.

Sources

New Jersey courts and rules:

New Jersey ethics opinions (Advisory Committee on Professional Ethics, Rutgers Law Library copies):

New Jersey laws and agencies:

National:

Questions about your setup? Talk to an advisor.

Talk to an advisorSee what our managed IT covers →