IT Security for Law Firms: Confidentiality Is a Professional Obligation

A law firm's IT obligations differ from an ordinary business in one fundamental way: confidentiality is not merely a commercial expectation but a professional duty, with rules of professional conduct behind it. A breach is not only a business problem; it is potentially a regulatory one.

Three things follow from that, and they shape everything.

1. Clients now audit their law firms

Corporate clients — particularly in finance, healthcare and technology — send outside counsel guidelines with security requirements, and increasingly audit against them. Firms are asked for:

• evidence of encryption at rest and in transit
• multi-factor authentication across all remote access
• documented incident response with notification commitments
• background checks on staff with matter access
• restrictions on offshore access and subcontracting
• sometimes a SOC 2 report, or a completed security questionnaire

This has changed the economics. Security is no longer purely a risk-reduction cost; it is a condition of being engaged by certain clients. Firms that cannot answer the questionnaire lose the work.

If you take nothing else from this: ask your largest clients for their outside counsel guidelines and read the security section. It is the most accurate requirements document you will get.

2. Access control has to reflect ethical walls

Most businesses can run on "staff see company data". A firm cannot. Conflict screens and ethical walls are professional requirements, and they must be enforced technically, not just by instruction.

What that means practically:

• Matter-level access control in the document management system, not merely firm-wide folders
• Screens applied in the system, so a screened individual cannot open the file, rather than being told not to
• Audit logs that record who accessed which matter and when, retained and reviewable
• Email handled too — screens that cover documents but not mailboxes are incomplete
• A process tied to conflicts checking, so a screen is applied when the conflict is identified

The common gap is a firm with careful conflicts procedures and a file share where everything is visible to everyone. The procedure is sound; the enforcement is not.

3. Retention runs for decades, and deletion is a decision

Client files must be retained for long periods, varying by jurisdiction, matter type and the firm's own engagement terms. Some materials — wills, deeds, trust documents — are kept effectively indefinitely.

That creates specific problems:

• Media and format obsolescence. Files stored on media nobody can read, or in formats nothing opens. Migrate forward deliberately, on a schedule.
• Retention and destruction policy must exist, be followed, and be documented. Ad hoc deletion by whoever needed disk space is indefensible if it is ever examined.
• Client property must be returnable. The file belongs to the client; you need to be able to produce it.
• Departing lawyers and matter transfers need a process that transfers files properly and records that it happened.

The controls that matter most

Email security. Business email compromise is the dominant threat to firms, and the specific scenario is wire fraud: an attacker in a mailbox watching a real estate or settlement transaction, then sending fraudulent payment instructions at exactly the right moment.

Controls: MFA everywhere, email authentication (SPF, DKIM, DMARC) properly configured, external-sender warnings, and — most importantly — a verbal verification procedure for any change to payment instructions, using a number from your records rather than one in the email. That last control stops the attack even when everything technical has failed.

Encryption. At rest on every device and server, in transit for everything. Laptops and portable media especially — a lost unencrypted laptop with client files is a notification event.

Secure file exchange with clients. Email attachments are the default and the weakest option. A client portal or secure transfer service, used consistently, removes a large category of risk and is something clients increasingly expect.

Mobile. Lawyers read matter email on personal phones. App protection policies secure the data without managing the device, and allow selective wipe when someone leaves.

Remote and travel access. Court appearances, client sites, hotels. Conditional access requiring a managed device, plus the assumption that any network is hostile.

Backup and recovery, tested. A firm that cannot access matter files cannot practise. Immutable backups, offsite copies, and a restore test you have actually performed.

Where firms most often fall short

• Shared logins, particularly for support staff and for practice management systems
• Former staff with active accounts, months after departure
• No audit logging, so a question about who accessed a matter cannot be answered
• Unencrypted laptops, especially personal machines used for firm work
• File shares with no matter-level permissions, undermining the conflicts process
• No tested incident response, despite notification obligations with short clocks
• Vendors without appropriate agreements — e-discovery providers, transcription services, cloud storage, the IT provider itself

A reasonable sequence

1. Get the outside counsel guidelines from your largest clients and treat them as the requirements.
2. Fix MFA and email authentication first — that is where the active losses occur.
3. Implement the verbal verification procedure for payment instruction changes, and train everyone on it this week. It is free and it stops the most expensive attack.
4. Audit access: who can see which matters, and does it match the conflicts position.
5. Confirm encryption at rest everywhere.
6. Write and test the incident response plan.
7. Review vendor agreements for confidentiality and security terms.
8. Build the retention and destruction schedule, and migrate at-risk formats.

The firms that handle this well tend to treat it as an extension of professional responsibility rather than an IT project — which is also the framing that gets partner attention, because it is the accurate one.