WISP Compliance for Las Vegas Law Firms: What Your Firm Needs in 2026

Lawyer reviewing WISP compliance document Las Vegas

Law firm compliance guide

WISP compliance for Las Vegas law firms

What a Written Information Security Plan is, who needs one, and how Nevada law and attorney ethics rules raise the bar for client data.

Request a compliance gap analysis (702) 725-2877

By Adam Lopez, Fractional CIO and vCISO, CMIT Solutions of Las Vegas · Updated October 2026

The short answer

A Written Information Security Plan (WISP) documents how your law firm protects client data: who is responsible, where the data lives, what safeguards are in place, and how you respond to a breach. Tax-preparing firms are required to keep one, and every Las Vegas firm benefits from having one.

This article is general information, not legal advice. Ask your own counsel how these rules apply to your firm.

Where firms stand

Do you actually have a WISP?

If you renewed a Preparer Tax Identification Number (PTIN) or filled out a compliance checklist, you may have confirmed that your firm has a Written Information Security Plan. The honest question is whether the plan exists on paper and matches how your firm really works. Many Las Vegas firms, especially in personal injury, estate planning and tax law, handle sensitive client data every day and have never written it down.

What is a WISP and who is required to have one?

A WISP is not a generic employee handbook. It is a working document that records how your firm protects client information.

TAX

Tax-preparing firms

The FTC Safeguards Rule treats tax preparers as financial institutions, and the IRS expects tax professionals to keep a WISP. IRS Publication 5708 and Publication 4557 explain what to include.

ALL FIRMS

Other law firms

A statute may not mandate a WISP for every practice area. Still, Nevada law expects reasonable security for personal information, and attorney ethics rules expect confidentiality. A written plan is how you prove it.

Core elements

What a strong law firm WISP includes

Designated coordinator

A named person responsible for security in your firm, with a backup.

Written risk assessment

A documented review of where client data lives, who can reach it, and where it could leak.

Technical safeguards

Multi-factor authentication, encryption, endpoint protection, email filtering, and tested backups.

Vendor oversight

Proof that the providers who touch client data, including your IT provider, protect it too.

Training

Regular staff training, especially on phishing and wire-fraud attempts.

Incident response

A written plan for who does what, who you call, and who you notify after a breach.

Why it matters in a claim: after an incident, insurers, clients and regulators ask what you had in place. A current, followed WISP is strong evidence of reasonable care. Missing documentation can make a claim harder.

State privacy law

Nevada SB 370 and personal injury firms

Many attorneys assume health privacy laws only reach doctors. Nevada’s consumer health data law (SB 370, effective 2024) is broader. It can apply to regulated entities that collect or process consumer health data, and personal injury and workers’ compensation files are full of it. Depending on whether it applies to you, obligations may include:

Consumer health data policy

A separate, posted policy that explains how you collect and use consumer health data.

Consent before collection

Clear consent before you gather certain health information.

Advertising limits

Restrictions on geofencing around health care facilities to target ads.

SB 370 has exemptions, including for entities already covered by HIPAA and certain financial privacy laws, and the Attorney General enforces it. Because the scope is nuanced, have counsel confirm whether your firm is covered.

Ethics

Attorney ethics and technology: ABA Formal Opinion 498

The American Bar Association’s Formal Opinion 498 (2021) addresses virtual practice. It reminds lawyers that the duties of competence and confidentiality follow them out of the office. Related guidance, including Formal Opinion 477R, calls for reasonable steps to secure client communications. For a Las Vegas firm that works hybrid or remote, those steps usually mean:

Secure communication

Encrypted email or a secure client portal for sensitive case files, chosen to match the sensitivity of the information.

Endpoint detection and response

Modern endpoint protection that goes beyond basic antivirus to contain ransomware.

Protected remote access

A VPN or equivalent secure connection when working on public Wi-Fi, plus multi-factor authentication on every account.

Pricing

What it costs to get a law firm compliant

CMIT prices per seat, from $49 to $120 per seat per month. Start with the protection you need and add support hours and applications as you grow.

Good

Cybersecurity only

From $49

per seat, per month

Managed cybersecurity protection for every seat
Core business applications covered
Best when you already have IT help

Better

Help desk plus cybersecurity

Priced per seat

between the Good and Best plans

Everything in Good
Help desk support during business hours
More applications covered as you add them

Best

24/7 help desk plus cybersecurity

Up to $120

per seat, per month

Everything in Better
24/7 support from our Las Vegas team
Broadest application coverage

Your price depends on the plan, whether support covers business hours or 24/7, and how many applications we cover. Ask for a written quote based on your seat count and applications.

Common questions

WISP and law firm compliance: frequently asked questions

What is a WISP?

A WISP is a Written Information Security Plan: a documented program that says who is responsible for security, where client data lives, which safeguards protect it, and what you do if something goes wrong.

Do all Las Vegas law firms legally need a WISP?

Not every firm is covered by the same rule. Firms that prepare tax returns are treated as financial institutions under the FTC Safeguards Rule, and the IRS expects a WISP from tax professionals. For other firms a written plan is not always mandated by one statute, but it is the clearest way to show the reasonable security that Nevada law and attorney ethics rules expect.

Does Nevada SB 370 apply to personal injury firms?

It may. SB 370 covers certain entities that collect or process consumer health data, and personal injury and workers’ compensation files are full of it. The law has exemptions, including for entities covered by HIPAA and certain financial laws, and it is enforced by the Attorney General. Ask your own counsel whether your firm is a regulated entity.

What does ABA Formal Opinion 498 say about technology?

Opinion 498 addresses virtual practice. It reminds lawyers that the duties of competence and confidentiality apply when you work remotely, including taking reasonable steps to secure communications, devices and client data.

What should a law firm WISP include?

A named security coordinator, a written risk assessment, access controls and multi-factor authentication, encryption, backup and recovery, employee training, vendor oversight, and an incident response plan, reviewed at least once a year.

How much does IT support and security cost for a Las Vegas law firm?

CMIT Solutions prices per seat, from $49 to $120 per seat per month, depending on the plan (cybersecurity only, or help desk plus cybersecurity), whether support covers business hours or 24/7, and how many applications we cover. We confirm the details in a written quote.

Stop guessing at compliance.

You went to law school to practice law, not IT security. Ask for a complimentary compliance gap analysis for your Las Vegas firm.

Schedule your confidential audit

Prefer to talk? Call (702) 725-2877 or email LVSales@cmitsolutions.com