⚡ Limited Availability — Accepting 3–4 New Clients This Quarter  |  Schedule Your Free Risk Review →

Legal · Free Resource

Legal IT Security Checklist

12 controls built around NY Rule of Professional Conduct 1.6 and ABA cybersecurity guidance — for firms that can't afford a confidentiality breach. Save this page or print it (Ctrl/Cmd+P).

1
Confidentiality
Client files encrypted at rest
Case files, DMS storage, and backups — encrypted, not just access-restricted.
2
Access
Multi-factor authentication on every attorney email account
Email is the single most common entry point for a confidentiality breach at a law firm.
3
Confidentiality
No client-confidential data on personal devices or personal email
A direct Rule 1.6 exposure the moment case material leaves firm-managed systems.
4
Confidentiality
Secure client portal for document exchange
Sensitive documents belong in an encrypted portal, not as email attachments.
5
Fraud prevention
Phone verification required for any wire or payment-instruction change
The single highest-dollar risk at firms handling real estate or escrow — a callback to a known number, every time, no exceptions.
6
Access
Secure remote access (VPN or equivalent) for attorneys working outside the office
Open Wi-Fi at a courthouse or coffee shop is not an acceptable substitute.
7
Continuity
Backup and disaster recovery plan covering case files and calendaring
A missed filing deadline from lost data is its own malpractice exposure, separate from the breach itself.
8
Vendor risk
Data-handling terms reviewed for every practice management / e-discovery vendor
Know where client data actually lives and who else can access it before you sign.
9
People
Security awareness training for all staff, including phishing simulation
The firm's own testimonial on this page: 4 of 8 attorneys clicked a simulated credential-harvesting link before training began.
10
Response
Written incident response plan naming who does what
Decided in advance, not improvised during an active ransomware event.
11
Insurance
Cyber insurance policy checked against actual controls in place
Many policies require MFA and tested backups to pay a claim — find out before you need to file one, not after.
12
Access
Same-day offboarding checklist for departing staff
Access to case systems revoked the day someone leaves, not whenever IT gets to it.

Score Yourself

10–12 checked Strong postureMinor gaps — worth a second look, not an emergency.
6–9 checked Moderate exposureReal gaps — plan to close these this quarter.
0–5 checked High riskAct now — this is the profile of a firm a wire-fraud attempt or confidentiality breach would go badly for.

This page is yours to keep — bookmark it, print it, or share it with your partners.

Free Consultation

Want Wlad to Score This For You?

Book a free 30-minute Risk Review. Wlad will walk your actual environment against this exact checklist and give you a written report within 24 hours — at no charge.

Schedule My Free Risk Review →

Questions first? Send us a message or call (516) 734-1515