Law Firm Cybersecurity Checklist: 25 Things Every Attorney Should Review in 2026

A law firm cybersecurity checklist should do more than remind attorneys to use strong passwords. It should help the firm decide what to verify, who owns the work, what evidence proves the safeguard is operating, and which gaps create the greatest risk to client confidentiality and firm operations.

Direct answer: In 2026, every law firm should review 25 core areas: security governance, technology competence, data inventory, access control, multifactor authentication, email authentication, wire-verification procedures, endpoint protection, patching, encryption, backups, matter-level access, secure sharing, data retention, vendor oversight, AI governance, security training, vulnerability management, penetration testing, logging and monitoring, incident response, breach notification, business continuity, cyber insurance, and documented evidence. The right implementation depends on the firm's size, clients, jurisdictions, systems, and data; the need to make and document reasonable, risk-based decisions does not.

This guide translates leading sources into an attorney-focused review. It draws on ABA Model Rule 1.1, ABA Model Rule 1.6, ABA Formal Opinion 477R, ABA Formal Opinion 483, NIST Cybersecurity Framework 2.0, CISA guidance, and relevant regulator guidance. It is educational, not legal advice. State ethics rules, breach laws, contractual duties, and sector-specific requirements must be reviewed for the firm's circumstances.

The 25-point checklist at a glance

Use the table as an index, not a scoring shortcut. A safeguard is not complete merely because software was purchased. For each item, record an accountable owner, the systems in scope, the evidence reviewed, the gaps found, the remediation deadline, and the person authorized to accept residual risk.

Governance, ethics, and risk

1. Assign security accountability to a named leader

Cybersecurity is a management obligation, even when technical work is outsourced. Name a partner, COO, CIO, security lead, or qualified outside adviser who can coordinate policy, risk decisions, budgets, vendors, incident response, and reporting to firm leadership. Define what that person can approve and which risks must be escalated.

This aligns with the Govern function added to NIST CSF 2.0. Evidence should include the appointment, reporting cadence, current risk register, and minutes or decisions from leadership reviews. A managed service provider can perform work; it should not be the sole party deciding whether its own controls are sufficient.

2. Review technology competence and confidentiality duties

Confirm that attorneys and supervised personnel understand the technology they use and the risks it creates. Comment 8 to ABA Model Rule 1.1 addresses keeping abreast of the benefits and risks associated with relevant technology. Model Rule 1.6(c) calls for reasonable efforts to prevent unauthorized access to or disclosure of information relating to a representation.

“Reasonable” is contextual. Formal Opinion 477R discusses factors such as sensitivity, likelihood of disclosure, cost, difficulty, and the effect of safeguards on representation. Review how those factors apply to email, remote work, client portals, collaboration tools, mobile devices, and generative AI. Check the controlling rules and opinions in every relevant jurisdiction.

3. Inventory systems, information, and data flows

A firm cannot protect systems or data it does not know it has. Maintain an inventory of devices, servers, cloud services, domains, mailboxes, practice-management tools, document repositories, client portals, payment systems, e-discovery platforms, integrations, service accounts, and authorized AI tools.

For confidential and regulated information, map where it is collected, transmitted, stored, backed up, shared, and deleted. Note matter sensitivity, data type, geographic location where relevant, vendor access, and business owner. Compare the list with accounts payable, single sign-on logs, browser extensions, and practice-group surveys to identify shadow technology.

4. Complete a documented risk assessment and written security program

Use the six NIST CSF 2.0 functions—Govern, Identify, Protect, Detect, Respond, and Recover—to organize the review. Smaller practices can use NIST's CSF 2.0 Small Business Quick-Start Guide to scale the process.

Document credible scenarios, affected information, current safeguards, likelihood, business and client consequences, treatment decision, owner, and due date. Convert the decisions into a written security program that leadership approves and revisits at least annually and after material changes. If the firm performs activities that could make it a covered financial institution, assess the FTC Safeguards Rule with qualified counsel; applicability is fact-specific, not automatic for every law firm.

Identity, email, and money movement

5. Enforce least privilege, access reviews, and prompt offboarding

Give each person only the access needed for current work. Separate ordinary and administrative accounts, limit standing administrator rights, review privileged access more frequently, and review matter and application access on a defined schedule. Departing personnel and vendors should lose access promptly across email, files, devices, portals, remote access, building systems, and third-party services.

Evidence should show the joiner-mover-leaver process, recent access-review decisions, terminated-session records, service-account owners, and exceptions. Include lateral moves and completed matters; access accumulation is not only an offboarding problem.

6. Require phishing-resistant multifactor authentication

Require MFA for email, remote access, document systems, cloud administration, billing, banking, client portals, e-discovery, password vaults, and backup consoles. Prioritize FIDO2 security keys or passkeys for partners, finance personnel, administrators, and other high-risk users because they resist common credential-phishing techniques better than SMS codes or simple push approvals.

CISA urges organizations to implement phishing-resistant MFA. Review enrollment and enforcement reports—not policy screenshots alone—and close legacy authentication paths that bypass MFA. Keep break-glass accounts tightly controlled, monitored, and tested.

7. Standardize passwords and privileged account handling

Provide an enterprise password manager, require unique credentials, block known-compromised passwords, and prohibit sharing through email, chat, or spreadsheets. Store service credentials in an approved vault with an identified owner and rotation process. Remove local administrator rights where they are not needed and use time-limited elevation where practical.

Do not force arbitrary periodic password changes unless compromise is suspected or another requirement applies; NIST digital identity guidance emphasizes password length, blocklists, rate limiting, and secure storage. Pair the password program with MFA rather than treating passwords as the only barrier.

8. Authenticate the firm's email domain and harden mailboxes

Verify that every sending service is covered by SPF and DKIM, then move DMARC toward an enforced policy after monitoring legitimate sources. Configure anti-phishing and impersonation protections, disable risky automatic forwarding, protect administrator roles, and retain the audit data needed to investigate mailbox access and forwarding-rule changes.

Use CISA's email and communications guidance and test the actual public DNS records. DMARC reduces unauthorized use of the firm's domain; it does not stop a criminal who compromises a real mailbox, so identity protection and transaction verification remain necessary.

9. Verify every change to wire or payment instructions out of band

Adopt a written rule that no emailed request to add or change payment instructions is trusted by itself. Call a previously verified number—not a number supplied in the message—using a second channel. Apply dual approval based on risk, document the verification, and train attorneys, accounting staff, assistants, and reception personnel to resist urgency and secrecy.

The FBI describes business email compromise as a sophisticated scam affecting legitimate payment activity and recommends secondary-channel verification of account changes. Review the FBI's BEC guidance and establish an immediate escalation path when a transfer may be fraudulent. Preserve messages and transaction details, contact the financial institution promptly, and report qualifying incidents through IC3.

Devices, applications, and infrastructure

10. Cover every endpoint with managed protection

Maintain a current list of firm-owned and approved personal laptops, desktops, servers, and mobile devices. Use centrally managed endpoint detection and response, anti-malware, full-disk encryption, screen-lock requirements, secure configuration, and mobile-device management or equivalent controls. Alert on devices that stop checking in.

Measure coverage against the inventory. A dashboard showing “healthy” agents is incomplete if unmonitored devices are absent from the dashboard. Define rules for personal devices, remote wipe, local storage, lost equipment, and separation of firm information from personal apps.

11. Set patch and vulnerability remediation deadlines

Continuously identify missing security updates and known vulnerabilities across operating systems, browsers, firewalls, VPN appliances, servers, applications, and internet-facing services. Prioritize vulnerabilities that are actively exploited, exposed to the internet, reachable from untrusted networks, or present on systems holding sensitive information.

Use CISA's Known Exploited Vulnerabilities Catalog as a prioritization input. Define remediation deadlines by risk, track exceptions and compensating safeguards, verify deployment, and report overdue items to leadership. An automated scan is useful evidence of discovery; it is not evidence that the weakness was fixed.

12. Verify encryption in transit, at rest, and on portable devices

Confirm full-disk encryption on laptops, strong transport encryption for websites and portals, encryption for cloud storage and backups, and appropriate protection for removable media. Manage recovery keys so authorized personnel can restore access without leaving keys exposed beside the protected data.

Encryption scope matters. A cloud provider's platform-level encryption does not prove that public sharing links, exported files, unmanaged devices, or email attachments are protected. Document where encryption begins and ends, who controls keys, and which workflows need an approved encrypted-message or client-portal option.

13. Maintain isolated, recoverable backups and test restoration

Keep multiple protected copies of critical data, including at least one offline, isolated, or immutable copy that ordinary administrators and compromised credentials cannot alter. Cover document systems, email where needed, financial records, configurations, identity systems, and other data required to continue representation.

The joint CISA #StopRansomware Guide recommends offline, encrypted backups and regular testing. Test restoration to a usable environment, not merely whether a backup job completed. Record recovery time, data loss, dependencies, failures, and corrective actions. Protect backup administration with separate credentials and MFA.

Client data and legal workflows

14. Restrict client and matter access by need to know

Review permissions in the document-management system, practice-management platform, file shares, e-discovery repositories, and collaboration spaces. Use matter-level security and ethical walls where required. Remove inherited broad access, stale guest accounts, and links that remain active after the need ends.

Test the result from an ordinary user's perspective. Evidence should include a current permissions report, ethical-wall configuration, approval workflow, periodic review, and correction of exceptions. Highly sensitive matters may warrant dedicated workspaces, stronger authentication, tighter download controls, or client-approved communication methods.

15. Approve secure methods for client communication and file sharing

Define when ordinary email is appropriate and when sensitivity requires an encrypted message, secure portal, controlled data room, or another protected channel. Configure expiration, recipient authentication, download restrictions where suitable, activity logging, and revocation. Prohibit public or anonymous links for client material unless expressly approved for a documented reason.

ABA Formal Opinion 477R rejects a one-size-fits-all rule and calls for a fact-specific analysis. Ask clients about communication requirements at engagement and revisit the decision when a matter's sensitivity or threat changes.

16. Enforce retention, legal holds, and secure disposal

Maintain a retention schedule tied to legal, ethical, client, insurance, and business requirements. Suspend deletion when a legal hold applies. When retention ends, delete data from active systems, exports, collaboration spaces, vendors, devices, and backups to the extent technically and legally appropriate, and obtain destruction evidence when needed.

Avoid keeping all client information forever “just in case.” Unnecessary copies expand discovery, breach, and operational risk. Coordinate records, privacy, litigation, and security personnel so defensible disposal never overrides preservation duties.

Vendors, cloud services, and artificial intelligence

17. Risk-tier every vendor that handles client data or firm access

Inventory providers, subprocessors, integrations, administrators, data types, locations where relevant, business dependencies, contract owners, and exit plans. Tier providers by consequence rather than cost: a low-cost transcription or AI service can present greater confidentiality risk than a large administrative platform.

For higher-risk vendors, review relevant independent assurance, penetration-testing evidence, authentication, encryption, logging, incident response, backup and recovery, secure deletion, and unresolved findings. Align contract terms with the assessment, including permitted use, incident notice, cooperation, subprocessors, return or deletion, and termination support. See the Attorney Armor vendor security assessment guide for an evidence-based process.

18. Govern generative AI before client information enters it

Maintain an approved-tool list and written rules for prompts, uploads, generated output, retention, training use, human review, confidentiality, privilege, citations, and matter-specific restrictions. Review the actual product tier and settings; consumer and enterprise versions can have different contractual and data-use terms.

The ABA Formal Opinion 512 discusses competence, confidentiality, communication, supervision, candor, and fees when lawyers use generative AI. Do not paste client information into a tool merely because another attorney has used the brand. Complete diligence, approve the specific service, configure it, train users, and periodically reassess changes.

People, exposure, testing, and detection

19. Train personnel and exercise high-risk workflows

Provide role-relevant training at onboarding and on a recurring schedule. Cover phishing, MFA prompts, credential theft, wire fraud, secure file sharing, remote work, lost devices, incident reporting, and approved AI use. Give finance teams, administrators, partners, and help-desk personnel scenario-specific exercises.

Use phishing simulations carefully to improve recognition and reporting, not to shame users. Measure reporting rate, repeated failure patterns, time to report, and completion of targeted coaching. Conduct live exercises for wire changes, suspicious login calls, vendor impersonation, and urgent client requests.

20. Continuously manage the firm's external attack surface

Maintain an authoritative list of domains, subdomains, cloud services, public applications, remote-access systems, IP addresses, and third-party-hosted assets associated with the firm. Monitor for exposed services, expired certificates, DNS changes, forgotten systems, leaked credentials, misconfigurations, and newly disclosed vulnerabilities.

Validate every finding before treating it as exploitable, assign ownership, set a deadline, and verify closure. Continuous monitoring shows change between deeper assessments; it does not replace authenticated vulnerability assessment, penetration testing, or secure configuration review. Start with Attorney Armor's free external assessment to see a portion of the public-facing evidence an attacker can collect.

21. Commission independent, scoped penetration testing

Use qualified independent testers to examine realistic attack paths across internet-facing infrastructure, remote access, cloud configuration, internal networks, and client-facing applications as relevant to the firm. Define scope, authorization, testing windows, safety controls, data handling, deliverables, severity method, remediation expectations, and retesting before work begins.

A penetration test is not the same as an automated vulnerability scan. The report should explain validated paths and business impact without creating unnecessary exposure, and the firm should track findings to correction and retest. Use the law firm penetration testing checklist to prepare scope and evidence.

22. Centralize security logs and arrange meaningful detection

Collect and protect logs from identity, email, endpoints, firewalls, remote access, cloud administration, document systems, client portals, and critical applications. Synchronize time, define retention based on investigation and legal needs, restrict log alteration, and alert on events that matter: impossible travel, risky sign-ins, new forwarding rules, privilege changes, malware, unusual downloads, and backup-policy changes.

Ensure someone can evaluate alerts after hours and knows how to escalate. Test detections with controlled events and confirm the record contains enough detail to determine what happened. Logging without review creates storage, not detection.

Response, recovery, insurance, and proof

23. Maintain and exercise an incident response and notification plan

The plan should name an incident commander, decision-makers, technical responders, breach counsel, forensic support, insurer contacts, communications leads, critical vendors, and law-enforcement contacts. Include separate playbooks for mailbox compromise, wire fraud, ransomware, stolen devices, vendor incidents, and unauthorized disclosure.

ABA Formal Opinion 483 addresses lawyers' obligations after a data breach. Notification duties vary by facts and jurisdiction. If the FTC Safeguards Rule applies, review its reporting requirement for certain events involving at least 500 consumers. Firms serving SEC-regulated entities should also understand contractual flow-downs associated with the 2024 Regulation S-P amendments; Regulation S-P applies directly to covered institutions, not law firms generally.

Exercise the plan at least annually and after material changes. Record decisions, timing, evidence-preservation steps, communication drafts, dependencies, and corrective actions. Do not wait for an incident to decide who has authority to take systems offline or notify a client.

24. Test business continuity and technology recovery

Identify the matters, deadlines, trust-account functions, filing systems, communications, and records that must continue during an outage. Document recovery priorities, responsible people, alternate communications, manual procedures, vendor dependencies, recovery time objectives, and acceptable data loss.

Run exercises that assume email, the document system, a primary vendor, or an office is unavailable. Verify contact lists without relying on the unavailable system. Test restored data and the business workflow that depends on it. A technically successful server recovery is not a successful recovery if attorneys still cannot access calendars, deadlines, client contacts, or filing credentials.

25. Align cyber insurance answers with a current evidence library

Review coverage, limits, retentions, sublimits, exclusions, panel requirements, notice provisions, social-engineering coverage, dependent-business-interruption coverage, and prerequisites for using preferred counsel or forensic providers. Answer applications accurately and preserve the evidence supporting each answer.

Maintain a controlled evidence library containing policies, training results, MFA and endpoint coverage, access reviews, vulnerability and penetration-test reports, remediation status, restore-test records, tabletop reports, vendor reviews, insurance documents, and current incident contacts. This same library can support client security questionnaires and leadership oversight. Restrict highly sensitive technical evidence and share it only through an approved process.

What should a law firm fix first?

If several items are incomplete, prioritize by probable consequence rather than checklist order.

• First 7 days: secure email and administrator accounts with strong MFA; lock down suspicious forwarding and legacy authentication; adopt mandatory callback verification for payment changes; verify endpoint and backup coverage; confirm the incident contact list.
• First 30 days: complete the system and vendor inventory; address internet-facing known exploited vulnerabilities; remove stale access; test a real restore; approve an interim AI rule; document the highest-risk gaps and owners.
• First 90 days: approve the written security program; complete an evidence-based risk assessment; review critical vendors; conduct a tabletop exercise; commission appropriate vulnerability assessment or penetration testing; centralize evidence and report unresolved risk to leadership.
• Ongoing: monitor the external attack surface, review access and vendors, train personnel, retest remediation, update the risk assessment after material change, and keep evidence current.

For a small practice, the controls do not disappear; the implementation becomes proportionate. One person may own several roles, a concise policy may be sufficient, and managed services may supply monitoring or testing. The firm should still make conscious decisions and preserve evidence.

Frequently asked questions

What is the most important cybersecurity control for a law firm?

There is no single control that makes a firm secure. Strong MFA on email and administrative accounts blocks many credential-based attacks, while out-of-band payment verification directly addresses wire fraud. Those safeguards should be paired with managed endpoints, tested backups, prompt patching, monitoring, and an exercised response plan.

Does ABA Model Rule 1.6 require a specific security product?

No. Model Rule 1.6(c) requires reasonable efforts to prevent unauthorized access or disclosure, and Comment 18 describes a fact-specific analysis. A product name or certification does not automatically establish reasonableness. The firm should assess sensitivity, threats, safeguards, cost and difficulty, client requirements, and the effect on representation, then document the decision under the controlling jurisdiction's rules.

How often should a law firm review this checklist?

Review high-change operational evidence continuously or monthly, access and unresolved risks at least quarterly, and the full program at least annually. Reassess after a merger, new office, major vendor or AI deployment, significant client requirement, material incident, or major system change. Contractual, insurance, and legal deadlines may require a different cadence.

Is a vulnerability scan the same as a penetration test?

No. A vulnerability scan identifies potential weaknesses, usually through automated checks. A penetration test uses skilled human analysis to validate exploitability and connect weaknesses into realistic attack paths within an authorized scope. Firms often need both: recurring assessment for breadth and periodic penetration testing for depth.

Does the FTC Safeguards Rule apply to every law firm?

No. Coverage depends on the activities the firm performs and whether it falls within the Rule's definition of a financial institution. Firms handling work connected to financial activities should review the FTC's applicability guidance with qualified counsel rather than assuming either coverage or exemption.

How can a law firm prove its cybersecurity program to a client or insurer?

Maintain dated evidence: approved policies, system and vendor inventories, MFA and endpoint coverage reports, access reviews, training results, vulnerability and penetration-test reports, remediation and retest records, backup restore tests, tabletop reports, incident contacts, and risk-acceptance decisions. Share only what the recipient needs through a controlled process.

Authoritative references

• ABA Model Rule 1.1: Competence
• ABA Model Rule 1.6: Confidentiality of Information
• ABA Formal Opinion 477R: Securing Communication of Protected Client Information
• ABA Formal Opinion 483: Lawyers' Obligations After an Electronic Data Breach or Cyberattack
• ABA Formal Opinion 512: Generative Artificial Intelligence Tools
• NIST Cybersecurity Framework 2.0
• NIST CSF 2.0 Small Business Quick-Start Guide
• CISA #StopRansomware Guide
• CISA Known Exploited Vulnerabilities Catalog
• FBI Internet Crime Complaint Center: Business Email Compromise
• FTC Safeguards Rule guidance
• SEC Regulation S-P amendments

How Attorney Armor helps law firms complete the checklist

Attorney Armor turns checklist answers into tested evidence. Our vulnerability assessments identify and prioritize exposed assets, known weaknesses, and configuration gaps. Our penetration testing validates realistic attack paths and retests important remediation.

Between formal reviews, continuous security monitoring watches for meaningful changes in the firm's external attack surface. Security awareness training exercises phishing, impersonation, and payment workflows, while compliance reporting organizes current evidence for leadership, clients, insurers, and applicable obligations.

Start with a free external assessment or contact Attorney Armor to scope a law-firm-specific review. Attorney Armor provides cybersecurity services, not legal advice; firms should confirm legal and ethical requirements with qualified counsel.