Law Firm Cybersecurity Checklist: Ten Questions Managing Partners Should Ask

Cybersecurity for a law firm is ultimately about protecting confidential client information and keeping the practice operating. ABA Model Rule 1.6(c) asks lawyers to make reasonable efforts to prevent unauthorized access to or disclosure of client information. Applicable state rules and the circumstances of the practice also matter.

Managing partners do not need to configure firewalls. They need credible answers to ten questions.

Questions 1–3: Know the information and who can reach it

1. Where are confidential client and matter files stored, including email, document systems, mobile devices, cloud accounts and outside portals?
2. Who can access each category of information? How are access rights changed when attorneys, staff or contractors join or leave?
3. Are privileged accounts and remote access protected through appropriate multifactor authentication and periodic review?

Permissions should reflect how the firm actually works, rather than assumptions made years ago when the software was first configured.

Questions 4–6: Prepare for predictable disruptions

4. How do staff verify changed payment instructions or unexpected requests for confidential documents?
5. Can the firm recover important client files and communications after ransomware or a major cloud outage?
6. Who directs an incident, coordinates with outside counsel and insurers, and handles notifications when required?

Practice these scenarios. A backup product or email filter is not a substitute for an operating procedure.

Questions 7–8: Make providers accountable

7. What obligations have cloud and IT vendors accepted concerning data, access, subcontractors and incident reporting?
8. Who independently reviews the provider's performance, recommended purchases and remaining risk?

Outsourcing technical management does not eliminate the need for leadership-level risk decisions.

Questions 9–10: Govern new technology

9. Which AI, transcription and document-automation tools are approved for confidential information—and under what restrictions?
10. Is there a funded technology roadmap with measurable priorities rather than a reactive product list?

Pick the three weakest answers, name owners and set a date to obtain evidence. See ABA Model Rule 1.6 and the firm's applicable jurisdictional rules for the professional-responsibility context.

Bring the issue to Cyber Virtues

Learn about law firm IT and cybersecurity advisory, or discuss a specific concern.