Every law firm must meet data security duties from three sources: the professional conduct rules your state has adopted, the ethics opinions your state bar has issued on technology, and the regulations and contracts that come with your clients. Together they decide how you must protect client files, who may see them, and what you have to prove if anyone asks.
Those duties fall into three sources:
- Professional conduct rules (based on ABA Model Rules 1.1 and 1.6): State-adopted rules that set the baseline duty to keep client information confidential and to stay competent with the technology you use.
- State bar cloud ethics opinions: State-level guidance on using cloud tools and outside vendors with reasonable care.
- Client-driven regulations and contracts: Extra rules and contract terms that come with your clients and the way they pay you, from health records to card payments.
At CMIT Solutions, we act as trusted technology advisors for law firms, building security into their IT by design and putting the technical and operational safeguards behind these compliance obligations in place. Our security-first approach, backed by responsive local support and a nationwide network of IT and cybersecurity professionals, turns that tangle of duties into a clear plan.
See how our security-first IT support for law firms helps protect your practice and supports your compliance efforts.
Where your law firm’s data security duties come from
These three sources stack rather than overlap. Meeting your bar’s conduct rules does not cover a client’s HIPAA obligations, and a solid cloud contract does not answer a state breach law. Each adds its own requirement, so a complete plan has to account for all three at once.
The table below maps each source to what it asks of you and to the evidence that shows you met it. Tracking all three while technology keeps growing more complex is hard, and the last column is where most firms fall short, so it is the first place we help them tighten up as a trusted advisor.
| Source of the duty | What it requires | When it applies | How you demonstrate it |
| State conduct rules based on ABA Model Rule 1.6 (confidentiality) | Reasonable efforts to prevent unauthorized access to or disclosure of client information | Every firm, every matter, under your state’s version of the rule | Access logs, encryption records, written safeguards |
| State conduct rules based on ABA Model Rule 1.1 (competence) | Staying reasonably informed about the benefits and risks of the technology you use | Every attorney, under their jurisdiction’s version of the rule | Training records, documented tool reviews |
| State conduct rules based on ABA Model Rule 5.3 (nonlawyer assistance) | Reasonable oversight of the vendors and staff who handle client data | Any firm using outside IT, cloud, or e-discovery, under its state’s version of the rule | Vendor contracts, due-diligence files |
| State bar cloud ethics opinions | Reasonable due diligence before storing client data with a third party | Any firm using cloud software | Vendor assessments, data-location records |
| HIPAA | Safeguards for protected health information | Firms that handle health information on behalf of covered entities, as business associates | Risk analysis, business associate agreements |
| PCI DSS (an industry standard, not a law) | Security controls for organizations that accept, process, store, or transmit payment card data; a firm’s obligations depend on its payment systems, service providers, and contracts | Firms that accept credit card payments, with scope depending on how payments are handled | Applicable PCI DSS validation documentation, such as a Self-Assessment Questionnaire or Attestation of Compliance, where required |
| State privacy and breach-notification laws (such as the CCPA, as amended by the CPRA, and the NY SHIELD Act) | Depending on the firm’s operations, the information it holds, and each law’s criteria: reasonable safeguards, privacy disclosures, and notice after certain data breaches | Firms that meet a law’s applicability criteria, since thresholds, exemptions, and covered data types vary by state | Privacy policy where required, written security program, incident response plan |
| Client contracts and cyber insurance | Specific controls named in security questionnaires and policy terms | Firms serving corporate clients or carrying cyber coverage | Completed questionnaires, control evidence |
Professional conduct rules (based on ABA Model Rules 1.1 and 1.6)
Professional conduct rules are the floor under every firm, and they come from your state, not the ABA. State-adopted rules of professional conduct, generally based on the ABA Model Rules of Professional Conduct, set duties for technological competence, client confidentiality, and supervision of nonlawyer assistance.
In the model version, Rule 1.6 requires reasonable efforts to prevent unauthorized access to client information, and the comment to Rule 1.1 expects you to stay current on the technology you rely on. The ABA publishes models and each state adopts its own version, so the wording can differ from one jurisdiction to the next.
Rule 5.3 extends the same thinking to the people and vendors who touch client data, so supervision is part of the duty too. Holding that standard while running a practice is demanding, which is where we step in as trusted advisors, putting in place and overseeing the technical safeguards those rules call for.
State bar cloud ethics opinions
State bar cloud ethics opinions answer a question the model rules leave open: may you store client data in the cloud? Most state bars that have addressed it say yes, as long as you take reasonable care. These opinions describe what reasonable care actually looks like.
They usually call for checking where data is stored, how it is secured, who can reach it, and what happens if the vendor fails. Because that duty stays with the firm rather than the software company, we support this due diligence for our clients, vetting each tool’s security controls against those expectations to help keep the cloud from becoming a blind spot in your threat visibility.
Additional reading: law firms and cloud security
Client-driven regulations and contracts
Client-driven rules change from matter to matter. The data your clients hand you can carry its own law: health records can fall under HIPAA when a firm acts as a business associate, and state privacy and breach-notification laws, such as the New York SHIELD Act, may add duties depending on the firm’s operations, the information it holds, and each law’s applicability criteria.
Simply handling a client’s medical records does not automatically make a firm subject to HIPAA.
State laws are not one-size-fits-all either. The California Consumer Privacy Act, for example, has applicability thresholds and exemptions, and breach-notification laws differ by state in their definitions, triggers, and deadlines.
Contracts add more layers: corporate clients send security questionnaires, payment networks and processors can bring in PCI DSS, an industry standard rather than a law, and cyber insurers require certain controls before they will cover you. A payment processor’s compliance alone does not prove your firm’s, so we help map each rule that applies to your firm to the technical controls that support it, applying the same tools and standards across every office and remote team.
Additional reading: law firm HIPAA compliance
Serving government or defense contractor clients? Our CMMC compliance services help your firm handle controlled information to federal standards.
The controls that protect client confidentiality
Meeting your confidentiality duty comes down to a handful of layered controls that decide who can reach client data and how well it is protected. The goal is simple: the right people see the right files, everything sensitive is encrypted, and every access leaves a record you can check later. Without these layers, many firms are left guessing whether client data is actually protected.
- Role-based access: Give each person access only to the matters they work on. This limits both outside attackers and accidental internal exposure, and it supports the ethical walls firms keep between clients.
- Multi-factor authentication: Require a second step beyond a password on every system that holds client data. It stops the most common breach method, a stolen password, from becoming a full compromise.
- Encryption at rest and in transit: Protect files where they are stored and while they move. Encrypted data stays unreadable even if a laptop is lost or an email is intercepted.
- Endpoint protection and patching: Keep antivirus, endpoint detection, and software updates current on every device. This closes the known gaps attackers look for first.
- Access logging: Record who opened which file and when. Logs catch unusual activity early and give you proof of control when a client or regulator asks.
A widely used baseline for these controls is the NIST Cybersecurity Framework, which many organizations adopt as a starting point for a structured security program. Rather than leave your firm to assemble that framework alone, we design, deploy, and manage these controls as one layered, security-first system that builds on that baseline, with continuous monitoring and threat response, so protection is built in by default and adapts as threats evolve.
Backup and recovery as a compliance requirement
Backup and recovery is not only an IT safeguard, it is part of your duty to protect client work. If ransomware locks your active files the week of a filing, untested backups can mean lost data, days of downtime, a missed deadline, and a bar complaint. Reliable recovery helps keep one attack from costing a case.
- Automated, daily backups: Back up client files, email, and case notes without relying on anyone to remember. A gap in backup is a gap in protection.
- Offsite or immutable copies: Keep at least one copy that ransomware cannot reach or alter. Backups stored beside live data fail at the moment you need them most.
- Tested recovery: Confirm on a schedule that backups actually restore. A backup you have never tested is a guess, not a safeguard.
We take backup and recovery off your plate entirely, running automated backups, keeping protected copies out of ransomware’s reach, and verifying restores on your behalf so recovery is tested long before you ever need it, supporting business continuity when something goes wrong.
See what a single outage could cost your firm with our IT downtime calculator.
Securing how your firm communicates with clients
Client communication is where confidential information most often slips out of your control. Every email, attachment, and shared folder is a chance for privileged data to reach the wrong inbox, and that risk grows when attorneys work across several offices and from home. Securing these channels helps keep everyday work from becoming an everyday risk.
- Email encryption: Encrypt messages that carry sensitive data by default, so only the intended recipient can read them.
- Secure file sharing: Use tools built for professional use, with access controls and audit trails, rather than consumer apps that were never designed for privileged data.
- Client portals: Give clients one secure place to exchange documents and messages. A portal protects confidentiality better than email and gives clients confidence their information is handled with care.
We set up and manage these secure channels for firms of every size, from solo practices to multi-office and remote teams, to help keep privileged information protected without slowing down the way your team already works.
Managing the vendors who touch your client data
Outsourcing work does not outsource the duty. Under your state’s version of Rule 5.3 and most state cloud opinions, your firm stays accountable for client data even when a vendor stores or processes it. With several vendors in the mix, accountability gaps are easy to create, which makes vendor oversight a security control in its own right.
- Due diligence before you sign: Review a vendor’s security controls, certifications, and track record with regulated clients before handing over any data.
- Written data protection terms: Put safeguards, breach-notice timelines, and responsibilities in the contract, not in a verbal promise.
- Ongoing review: Recheck vendors on a schedule, because a provider that was safe last year may not be this year.
Vendor oversight is detailed, ongoing work, and we carry it for the firms we support, assessing providers, holding them to clear terms, and rechecking them to help keep accountability from slipping through a gap. As your firm adopts new technology, including AI tools, our cybersecurity-informed recommendations help you do it with confidence.
Wondering how your firm’s overall security measures up? Get a custom cybersecurity score to see where you stand.
Training the team that attackers target first
Many breaches start with a person, not a server. A convincing phishing email, a reused password, or a file sent to the wrong address can undo strong technology in seconds, and every new hire adds another target. Training turns your staff from the weakest link into a working layer of defense, but many growing firms lack the in-house IT resources to run it consistently.
- Phishing simulations: Send safe test emails to see who clicks, then coach from the results. Instincts improve with practice.
- Security awareness training: Teach staff to spot suspicious links, protect passwords, and handle devices safely. Short, regular sessions beat one long annual lecture.
- Clear, signed policies: Put your data-handling rules in writing and have everyone acknowledge them, so expectations are never in question.
We run this program for the firms we work with, from simulated phishing to regular training, helping build security awareness into a habit your team keeps without extra effort on your part, so your people become one more layer of protection.
Documenting compliance so you can prove it
Here is the part most firms miss: your duty is not satisfied by good intentions; it is satisfied by controls you can show. When a client sends a security questionnaire or a regulator asks how you protect data, the firm with documentation answers in minutes, and the firm without it scrambles.
Good documentation maps each obligation from the matrix above to a specific control and the evidence behind it. That record supports your answers to client security questionnaires, cyber insurance applications, and any bar review of whether your safeguards were reasonable.
If an incident happens, access logs, incident records, and a written response plan let the firm contain it quickly and show that it acted with care. As your trusted technology advisor, we build and maintain that documentation alongside your controls, so the evidence is easier to pull together when anyone asks for it.
Many firms assume their cyber insurance will pay out after an attack, but insurers increasingly require specific security controls before they will issue or renew a policy.
Use our insurance readiness assessment to see whether your current security environment aligns with what insurers now expect.
A data security lapse at a small firm: how it unfolds
Picture a six-attorney personal injury firm that keeps case files, including clients’ medical records, in a consumer cloud account shared by the whole team. There is no multi-factor authentication, no limit on who can open what, and backups no one has ever tested, because IT is treated as upkeep and no one owns long-term technology guidance. The setup feels fine, until it is not. (This is an illustrative example, not an actual case.)
A paralegal reuses a password that was exposed in an unrelated breach. An attacker signs in, quietly copies months of files, then triggers ransomware on the way out. The firm cannot open its own case files the week two filings are due.
Mapped back to the sources, the gaps are obvious: confidentiality rules based on Rule 1.6 called for reasonable efforts the firm never made, the firm’s confidentiality obligations applied to those medical records, and applicable state privacy and breach-notification laws could have imposed additional duties the moment data left the building. Reducing exposure like this before it becomes a bad week is the work we do for the firms we partner with, pairing layered controls that help prevent, detect, and respond to threats with the documentation to back them up.
Let us handle the technical side of law firm data security
You did not go to law school to manage firewalls and backup schedules. At CMIT Solutions, we take the weight of data security off your desk, building security-first IT that is designed, monitored, managed, and supported to protect your systems, devices, users, and data and to back the duties your practice is held to. We have worked with thousands of businesses since 1996, and as a recognized leading managed service provider, our local teams are backed by a nationwide network of more than 900 IT and cybersecurity professionals, so your firm gets enterprise-level capabilities with the reliable, personal service of a local team.
Our team works with you to map the obligations your counsel identifies to working controls, monitors your systems around the clock and responds when threats appear, and keeps the records that document them, so the evidence is ready when a client, insurer, or regulator asks. That is why firms lean on us as a long-term technology advisor, not just a help desk, aligning their IT with their goals to support productivity, resilience, and growth with confidence.
Our Optyx case study shows this at work: Optyx, an optical retail chain with 13 storefronts, relies on us to keep patient data protected and its systems consistent at every location, with a technician who can come on-site when it is needed. We optimized internet service across all of its sites, including backup connections, so critical systems stay online.
Call us at (800) 399-2648 or visit our contact page to see how our security-first IT, responsive local support, and strategic guidance can help protect your firm’s data.
FAQs
How often should a law firm review its data security?
A law firm should review its data security at least once a year, and again after any major change, such as new software, a new office, or staff turnover. Many firms also check access rights and backups every quarter, because those settings drift fastest between full reviews.
What should a law firm do first after a suspected data breach?
A law firm should first contain the breach by disconnecting affected devices and resetting exposed passwords. Next, preserve all evidence and avoid deleting files, then contact your IT and legal advisors. Finally, check whether state breach notification laws or client contracts require you to notify anyone, and by what deadline.
Do small and solo law firms have the same data security duties as large firms?
Yes, small and solo law firms have the same data security duties as large firms. State professional conduct rules apply no matter the firm size, and state and client regulations do not shrink for smaller practices. What changes is scale, so many small firms rely on an outside IT partner.
What should a law firm do with client data access when an employee leaves?
A law firm should end an employee’s access to client data on their last day. Disable their accounts, revoke device and cloud access, change any shared passwords, and collect firm equipment. Keep a record of each step, since a clean offboarding is both a security control and proof of care.
How long should a law firm keep its security and compliance records?
A law firm should keep security records as long as the matters and duties they support. Many firms retain access logs, incident reports, and vendor assessments for several years, matching their file-retention and malpractice insurance timelines. When unsure, match each record to the longest obligation it could need to prove.
