Cybersecurity Mistakes Chicago Law Firms Make and How Managed IT Prevents Them

A Michigan Avenue law firm discovered unauthorized access to their document management system on a Tuesday morning in September. By Wednesday afternoon, they were notifying 312 clients that confidential legal communications, case strategies, and privileged information had potentially been compromised.

The breach didn’t result from sophisticated hacking. An associate’s laptop containing cached credentials to the firm’s document system was stolen from their car during a lunch meeting in River North. The laptop wasn’t encrypted. The document system didn’t require multi-factor authentication. Remote access remained enabled for the stolen device for three days before anyone noticed.

The direct costs exceeded $180,000 in forensic analysis, client notification, and mandatory reporting to the Illinois Attorney Registration and Disciplinary Commission. But the real damage came from malpractice claims filed by two clients whose privileged case strategies were exposed to opposing counsel. Those claims ultimately cost the firm $1.2 million in settlements and increased malpractice insurance premiums.

The entire incident was preventable. Not through expensive enterprise security systems, but through basic IT security practices that managed IT services provide routinely.

For law firms in Chicago, cybersecurity isn’t just about protecting data, it’s about fulfilling ethical obligations to clients, avoiding malpractice exposure, and maintaining the confidentiality that forms the foundation of attorney-client relationships. Yet many firms make the same preventable mistakes that create unnecessary risk.

Why Law Firms Are High-Value Targets for Cyber Attacks

Legal practices hold information that’s immediately valuable to criminals, competitors, and adversaries in litigation.

Here’s what attackers see when they target law firms:

• Privileged communications between attorneys and clients contain case strategies, settlement positions, financial information, and confidential business details. This information has direct value to opposing parties in litigation or business negotiations.
• Intellectual property and trade secrets flow through law firms representing clients in technology, manufacturing, and competitive industries. Corporate espionage attacks target law firms specifically to access client intellectual property that would be difficult to obtain directly.
• Personal identifying information for high-net-worth individuals makes law firms attractive to identity thieves. Estate planning practices, family law firms, and real estate attorneys maintain social security numbers, financial account information, and sensitive personal details.
• Trust account information and client funds create immediate financial theft opportunities. Business email compromise attacks targeting law firms often focus on misdirecting wire transfers or intercepting client payments.
• Merger and acquisition details provide insider trading opportunities. Law firms working on M&A transactions hold non-public information that has significant financial value before deals become public.
• Litigation strategies and witness information give opposing counsel unfair advantages. Breaches that expose case strategies, witness testimony plans, or settlement authority create ethical complications and potential malpractice liability.

The American Bar Association’s 2024 Legal Technology Survey found that 29% of law firms experienced a security breach up from 25% the previous year. More concerning, 21% of firms weren’t sure whether they’d been breached, suggesting many incidents go undetected.

Chicago’s concentration of law firms from major international practices to boutique litigation shops and solo practitioners creates a target-rich environment. The city’s legal district contains hundreds of firms managing billions in client matters, each representing potential value to sophisticated attackers.

Mistake #1: Treating IT Security as an Expense Instead of Risk Management

The most fundamental mistake law firms make happens before any technical decisions: viewing cybersecurity spending as a cost center rather than malpractice prevention.

Here’s how this mistake manifests:

• Delayed security investments happen when firms postpone necessary security improvements because budgets are tight or other priorities seem more immediate. A West Loop litigation firm delayed implementing multi-factor authentication for 18 months despite their IT provider’s recommendations. During those 18 months, a compromised partner’s credentials gave attackers access to case files for three active matters. The firm settled malpractice claims for $400,000 more than 20 years of the multi-factor authentication cost they’d delayed.
• Inadequate IT budgets that don’t reflect the value of data being protected. Firms comfortable spending $50,000 annually on malpractice insurance sometimes resist spending $15,000 on managed IT services that prevent the incidents triggering malpractice claims.
• Reactive rather than proactive approach means addressing security only after problems occur. Firms wait until after a breach to implement proper controls, when prevention would have cost a fraction of response expenses.
• Failure to calculate true breach costs leads to underestimating security value. Direct breach response costs represent only part of total exposure. Add malpractice claims, ARDC reporting obligations, client notification requirements, reputation damage, and lost client relationships actual breach costs often exceed 50-100x annual preventive security spending.

The Illinois Rules of Professional Conduct specifically require attorneys to make reasonable efforts to prevent unauthorized access to client information. This isn’t optional, it’s an ethical obligation. Yet many firms treat security as discretionary IT spending rather than mandatory risk management.

Managed IT services transform this equation. Instead of unpredictable security incidents requiring emergency response spending, firms pay predictable monthly fees for comprehensive protection. The cost comparison is clear: $1,500-3,000 monthly for managed IT versus $150,000-500,000+ for breach response and potential malpractice claims.

A 15-attorney family law firm in Lincoln Park analyzed their options after learning about a competitor’s breach. They could continue spending $800 monthly on basic IT support that provided no proactive security monitoring, or invest $2,400 monthly in comprehensive managed IT with active threat detection, security monitoring, and compliance support.

The partners viewed the additional $1,600 monthly as inexpensive malpractice insurance. Within six months, their managed IT provider detected and blocked a business email compromise attempt targeting their trust account. That single prevented incident would have cost the firm tens of thousands in stolen funds and regulatory complications paying for years of managed IT protection.

Mistake #2: Using Consumer-Grade Tools for Professional Legal Work

Law firms routinely handle documents requiring the highest confidentiality standards, yet many use the same file sharing and communication tools as consumers managing personal photos and casual emails.

Common scenarios that create risk:

• Personal email accounts for client communication. Associates forwarding documents to their Gmail accounts to work from home. Partners using personal email to send files too large for the firm’s system. Each use creates unprotected copies of privileged information outside firm control.
• Consumer cloud storage for case files. Attorneys sharing discovery documents through personal Dropbox accounts. Paralegals storing client files in Google Drive because it’s easier than the firm’s official document management system. These platforms lack the security controls, audit trails, and retention policies legal practice requires.
• Text messaging for substantive legal communications. Unencrypted SMS messages discussing case strategy, sharing confidential details, or coordinating with clients. These messages receive no legal hold protection, create no searchable record for discovery obligations, and offer no security against interception.
• Shared passwords for firm accounts. Multiple attorneys using the same login for the firm’s practice management system. Staff sharing a generic account for document assembly software. When everyone uses the same credentials, you can’t audit who accessed what information or revoke access when someone leaves.
• Unmanaged personal devices accessing firm data. Attorneys working from personal laptops without security controls. Staff using personal tablets to access client information. These devices may lack encryption, current security updates, or even basic antivirus protection yet they connect directly to your most sensitive data.

One Chicago personal injury firm experienced this exact problem. An attorney forwarded settlement documents to her personal email to review over the weekend. Her personal email account was later compromised through credential stuffing attackers tried username/password combinations from other data breaches. The compromised account gave attackers access to the confidential settlement documents, which included medical records and detailed financial information for the client.

The firm had to notify the client, report the incident to their malpractice carrier, and document the breach to ARDC. The attorney faced disciplinary questions about whether forwarding client information to unsecured personal email violated her duty of confidentiality. The firm’s professional liability insurance rates increased 40% at renewal.

Managed IT services solve this through professional-grade infrastructure:

• Microsoft 365 for law firms provides enterprise email, secure document storage, encrypted communication tools, and comprehensive audit logging all designed for professional use with appropriate security controls.
• Secure document management systems specifically built for legal practice, with version control, privilege logging, conflict checking, and retention policy enforcement built in.
• Mobile device management that extends firm security policies to smartphones and tablets, ensuring personal devices accessing firm data meet minimum security standards.
• Conditional access policies that prevent data access from unmanaged devices or untrusted locations, protecting information even when attorneys work remotely.
• Data loss prevention that prevents confidential information from being forwarded to personal accounts, uploaded to consumer cloud storage, or otherwise leaving firm control.

These aren’t expensive enterprise systems anymore. Microsoft 365 Business Premium which includes most of these capabilities costs under $25 per user monthly. The real cost is in proper configuration and ongoing management, which is exactly what managed IT services provide.

Mistake #3: Inadequate Email Security Exposing Privileged Communications

Email remains the primary attack vector for cybercriminals targeting law firms. Yet many firms rely on basic email security that fails to catch sophisticated threats.

Email security gaps create these exposures:

• Phishing attacks impersonating clients or courts. Emails appearing to come from existing clients requesting urgent action on wire transfers. Messages claiming to be from court administrators with links to fake e-filing portals designed to steal credentials. These attacks bypass basic spam filters because they’re carefully crafted to appear legitimate.
• A Loop litigation firm received an email perfectly impersonating their largest client’s general counsel. The email referenced a real pending matter, used correct terminology, and requested an urgent wire transfer for settlement. Only the associate’s decision to call the client directly despite the email saying “no time for calls” prevented $280,000 from being wired to criminals.
• Spoofed emails impersonating firm attorneys. Attackers research firm structure through websites and LinkedIn, then send emails claiming to be partners to trick staff into wiring funds or sharing information. The emails come from domains almost identical to the firm’s legitimate domain CMITLaw.com versus CMlTLaw.com (note the “I” replacing “I”).
• Malicious attachments disguised as legal documents. Files named “Motion_for_Summary_Judgment.pdf” or “Discovery_Response.docx” that actually contain malware. Legal staff are trained to open court documents and client files—attackers exploit this expected behavior.
• Unencrypted email containing confidential information. Standard email transmission provides no encryption. Messages travel across the internet in readable text. Any system between sender and recipient can intercept and read email content. For privileged attorney-client communications, this lack of encryption creates confidentiality risks.
• No email authentication verification. Basic email systems don’t verify sender identity. Attackers easily forge “From” addresses to make emails appear to originate from trusted sources. Without proper email authentication (SPF, DKIM, DMARC), recipients have no way to verify legitimacy.
• Lack of email archiving and retention. Legal holds, e-discovery obligations, and professional responsibility rules require firms to retain email communications. Consumer-grade email without proper archiving can’t satisfy these requirements. When relevant emails are accidentally deleted or can’t be retrieved, firms face sanctions and ethical violations.

Managed IT services provide comprehensive email security:

• Advanced threat protection analyzes email attachments and links in isolated environments before delivery, catching malicious content that bypasses traditional spam filters.
• Impersonation protection detects emails claiming to be from trusted contacts but originating from suspicious sources, flagging potential business email compromise attempts.
• Encryption for confidential communications ensures privileged information remains protected during transmission, with automatic encryption based on content sensitivity or recipient domain.
• Email authentication implementation (SPF/DKIM/DMARC) verifies sender identity and prevents spoofing of your firm’s domain, protecting both incoming and outgoing communications.
• Comprehensive email archiving with legal hold capabilities ensures all communications are retained, searchable, and retrievable for e-discovery or ethical obligation compliance.
• User training and simulated phishing that educates staff about email threats while testing their ability to recognize and report suspicious messages.

A South Loop intellectual property firm implemented comprehensive email security after a close call with a phishing attack. Within the first three months, their advanced threat protection caught and blocked 23 sophisticated phishing attempts that would have bypassed their previous spam filter. One attempt specifically targeted the firm’s finance manager with a spoofed email from the managing partner requesting urgent payment to a “new vendor” a classic business email compromise attack.

Mistake #4: Poor Remote Access Security

The shift to hybrid work created new opportunities for attorneys and staff and new vulnerabilities for law firms without proper remote access security.

Remote work security problems include:

• Unencrypted connections to firm resources. Attorneys accessing case files over public WiFi at coffee shops, airports, or courthouses. Without VPN protection, these connections transmit privileged information in readable form over untrusted networks where interception is trivial.
• Inadequate authentication for remote systems. Document management systems, practice management software, and email accessible with just username and password no second factor required. Compromised credentials (which happen frequently through phishing or password reuse) give attackers complete access to firm data.
• Personal computers accessing firm networks. Home computers used by family members for general internet browsing that also connect to firm systems for legal work. These machines may have outdated security, infected with malware, or lack basic protections yet they access the same confidential information as secured office workstations.
• No remote device visibility or control. When attorneys work from home or while traveling, IT has no way to verify their devices have current security updates, required security software, or appropriate configurations. Problems only surface after security incidents occur.
• Unsecured home networks. Default router passwords, outdated firmware, no network encryption many home networks provide minimal security. When attorneys work from these networks, they’re connecting your firm’s confidential data to inadequately protected infrastructure.

A Chicago employment law firm learned this lesson after an associate’s home computer was compromised. The associate used the same laptop for personal web browsing and accessing firm systems. Malware from a personal activity infected the computer, then spread to the firm’s network when the associate connected via VPN. The malware specifically targeted legal documents, uploading them to an external server before detection.

The firm spent $85,000 on forensic analysis to determine what was accessed, client notification for potentially affected matters, and security remediation. They also faced uncomfortable conversations with clients about how confidential employment discrimination cases and settlement negotiations might have been compromised.

Managed IT services provide secure remote access:

• VPN infrastructure that encrypts all traffic between remote devices and firm networks, protecting data even over untrusted WiFi connections.
• Multi-factor authentication for all remote access, ensuring compromised passwords alone cannot grant access to firm systems.
• Managed endpoints that maintain security regardless of location home, office, or courthouse with centralized security updates, monitoring, and configuration.
• Conditional access policies that verify device security posture before allowing connection, blocking access from non-compliant devices.
• Zero-trust security architecture that assumes no connection is inherently trusted, verifying every access request regardless of source.
• Remote monitoring and support that identifies and resolves security problems on remote devices before they create firm-wide issues.

After the employment law firm’s breach, they implemented comprehensive remote access security through managed IT services. Every attorney and staff member received a properly configured, encrypted, monitored laptop. VPN became mandatory for any remote access. Multi-factor authentication protected all systems. Device compliance checks prevented connections from non-secured devices.

During the first year after implementation, the system blocked 12 connection attempts from devices that failed security compliance checks devices with outdated operating systems, missing security updates, or disabled antivirus protection. Each blocked connection represented a potential security incident prevented before it could impact the firm.

Mistake #5: Neglecting Microsoft 365 Security Configuration

Most Chicago law firms use Microsoft 365 for email, document storage, and collaboration. Few properly secure it.

Microsoft 365 security mistakes include:

• Default security settings that prioritize convenience over protection. Out-of-box Microsoft 365 enables features that improve usability but create security gaps for legal practices. External sharing, guest access, and collaboration features work great for general business—but create confidentiality risks for privileged information.
• No multi-factor authentication enforcement. Microsoft 365 supports MFA but doesn’t require it by default. Firms that skip MFA implementation leave accounts vulnerable to credential compromise, the number one cause of Microsoft 365 breaches.
• Inadequate data loss prevention. Attorneys can download entire case files to personal devices, forward confidential emails to personal accounts, or share privileged documents with unauthorized parties. Without proper DLP policies, Microsoft 365 does nothing to prevent these actions.
• Poor retention policy configuration. Email and documents delete according to users’ choices rather than firm policy or ethical obligations. When relevant communications are needed for e-discovery or client matters, they may be permanently gone.
• No audit logging or monitoring. Firms don’t know who accessed what information, when documents were shared externally, or whether unusual account activity indicates compromise. Microsoft 365 generates comprehensive logs but only if configured properly and actively monitored.
• Inadequate backup. Microsoft 365 isn’t a backup solution. Deleted emails, corrupted files, and ransomware damage can result in permanent data loss. Firms assuming Microsoft protects their data learn otherwise after incidents occur.
• Unmanaged mobile device access. Attorneys access firm email and documents from smartphones and tablets. Without mobile device management, these devices may lack even basic security like PIN protection yet they sync complete mailboxes and store case files.

One Michigan Avenue law firm experienced Microsoft 365 misconfiguration consequences firsthand. An associate’s Microsoft 365 account was compromised through credential stuffing. The attackers spent four days browsing the associate’s email and documents before anyone noticed. During that time, they accessed confidential information for 17 active client matters.

The breach occurred despite the firm having “good” security. They had antivirus, spam filtering, and paid Microsoft 365 subscriptions. What they lacked was proper configuration of Microsoft 365’s security features and active monitoring for suspicious account activity.

Investigation revealed the compromised account showed obvious warning signs: login attempts from Eastern Europe, unusual access times, bulk email downloads, and access to files the associate had never touched. Microsoft 365 logged all these indicators—but nobody monitored the logs. The breach was discovered only when a client received a suspicious email from the compromised account.

Managed IT services properly secure Microsoft 365:

• Security baseline configuration that enables appropriate protections for legal practices while maintaining needed functionality.
• Enforced multi-factor authentication across all accounts, eliminating credential compromise as a viable attack vector.
• Data loss prevention policies that prevent confidential information from being forwarded to personal accounts, shared externally, or leaving firm control.
• Retention policies aligned with professional responsibility rules, litigation holds, and firm document retention requirements.
• Active security monitoring that identifies suspicious account activity, unusual access patterns, and potential compromises in real-time.
• Comprehensive backup using third-party solutions that protect against accidental deletion, ransomware, and Microsoft 365 service issues.
• Mobile device management that secures smartphones and tablets accessing firm data with encryption, PIN requirements, and remote wipe capabilities.
• Conditional access policies that restrict data access based on device compliance, location, and security posture.

A River North business litigation firm implemented proper Microsoft 365 security through managed IT services after learning about a competitor’s breach. Within the first month, their security monitoring caught a compromised account—an attorney’s credentials were being used to access email from an IP address in Russia while the attorney sat in the firm’s office.

The managed IT provider immediately disabled the compromised account, forced password reset, enabled MFA, and conducted forensic analysis to determine what was accessed. Total incident duration: 22 minutes from detection to containment. No client data was stolen because rapid detection and response prevented the attackers from progressing beyond initial access.

Compare that to the four-day undetected breach the Michigan Avenue firm experienced. The difference was active monitoring and proper Microsoft 365 security configuration—exactly what managed IT services provide.

Mistake #6: Inadequate Document Management Security

Document management systems (DMS) hold the crown jewels of law firm data—case files, privileged communications, work product, and client information. Yet many firms inadequately secure these systems.

Document management security problems:

• Overly broad access permissions. Everyone at the firm can access everything in the DMS. Attorneys see files for matters they’re not working on. Staff access confidential information unrelated to their responsibilities. This violates need-to-know principles and creates unnecessary exposure.
• No audit trails for document access. Firms can’t determine who opened which documents, when files were downloaded, or whether documents were shared externally. When questions arise during litigation or after security incidents, this lack of visibility becomes critical.
• Inadequate access controls for departed employees. Former employees’ DMS credentials remain active for days or weeks after departure. During that window, they can download client information, case strategies, and firm intellectual property with no one noticing.
• Poor integration with email systems. Documents are saved to the DMS but then emailed as unprotected attachments. The DMS provides security for stored documents but offers no protection once files leave the system.
• No encryption for sensitive documents. Files containing particularly sensitive information trade secrets, high-profile client matters, confidential negotiations receive the same protection as routine correspondence. No additional security layers protect the most valuable data.
• Failure to implement secure external sharing. Attorneys email documents to clients, co-counsel, and opposing parties sending copies outside firm control. Better approaches exist using secure client portals and controlled document sharing, but many firms default to email attachments.
• Insufficient backup and disaster recovery. DMS backups run infrequently, aren’t tested regularly, or lack offsite protection. When systems fail or ransomware strikes, firms discover their backups are inadequate to restore operations.

A Chicago real estate firm experienced document management failure during a closing. Their DMS crashed due to hardware failure, making transaction documents inaccessible during time-sensitive deal completion. Their backup existed but required 18 hours to restore—longer than the closing window.

The deal fell apart. The client sued for negligence and specific performance issues caused by the firm’s system failure. The firm settled for $175,000 plus lost the client relationship. Proper managed IT with redundant systems and tested disaster recovery would have prevented the entire incident.

Managed IT services provide secure document management:

• Proper access control implementation that grants permissions based on matter involvement and business need, not blanket firm-wide access.
• Comprehensive audit logging that tracks every document access, modification, download, and external share providing complete visibility and compliance documentation.
• Automated access revocation for departed employees, disabling all system access immediately upon termination.
• Email integration that shares documents via secure links rather than unprotected attachments, maintaining control over firm data even after sharing.
• Document encryption for sensitive information, ensuring confidential files remain protected even if storage systems are compromised.
• Secure client portals for document exchange with clients and external parties, eliminating emailed attachments while maintaining professional presentation.
• Robust backup and disaster recovery with frequent backups, regular restoration testing, and rapid recovery capabilities ensuring continuity during failures.
• Cloud-based document management (like NetDocuments or iManage Cloud) that eliminates on-premise hardware failure points while providing enterprise-grade security and accessibility.

A West Loop litigation boutique moved from an aging on-premise DMS to cloud-based document management through their managed IT provider. The transition eliminated hardware maintenance, improved remote access for hybrid work, and added security features their old system lacked. More importantly, they gained confidence that case files remained protected and accessible regardless of circumstances no more worrying about server failures during critical litigation.

Mistake #7: Failing to Train Staff on Security Threats

Technology provides protection, but humans remain the weakest link in cybersecurity. Law firms invest in security tools while neglecting the human element.

Training gaps create vulnerabilities:

• No phishing awareness training. Staff can’t recognize sophisticated phishing attempts because they’ve never seen examples or learned warning signs. Attorneys trained to scrutinize opposing counsel’s arguments fail to apply similar skepticism to suspicious emails.
• Inadequate security policies. Firms lack written policies explaining what staff should and shouldn’t do regarding passwords, email security, document sharing, and remote work. Without clear guidance, everyone creates their own practices—often insecure ones.
• No incident reporting procedures. When something suspicious occurs, staff don’t know who to tell or what constitutes a reportable incident. Minor indicators that could reveal attacks in progress go unreported because nobody established clear incident reporting expectations.
• Passwords practices that undermine security. Staff reuse passwords across personal and professional accounts. Partners write passwords on sticky notes. Associates use simple passwords that are easy to remember and easier to crack. Nobody uses password managers because the firm never introduced them.
• Lack of security culture. Security is viewed as IT’s responsibility rather than everyone’s obligation. Attorneys prioritize convenience over protection. Staff find workarounds for security controls that seem inconvenient. Security becomes an obstacle to avoid rather than a practice to embrace.

The Michigan Avenue firm with the four-day undetected breach? The compromise started with a phishing email. The associate who clicked the link later admitted she didn’t think it seemed suspicious and if she did have questions, she wouldn’t have known who to ask. The firm provided no security awareness training and no clear incident reporting process.

That $85,000 breach resulted from a $0 training investment. Or more accurately, a $0 training investment resulted in an $85,000 breach.

Managed IT services include security training:

• Regular phishing simulation that sends realistic phishing tests to staff, measures who clicks suspicious links, and provides immediate training for those who do.
• Security awareness training covering current threats, proper security practices, and law firm-specific scenarios that attorneys and staff actually encounter.
• Clear security policies in plain language explaining expectations around passwords, email, remote work, document sharing, and data handling.
• Incident reporting procedures that make it easy and non-punitive for staff to report suspicious activity, with clear escalation paths and response expectations.
• Password manager implementation that makes strong, unique passwords practical rather than burdensome, eliminating password reuse as a vulnerability.
• Security culture development that frames protection as everyone’s responsibility and recognizes the ethical obligations attorneys have regarding client data confidentiality.

A family law firm in Lincoln Square implemented regular phishing simulations through their managed IT provider. Initial results were sobering 42% of staff clicked suspicious links in the first simulation. After six months of ongoing testing and training, that number dropped to 4%. More importantly, staff began voluntarily reporting suspicious emails even when they weren’t test simulations.

The firm’s managing partner credited this security awareness training with preventing a business email compromise attack. Their accounting manager received an email appearing to be from the managing partner requesting an urgent payment. Because of recent training, the manager recognized warning signs—unusual urgency, payment request via email, instructions not to call. Instead of processing the payment, she walked to the managing partner’s office to verify. The request was fraudulent.

That single prevented incident worth the $35,000 payment the criminals requested—paid for more than three years of the firm’s managed IT services. And that was just one of multiple threats the training-aware staff identified during the year.

Mistake #8: Inadequate Vendor Management and Third-Party Risk

Law firms increasingly rely on specialized software vendors for practice management, e-discovery, legal research, document automation, and client services. Each vendor relationship creates potential security risk.

Vendor-related security problems:

• No security assessment of vendors before engagement. Firms select vendors based on features and price without evaluating security practices. They assume vendors implement appropriate protections—often incorrectly.
• Inadequate vendor access controls. Third-party providers receive broad access to firm systems without time limitations or scope restrictions. Access continues indefinitely even after specific projects complete.
• Lack of vendor security monitoring. Firms don’t verify vendors maintain stated security practices, update their systems, or respond appropriately to vulnerabilities. The security claims made during sales remain unvalidated during the relationship.
• No vendor breach notification requirements. Contracts don’t mandate timely notification if vendors suffer security incidents. Firms learn about breaches affecting their data only if vendors voluntarily disclose—many don’t.
• Inconsistent security requirements across vendors. Firms implement strong security for their own systems while allowing vendors with poor security to access the same data. The overall security posture is only as strong as the weakest vendor.
• Unmanaged SaaS application sprawl. Individual attorneys subscribe to online services using firm credit cards or personal accounts. IT doesn’t know these applications exist, can’t assess their security, and has no control over the firm data flowing to these unvetted vendors.

A Chicago immigration law firm experienced vendor risk consequences when their document automation vendor suffered a breach. Client information the firm submitted for automated form generation was exposed. The vendor delayed notifying the firm for three weeks during which time the firm continued submitting client data to the compromised system.

The firm faced client notification obligations, ARDC reporting requirements, and difficult conversations about how their vendor selection and management processes allowed the exposure. Their engagement letter with the vendor included no security requirements, no breach notification timelines, and no audit rights.

Managed IT services address vendor risk:

• Vendor security assessment before engagement, evaluating security practices, certifications, and contractual protections to ensure vendors meet minimum security standards.
• Proper vendor access control with time-limited credentials, minimal necessary permissions, and automatic access expiration when projects complete.
• Ongoing vendor security monitoring that tracks vendor security posture, breach notifications, and security incident response capabilities.
• Standardized vendor security requirements included in engagement agreements, with breach notification requirements, audit rights, and security control specifications.
• SaaS application management that provides visibility into all cloud services accessing firm data, with security assessment and approval workflows before use.

Business continuity planning that accounts for vendor failures, with backup providers identified and transition plans prepared for critical services.

A South Loop litigation firm implemented comprehensive vendor management through their managed IT provider. During vendor security review, they discovered their e-discovery vendor used inadequate encryption and stored data in improperly secured cloud storage. The firm required security improvements as a condition of continued engagement. When the vendor couldn’t implement required protections within 90 days, the firm switched to a more secure alternative.

That proactive vendor security management prevented potential data exposure and demonstrated the firm’s reasonable efforts to protect client information a specific ethical requirement under Illinois Rules of Professional Conduct.

The Ethical Obligations: Illinois Rules of Professional Conduct Rule 1.6(c)

Law firm cybersecurity isn’t just best practice—it’s an ethical requirement under Illinois Rules of Professional Conduct.

Rule 1.6(c) states: “A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.”

The key phrase is “reasonable efforts.” What constitutes reasonable effort evolves as technology and threats change.

In 2024, reasonable efforts include:

• Encryption for devices and communications containing confidential client information. Unencrypted laptops, unprotected email, and unsecured mobile devices no longer meet reasonable protection standards.
• Multi-factor authentication for systems accessing client data. Password-only protection isn’t sufficient against modern credential compromise attacks.
• Active security monitoring that detects potential breaches quickly rather than waiting for indicators to surface through other means.
• Proper access controls ensuring only authorized personnel can access specific client information based on business need.
• Secure document management and sharing that protects privileged information during storage and transmission.
• Incident response capability that enables quick containment and remediation when security incidents occur.

Staff training on security threats and proper data handling practices.

Notice what’s missing from this list: expensive enterprise security systems, full-time IT staff, or unreasonable cost burdens. The reasonable efforts standard accounts for firm size and resources. Solo practitioners aren’t expected to implement Fortune 500 security programs.

But all firms regardless of size must implement basic security practices. Multi-factor authentication costs nothing. Encryption is built into modern operating systems. Security awareness training requires time investment but minimal expense.

The consequence of failing to meet reasonable efforts:

• Disciplinary action from ARDC if security failures result in unauthorized disclosure of client information.
• Malpractice liability when inadequate security causes client harm through information exposure.
• Client termination of representation and potential fee disputes when clients lose confidence in the firm’s ability to protect confidential information.
• Reputation damage within the legal community and among referral sources when security failures become known.

The Illinois Attorney Registration and Disciplinary Commission has sanctioned attorneys for failing to implement reasonable security measures. As cybersecurity expectations evolve, the threshold for “reasonable efforts” continues to rise. Practices that might have been acceptable five years ago like password-only access or no encryption no longer satisfy ethical obligations.

Managed IT services help firms satisfy Rule 1.6(c):

By implementing comprehensive security measures appropriate for firm size and budget, managed IT provides documented evidence of reasonable efforts to protect client information. When questions arise during malpractice claims, disciplinary investigations, or client inquiries—firms can demonstrate specific security controls implemented to satisfy ethical obligations.

This documentation matters. The question isn’t whether perfect security existed (perfect security doesn’t exist). The question is whether reasonable efforts appropriate to the circumstances were implemented. Managed IT services provide both the actual security controls and the documentation proving reasonable efforts were made.

Mistake #9: No Incident Response Plan

Most law firms have no documented plan for responding to cybersecurity incidents. When breaches occur, they improvise response—usually poorly.

Problems from lacking incident response plans:

• Delayed detection and containment because nobody knows what indicators to watch for or what actions to take when suspicious activity is noticed.
• Evidence destruction during panicked response attempts shutting down systems, deleting files, or otherwise destroying forensic evidence needed to understand what occurred.
• Inadequate documentation of what happened, what was compromised, and what response actions were taken making it impossible to satisfy notification requirements or defend against malpractice claims.
• Confused communications with clients, insurers, regulators, and law enforcement because nobody established clear responsibility for external communications during incidents.
• Regulatory violations from missing notification deadlines, failing to preserve evidence, or not reporting incidents as required by professional responsibility rules.
• Missed insurance coverage because policy notification requirements weren’t met during critical timeframes after incidents.

The West Loop firm mentioned earlier that nearly wired $180,000 to criminals? They had no incident response plan. After catching the attempted fraud, they didn’t know whether to report it to ARDC, notify their malpractice carrier, document it in their security logs, or treat it as a non-event since funds weren’t actually stolen.

They ultimately decided reporting wasn’t necessary since no actual loss occurred. Months later, during their malpractice insurance renewal, the carrier asked whether they’d experienced any “security incidents” during the policy period. The firm answered no—the wire transfer was attempted but not completed, so they didn’t consider it an incident.

The carrier discovered the event through industry reports about business email compromise attempts targeting Chicago law firms. The firm’s failure to report resulted in their renewal being declined for material misrepresentation. They had to find new coverage at 60% higher premiums.

A documented incident response plan would have clarified that attempted business email compromise constitutes a reportable security incident requiring insurer notification within specific timeframes.

Managed IT services include incident response planning:

• Documented incident response procedures specifying roles, responsibilities, and actions for different incident types.
• Clear escalation paths ensuring appropriate personnel are notified based on incident severity.
• Evidence preservation protocols that protect forensic information while containing threats.
• Communication templates for client notification, ARDC reporting, insurer notification, and law enforcement coordination.
• Regular testing and updates ensuring incident response plans remain current and staff understand their roles.
• 24/7 incident response support from security professionals who guide firms through incidents as they occur.

When the Lincoln Square family law firm’s managed IT provider detected the compromised account accessing systems from Romania, their incident response plan activated automatically. Within minutes:

• The compromised account was disabled
• The security team began forensic analysis
• The managing partner received notification
• Documentation began for potential ARDC and insurer reporting
• Communication templates prepared for client notification if needed

By morning, the firm had a complete incident report documenting what happened, what was accessed (nothing containment occurred before data theft), what response actions were taken, and recommendations for preventing recurrence.

That organized response directly resulted from having a documented, tested incident response plan something the firm’s managed IT provider created as part of standard service.

The Cost-Benefit Analysis: Managed IT Investment vs. Breach Costs

Law firms evaluating managed IT services inevitably ask about cost. Understanding real numbers clarifies the value proposition.

Typical managed IT costs for law firms:

• 5-attorney firm: $2,000-3,500 monthly ($24,000-42,000 annually)
• 15-attorney firm: $4,500-7,500 monthly ($54,000-90,000 annually)
• 30-attorney firm: $8,000-13,000 monthly ($96,000-156,000 annually)

These costs include:

• 24/7 security monitoring and threat detection
• Proactive system management and maintenance
• Help desk support for staff
• Microsoft 365 security management
• Email security and encryption
• Device management and security
• Backup and disaster recovery
• Security awareness training
• Vendor security management
• Incident response support
• Compliance documentation assistance

Compare this to breach costs:

Direct incident response: $75,000-250,000 for forensic analysis, containment, and remediation

Client notification: $15,000-100,000 depending on number of affected clients and notification requirements

ARDC response: $25,000-75,000 in legal fees defending against disciplinary investigation

Malpractice claims: $100,000-1,000,000+ depending on actual client harm from information exposure

Insurance impact: 40-100% increase in malpractice premiums for 3-5 years following breaches

Lost clients: 15-30% client attrition on average following security incidents

Reputation damage: Unmeasurable but significant impact on referrals and new client acquisition

Opportunity cost: Hundreds of billable hours spent responding to incidents rather than serving clients

The Chicago law firm that experienced the four-day undetected breach spent $85,000 on direct response costs. But their total cost exceeded $300,000 when including malpractice insurance increases, client losses, and partner time dedicated to breach response rather than legal work.

For their 12-attorney firm, comprehensive managed IT would have cost approximately $65,000 annually. One prevented breach would have paid for five years of protection. Instead, they spent 4.5x their annual managed IT cost on responding to a single incident—and still face ongoing reputation damage and elevated insurance costs.

The math is clear: Managed IT costs a fraction of breach response expenses. More importantly, managed IT provides the continuous protection, monitoring, and expertise that prevents most incidents from occurring in the first place.

How Managed IT Services Transform Law Firm Security

The difference between managing IT yourself and using managed IT services is the difference between hoping nothing goes wrong and knowing you’re actively protected.

What changes with managed IT:

Proactive monitoring instead of reactive firefighting. Problems are identified and resolved before they impact operations. Security threats are caught during attempted attacks, not after data theft.

Predictable costs instead of emergency expenses. Monthly managed IT fees replace unpredictable emergency IT spending and catastrophic breach costs.

Expert support instead of hopeful guessing. When technical questions arise, you access experienced professionals who manage security for multiple law firms not Google searches and trial-and-error.

Compliance confidence instead of ethical uncertainty. Your security measures demonstrably satisfy reasonable efforts requirements under Rule 1.6(c), with documentation to prove it.

Business continuity instead of operational disruption. Backup and disaster recovery ensure operations continue even when equipment fails or security incidents occur.

Scalability without complexity. As your firm grows, technology infrastructure scales smoothly without requiring technical expertise from partners or staff.

Current security instead of outdated protection. Threat detection evolves automatically as new attacks emerge, keeping protection current without requiring your attention.

A River North business litigation firm transitioned to managed IT services three years ago. Their managing partner describes the change: “We went from constantly worrying about technology and security to focusing entirely on legal work. When technical issues arise which is rare, they’re handled before we notice. We’ve had zero security incidents since implementation, our client portal has improved client communication, and our staff productivity increased because technology actually works rather than creating obstacles.”

The firm’s annual managed IT cost is less than a single partner bills in one month. Yet it eliminates technology concerns that previously distracted multiple attorneys and consumed administrative time dealing with IT problems.

More importantly, the firm confidently tells clients they implement comprehensive security measures to protect confidential information and can document specific controls when asked. This security posture has become a competitive advantage in attracting security-conscious corporate clients.

What to Look for in Managed IT Providers for Law Firms

Not all managed IT providers understand legal practice requirements. Generic IT companies treat law firms like any other business missing the specific security, compliance, and operational needs legal practices face.

Essential capabilities for law firm IT providers:

• Legal industry experience working with other Chicago law firms, understanding ethical obligations, confidentiality requirements, and professional responsibility rules.
• Security-first approach that prioritizes data protection over convenience, with comprehensive security measures built into standard service.
• Microsoft 365 expertise specific to legal configurations, including proper security settings, retention policies, and information barriers for conflict management.
• Compliance support helping firms satisfy ARDC requirements, client security questionnaires, and professional responsibility obligations.
• Document management experience with legal-specific DMS platforms like NetDocuments, iManage, or Worldox not just generic file storage.
• Rapid response capability understanding that legal deadlines, court filings, and client emergencies demand immediate response, not next-business-day callbacks.
• Security awareness training specifically designed for law firms, addressing threats targeting legal practices and scenarios attorneys actually encounter.
• Professional communication appropriate for client-facing environments where vendors may interact with clients or opposing counsel.
• Local presence in Chicago for situations requiring on-site response and understanding of local legal community expectations.
• Transparent pricing and communication without surprise bills, hidden fees, or technical jargon clear explanations in business terms.

When evaluating managed IT providers, ask specific questions:

• “How many Chicago law firms do you currently support?”
• “Describe your experience with legal ethics requirements around data security.”
• “How do you handle Microsoft 365 security configuration for law firms?”
• “What’s your average response time for urgent issues during business hours?”
• “Show me an example of security awareness training you provide to legal staff.”
• “How do you help firms respond to client security questionnaires?”

The answers reveal whether you’re talking with legal IT specialists or generic IT companies trying to serve law firms without relevant experience.

Protect Client Confidentiality with Proactive IT Support

Your ethical obligation to protect client information isn’t optional. Neither is the need for comprehensive cybersecurity that satisfies Rule 1.6(c)’s reasonable efforts standard.

The law firms suffering breaches, facing malpractice claims, and explaining security failures to ARDC didn’t plan to fail. They simply failed to plan treating IT security as an expense to minimize rather than risk management essential to legal practice.

The good news: You don’t need enterprise security budgets or technical expertise to protect client information properly. You need managed IT services from providers who understand legal practice, implement comprehensive security measures, and provide ongoing monitoring and support that prevents incidents before they occur.

CMIT Solutions Chicago has secured law firm data and satisfied professional responsibility requirements since 2008. We’ve maintained 99.9% uptime across 200+ Chicago businesses while achieving zero client data breaches over 17 years of operations.

We don’t just provide technology, we understand how Chicago law firms operate, the ethical obligations you face, and the practical security needs of legal practice. We’ve implemented secure document management, protected privileged communications, and helped firms respond to client security questionnaires and ARDC inquiries.

Our law firm clients focus on legal work because we handle the technology and security that protects their practice.

📞 Talk to an expert about protecting your firm’s client data

Schedule a free security assessment to evaluate your current security posture, identify gaps in protection, and develop a comprehensive IT security plan that satisfies your ethical obligations.

Every day you delay is another day client information remains inadequately protected. The law firm that implements proper security before an incident happens demonstrates the reasonable efforts Rule 1.6(c) requires. Make sure that firm is yours.

---

About CMIT Solutions Chicago

Since 2008, CMIT Solutions Chicago has provided comprehensive managed IT services, cybersecurity protection, and compliance support to law firms, professional services organizations, and businesses throughout Chicago. With 200+ active clients, 99.9% uptime, and zero client data breaches, we deliver the secure IT infrastructure that protects your clients’ confidential information and satisfies your professional responsibility obligations.