Cybersecurity for small law firms

Who this page is for

• You’re a partner or office manager at a 3 to 30 person firm with no in-house IT.
• A client just sent you a long security questionnaire.
• Your cyber insurance renewal asks about MFA, EDR and backups.
• You send closing, settlement or trust account wires and worry about spoofed instructions.

What this looks like in a small firm

A 12-lawyer firm runs on Microsoft 365 with MFA for the partners only. The IT contractor reaches the file server by remote desktop. Paralegals keep portal passwords in a shared spreadsheet.

Then a title company emails new wire instructions for a closing from a domain that differs by one letter. That is business email compromise, and why wire verification belongs in the same plan as MFA.

What the ABA rules and opinions say

The ABA Model Rules are a model. Your state’s adopted rules are what bind you, so check them with your state bar. With that caveat, these are the pieces that matter for security.

Source	What it addresses	Practical meaning for a small firm
Model Rule 1.1, Comment 8	Competence includes keeping up with the benefits and risks of relevant technology [VERIFICAR]	Someone at the firm has to understand the tools you use, or hire someone who does
Model Rule 1.6(c)	Reasonable efforts to prevent inadvertent or unauthorized disclosure of, or access to, client information [VERIFICAR]	Reasonable safeguards, scaled to the sensitivity of the information
Formal Opinion 477R (2017)	Securing communication of protected client information; email is generally acceptable, but highly sensitive matters may call for extra measures like encryption [VERIFICAR]	Decide when matters need encrypted email or a client portal, and tell staff
Formal Opinion 483 (2018)	Duties after a data breach or cyberattack: monitor, act to stop and mitigate, investigate, and inform current clients when their information is involved [VERIFICAR]	Have a written incident response plan before you need it
Formal Opinion 498 (2021)	Virtual practice: securing remote work, devices, networks and supervision of staff working outside the office [VERIFICAR]	MFA and managed devices for anyone working from home
Formal Opinion 512 (2024)	Generative AI tools: competence, confidentiality, client communication, supervision and fees [VERIFICAR]	Know what an AI tool does with client data before anyone pastes a document into it

The opinions are listed on the ABA’s ethics opinions page, and members can read them in the ABA’s online library.

When HIPAA applies to a law firm

HIPAA doesn’t cover law firms in general. It can apply when you work for a health care client.

HHS’s business associate guidance gives this example of a business associate: an “Attorney whose legal services to a health plan involve access to PHI.” The same reasoning can apply to firms that receive PHI from hospitals, practices or other covered entities to do their legal work.

If that’s you, expect a BAA. Under 45 CFR 164.314(a), the contract requires you to comply with the Security Rule for that ePHI, to bind your own subcontractors, and to report security incidents.

In August 2025, HHS announced that BST & Co. CPAs, an accounting firm acting as a business associate, paid $175,000 after a ransomware attack, and OCR found it had not done an accurate and thorough risk analysis (HHS release). A firm in that position needs its own HIPAA risk assessment.

Wire fraud and business email compromise

The FBI’s 2025 Internet Crime Report counts 24,768 business email compromise complaints in 2025. Reported BEC losses that year were about $3.05 billion.

The FBI’s BEC page recommends using “secondary channels or two-factor authentication” to verify requests to change account information. It also recommends checking the sender’s full email address, especially on phones.

If money goes out on a fraudulent instruction, the FBI says to contact the originating bank as soon as you recognize the fraud and to file a complaint at ic3.gov.

For a firm, the control is a written rule: no wire goes out on new or changed instructions until someone confirms them by phone, using a number already in the file.

State breach notification laws

NCSL reports that all 50 states, the District of Columbia, Guam, Puerto Rico and the Virgin Islands have laws requiring notice of security breaches involving personal information (NCSL). The laws differ on what counts as personal information, what triggers notice, deadlines, and exemptions such as encrypted data.

A firm with clients in several states can face several of these laws at once, so name breach counsel in your incident response plan.

Client security questionnaires

Some corporate, financial and health care clients send outside counsel a security questionnaire before or during an engagement. Questions you’re likely to see:

• Do you require MFA for email and remote access?
• Is client data encrypted at rest and in transit?
• Do you run endpoint detection and response on all devices?
• Do you have a written incident response plan, and when did you last test it?
• Do you carry cyber insurance, and with what limits?

Answer accurately. A “yes” you can’t support creates its own risk. Where the answer is “not yet,” give a target date.

Options compared

Provider or option	Best for	How it works	Pricing info (as of October 2026)	Pros	Cons
Coro (I work with them)	Firms that want endpoint, email and cloud app security in one console	Bundled modules, including EDR, email security and data governance (Coro)	Not published; quote-based	One dashboard for a small team	Someone still has to review alerts
Huntress (I work with them)	Firms with an outside IT provider that wants a security team behind it	Managed EDR, plus identity protection for Microsoft 365 and Google accounts	Managed EDR MSRP $8.99 per endpoint per month; Managed ITDR MSRP $4.80 per identity per month; 50-seat minimum direct (Huntress)	Published prices; watches Microsoft 365 and Google sign-ins, where BEC often starts	Under 50 seats, you’d buy through an IT provider because of the direct minimum
CyberMaxx (I work with them)	Firms of 20 to 30 people, or with demanding clients, that want MDR	MaxxMDR, 24x7x365 detection and response, plus offensive and incident response services (CyberMaxx)	Not published	Full service, including incident response	Likely more service than a 3-lawyer firm needs
Hook Security (I work with them)	Short monthly training and phishing tests	3 to 5 minute modules and automated phishing simulations (Hook)	Per seat, not published	Easy to keep up month after month	Training alone doesn’t stop a compromise
Keeper (I work with them)	Replacing shared spreadsheets of portal and court e-filing passwords	Business password manager with shared folders (Keeper)	Prices didn’t display when I checked [VERIFICAR]	Shared vaults by practice group	Requires staff to change habits
Microsoft Defender for Business (I don’t work with them)	Firms already on Microsoft 365	EDR included in Business Premium or sold alone	$3.00 per user per month, paid yearly (Microsoft)	Low list price, same vendor as email	You or your IT provider must respond to alerts

What it costs

Published list prices as of October 2026:

• Microsoft Defender for Business: $3.00 per user per month, paid yearly.
• Huntress Managed EDR: MSRP $8.99 per endpoint per month.
• Huntress Managed ITDR: MSRP $4.80 per identity per month.

What changes the price: number of people and devices, whether someone watches alerts 24/7, whether your IT provider already resells a tool, and contract length.

A control plan by firm size

3 to 10 people

• MFA on every mailbox and on the practice management system, with phishing-resistant methods for admins, as CISA recommends.
• EDR on every laptop and desktop.
• A business password manager.
• A written wire verification rule.
• Cloud backup of documents and email with a copy the firm controls.
• A one-page incident response plan with your insurer’s hotline and an outside counsel contact.

11 to 20 people

• Everything above, plus managed EDR or identity threat detection so alerts get handled.
• Separate admin accounts for whoever manages Microsoft 365 or Google.
• Monthly short training and quarterly phishing tests.
• A vendor list with what client data each one holds.

21 to 30 people

• MDR with 24/7 coverage.
• Device management for laptops that leave the office, encrypted disks and remote wipe.
• A tabletop exercise of your incident response plan once a year.
• Written security expectations for your IT provider.
• A documented position on generative AI tools and client data.

How implementation works

1. Weeks 1 to 2: inventory devices, accounts and vendors. Turn on MFA everywhere and adopt the wire verification rule.
2. Weeks 2 to 4: deploy EDR and the password manager. Remove shared accounts.
3. Weeks 4 to 6: fix backups so one copy can’t be reached from the network, and test a restore.
4. Weeks 6 to 8: write the incident response plan, start training, and prepare your answers for client questionnaires and the cyber insurance renewal.

Questions to ask any security provider

1. Who responds to an alert at night or on a weekend?
2. Do you detect suspicious Microsoft 365 or Google sign-ins and inbox rules?
3. Can you give us documentation for client questionnaires?
4. Will you sign a BAA if we handle PHI for health care clients?

Common mistakes in small firms

1. MFA for partners only. Attackers use whichever mailbox doesn’t have it.
2. Wire instructions confirmed by replying to the email. The reply goes to the attacker.
3. The IT contractor’s remote desktop with only a password. CISA’s ransomware guide recommends phishing-resistant MFA for VPNs and other remote access.
4. Answering client questionnaires aspirationally. It can turn a security gap into a misrepresentation.
5. Treating a health care client’s BAA as paperwork. It makes the Security Rule apply to that client’s ePHI in your systems.
6. No plan for who to call. Opinion 483 addresses prompt action after a breach [VERIFICAR], and your insurance policy may have its own notice requirements.

For secure client email options, see HIPAA compliant email, which also applies to encrypted email for sensitive legal matters. To see your gaps in one place, the security checklist works for firms too, and the glossary explains terms like EDR, MDR and BEC. If you want me to compare security services for your firm, send me your firm’s size and setup.