Law Firm IT Checklist: Ethics Rules and Security Basics

A small law firm’s IT has one job beyond keeping the computers running: protecting confidential client information in a way you could explain to the State Bar. California’s Rule 1.1 expects lawyers to understand the benefits and risks of the technology they use, and State Bar ethics opinions spell out what reasonable care looks like. In practice that means multi-factor sign-in, encrypted devices that can be wiped remotely, tested backups, controlled access to matter files, and a written plan for a data breach.

This guide covers the software law firms typically run, what the rules say in technical terms, the risks that matter most, and a checklist you can copy. It is IT guidance, not legal or ethics advice. For a shorter overview of the services involved, see our law and accounting firms page.

What software does a small law firm actually run?

Most small firms rely on five or six systems. Knowing which ones hold client information tells you what has to be secured and backed up.

System	Common products	What to check
Practice management (matters, calendar, time, billing)	Clio Manage, MyCase, Smokeball, PracticePanther	Every user has their own login with multi-factor authentication; matter permissions are set; you know how to export your data
Document management	NetDocuments, iManage, or SharePoint and OneDrive in Microsoft 365	Who can open which matters, version history, and what happens to files when someone leaves
Email and calendar	Microsoft 365 or Google Workspace	Multi-factor authentication for every mailbox, no automatic forwarding to outside addresses, retention settings
Accounting and trust accounting	QuickBooks, or the billing module in the practice management system	Who can change payee or bank details, and how those changes are confirmed
E-signature, client portal, e-filing	Varies by firm and by court	Shared logins, and old accounts for former staff
Older server-based software	Tabs3, Time Matters, or a Windows file server	Whether the server is still supported, patched, and backed up somewhere off site

Cloud products move the server out of your office, but they do not move the responsibility. The account settings, the user list, and the devices that sign in are still yours to manage.

What do the ethics rules require from a firm’s technology?

None of the rules name a product or a setting. They set a standard of reasonable care and leave the details to you. That is why it helps to read what the opinions actually say.

ABA Model Rules 1.1 and 1.6(c)

Comment 8 to ABA Model Rule 1.1 says competence includes keeping up with “the benefits and risks associated with relevant technology.” Model Rule 1.6(c) requires reasonable efforts to prevent unauthorized access to, or disclosure of, information relating to a representation. The Model Rules are a template. California lawyers are bound by California’s own rules, covered next.

California Rules 1.1 and 1.6

California added the same technology language to its competence rule. Comment [1] to Rule 1.1, effective March 22, 2021, says the duty of competence includes keeping abreast of “the benefits and risks associated with relevant technology.”

California’s Rule 1.6 is worded differently from the ABA version. It has no paragraph (c). Instead it ties confidentiality to Business and Professions Code section 6068(e)(1), and the State Bar’s ethics opinions read that duty, together with Rule 1.1, as requiring reasonable steps to secure electronic client information.

State Bar of California formal opinions

The State Bar keeps a list of its ethics opinions related to technology. These opinions are advisory, not binding, but they are the clearest statement of what the Bar considers reasonable. Four matter most for day-to-day IT:

• Formal Opinion 2010-179 (confidentiality and technology). Before using a technology to send or store client information, evaluate six things: its level of security and whether reasonable precautions can improve it, the legal consequences for someone who intercepts the information, how sensitive the information is, the impact on the client if it is disclosed, the urgency of the situation, and the client’s instructions and circumstances. The opinion’s example is a lawyer using a laptop on public and home Wi-Fi.
• Formal Opinion 2012-184 (virtual law office). A firm may run entirely on cloud services, with the same duties as any other firm. A lawyer who cannot assess a vendor’s security should consult someone who can, such as an IT consultant.
• Formal Opinion 2020-203 (data breaches). Lawyers must assess the risks of keeping client data on electronic devices and take reasonable steps to secure their systems. After a breach, they must make a reasonable inquiry into what happened and notify any client whose interests have a reasonable possibility of being negatively affected. The opinion also says firms should consider whether the supervision rule (Rule 5.1) requires them to prepare a data breach response plan, and notes that such a plan may be required. Its examples are worth reading. The lawyer whose stolen laptop had biometric sign-in and could be located, locked, and wiped remotely comes out far better than the lawyer with a four-character phone passcode and no way to wipe the phone.
• Formal Opinion 2023-208 (working remotely). Remote work does not change a lawyer’s duties. Managing lawyers must put reasonable policies in place. The examples include separate computer accounts for household members, two-factor authentication, strong passwords, automatic screen locking, and switching off the listening features of smart speakers where client matters are discussed.

The State Bar also publishes practical guidance on generative AI, first issued in November 2023 and revised in May 2026. It is linked from the Bar’s ethics and technology resources page. The short version for IT purposes: know where an AI tool sends what you type before anyone pastes client information into it.

ABA Formal Opinions 477R and 498

ABA Formal Opinion 477R (2017) addresses sending client information over the internet. Its position is that unencrypted email is often reasonable for routine matters, but particularly sensitive information, a client’s instructions, or a legal requirement can justify stronger protection such as encryption or a secure portal. It lists seven considerations, including understanding how client information is transmitted and where it is stored, training lawyers and staff, and doing due diligence on vendors.

ABA Formal Opinion 498 (March 10, 2021) covers virtual practice and is the most concrete of the group. It points to security updates, strong passwords, antivirus software, encryption, secure routers, and virtual private networks (VPNs, which encrypt the connection between a device and the office or the internet). It says data must be backed up regularly with secure access to the backup. It says firms should have a data breach policy and a plan for telling affected clients. And it says a bring-your-own-device policy should make sure a lost or stolen device can be wiped remotely.

What are the main technology risks for a law firm?

1. A taken-over email account. Email contains reset links for nearly every other system, plus years of client correspondence. Multi-factor authentication (MFA), meaning a second proof of identity such as an app prompt in addition to the password, is the main defense. Our post on why multi-factor authentication matters explains the options.
2. Wire and payment fraud. Settlement funds, retainers, and trust account transfers make firms a target for business email compromise, where a criminal impersonates a client, a partner, or opposing counsel and sends changed payment instructions. The fix is a process: confirm any new or changed payment details through a separate channel you already trust, never by replying to the email.
3. Lost or stolen devices. A laptop with an unencrypted drive is readable by anyone who removes the drive. BitLocker on Windows and FileVault on Mac encrypt the drive, and a device management tool can wipe a missing laptop or phone.
4. Ransomware and data loss. A backup only counts if you have restored from it. Our business data backup guide explains the 3-2-1 approach. Cloud practice management data deserves its own export or backup plan too.
5. Access that outlives the job. Former staff accounts, shared logins, and a drive where everyone can open every matter make it hard to show who saw what. A written onboarding and offboarding process closes this gap.
6. Unsupported systems. Windows 10 support ended on October 14, 2025, and old servers and old versions of desktop software stop receiving security fixes as well. See our Windows 10 end of life guide for the options.

A law firm IT checklist you can copy

Accounts and email

• Every person has their own login to every system. No shared passwords.
• MFA is on for email, practice management, document management, banking, and remote access.
• A business password manager holds firm credentials, including court and e-filing logins.
• Automatic forwarding of email to outside addresses is blocked.
• The firm’s domain has SPF, DKIM, and DMARC records. These are the settings that let receiving mail servers verify that a message really came from your domain.

Devices

• Every laptop and desktop has full-disk encryption turned on, and the recovery keys are stored somewhere safe.
• Phones and tablets that receive firm email have a passcode and can be wiped remotely.
• Operating systems and applications update automatically, and nothing in use is out of support.
• Screens lock after a few minutes of inactivity.
• Computers used at home have a separate account for firm work.

Files and backups

• Matter files live in the document system, not on individual desktops.
• Permissions match who actually needs each matter or practice area.
• Backups run automatically, one copy is kept off site, and a test restore is done on a schedule with the date written down.
• There is a way to get your data out of each cloud system if you ever need to.
• Old computers, drives, and copiers are wiped or destroyed before disposal.

Policies and people

• A written data breach response plan names who does what, including who decides on client notification.
• Changed payment instructions are always confirmed through a separate, known channel.
• A written remote work and personal device policy covers the points in Opinion 2023-208 and ABA 498.
• Staff get short phishing training at least once a year.
• There is a list of vendors that hold client information, with a note on what each one holds.
• The firm has decided which AI tools may be used with client information, and staff know the answer.

What a smaller firm can reasonably skip

The standard is reasonable care for your situation, so the right setup for a solo is smaller than the right setup for a 20-person firm.

If you run a cloud practice management system and Microsoft 365 or Google Workspace, you probably do not need an office server, and without a server you may not need a VPN into the office at all. You do not need enterprise security monitoring to satisfy the opinions above. You do need the basics done completely: MFA everywhere, encrypted and up-to-date devices, a tested backup, and a short written plan.

Not every message has to be encrypted, either. Opinion 477R accepts ordinary email for routine matters. It makes sense to have an encrypted option ready for the sensitive ones, and our guide to email encryption for small businesses compares the choices.

Common mistakes

• Treating a cloud subscription as the security plan. The vendor secures its platform. You control who signs in, from what device, and with what permissions.
• Turning on MFA for email but not for the practice management system, or the other way around.
• Relying on a sync folder as a backup. Sync copies deletions and ransomware damage along with everything else.
• Leaving a departed employee’s mailbox and logins active because someone might need the email later. Convert the mailbox or export it, then close the account.
• Writing a breach plan once and never checking that the names and steps in it still apply.

Questions to ask any IT provider

1. How will you handle access to our systems, and will you sign a confidentiality agreement?
2. Will every person at the firm, and everyone on your side, have an individual login with MFA?
3. How are our backups tested, how often, and can we see the result?
4. What happens when a laptop or phone is lost? Walk us through the steps.
5. What is your process when someone joins or leaves the firm?
6. Will we receive written documentation of our setup, and do we own it?
7. How do you schedule maintenance around trial dates and filing deadlines?
8. If we stop working together, how do we get our passwords, documentation, and administrator access back?

A good answer is specific and in writing. These questions work just as well for reviewing your current arrangement as for choosing a new one.

Common questions

Does California require law firms to encrypt email?

No rule requires encryption for every message. State Bar Formal Opinion 2010-179 asks lawyers to weigh the sensitivity of the information, the security of the technology, and the client’s instructions. ABA Formal Opinion 477R reaches a similar result: routine email is generally acceptable, while highly sensitive information may need encryption or a secure client portal.

Can a law firm keep client files in the cloud?

Yes. State Bar Formal Opinion 2012-184 accepts a fully cloud-based practice, and ABA Formal Opinion 498 says to choose a reputable provider and take reasonable steps to keep client information confidential and accessible. In practice that means reviewing the vendor’s security and terms, turning on MFA, managing permissions, and knowing how to export your data.

Do we have to tell clients about a data breach?

Under State Bar Formal Opinion 2020-203, a lawyer must notify any client whose interests have a reasonable possibility of being negatively affected by the breach. Separately, California Civil Code section 1798.82 requires businesses to notify California residents whose unencrypted personal information was acquired, and to send a sample notice to the Attorney General when more than 500 residents are affected. Our guide on what to do after a data breach covers the first steps.

Does a solo attorney need a written security plan?

Opinion 2020-203 says firms should consider whether the supervision rule requires a breach response plan, and ABA Formal Opinion 498 says lawyers should have a data breach policy. Neither sets a size cutoff. For a solo, this can be two pages: what systems you have, how they are protected, who to contact, and how you would decide whether clients need to be told.

How Coastal Growth Co. can help

Coastal Growth Co. provides IT support for small businesses across Orange County, including law firms. We can review your setup against the checklist above, put the technical items in place (MFA, device encryption and remote wipe, backups with test restores, permissions, and offboarding), and write down what was done so you have a record. Ethics questions stay with you and your counsel. The scope and price are agreed before any paid work starts. See our managed IT support page for how ongoing help works, or contact us to talk through your firm’s setup.