Cyber Security Services- Securing Fortune 100 companies since 2014
Penetration Testing

Cybersecurity for Law Firms

Law firms hold exactly what attackers want: confidential client information, merger and litigation details, and trust accounts that move money. Professional obligations add pressure. ABA Model Rule 1.6(c) requires reasonable efforts to prevent unauthorized disclosure of client information, and corporate and financial clients increasingly audit their outside counsel’s security. We help firms of every size protect client data and answer those audits with confidence.

How we help law firms

Client security audits and outside counsel guidelines

We help you answer client security questionnaires and meet outside counsel guidelines, and build the policies and evidence clients ask for, such as access controls, encryption, incident response and vendor oversight.

Business email compromise targets real estate closings, settlements and trust account transfers. We harden email and Microsoft 365, set up payment verification procedures and train staff to spot impersonation.

Penetration testing and risk assessments that show where client data is exposed, with reports you can share with clients and insurers.

Ransomware readiness, tested backups and an incident response plan that accounts for client notification duties under ABA Formal Opinion 483.

Fractional security leadership that gives partners a clear security program, budget and reporting without a full-time hire.

How We Work

Discovery

We learn your practice areas, client requirements, systems and who has access to client data.

Penetration testing scoping and rules of engagement

Risk Assessment

We assess your security controls against client expectations, ABA guidance and recognized frameworks.

Penetration testing reconnaissance phase

Testing

We test your network, email and key systems to prove where the real risks are.

Penetration testing exploitation phase

Remediation Roadmap

You receive a prioritized plan that fits a firm's budget and workflow, starting with the controls that protect client data and funds.

Penetration test reporting icon

Ongoing Support

We help you answer client audits, train staff and keep the program current year after year.

Penetration Testing

Protect Your Clients' Confidential Information

Schedule a call to assess your firm's security and prepare for client audits.

Frequently Asked Questions

What are a law firm's cybersecurity obligations?

ABA Model Rule 1.6(c) requires reasonable efforts to prevent unauthorized access to client information, and the duty of competence includes understanding the risks of technology. ABA Formal Opinion 477R addresses securing client communications, and Formal Opinion 483 addresses obligations after a data breach. State breach laws and client contracts add further requirements.

Corporate, financial and healthcare clients are responsible for their own data even when it sits with outside counsel, so they assess their law firms the same way they assess other vendors.

Strong email security and multi-factor authentication, alerts for suspicious mailbox rules, and a firm rule that payment instructions are always verified by phone using a known number, never by replying to an email.

Yes. We work with firms of every size and prioritize the controls that give a small firm the most protection for its budget.

It depends on the size of the firm and the services you need, from a single assessment to ongoing vCISO support. We provide a fixed quote after a free scoping call.

Reviewed by Matt Santill, CISSP, founder of Cyber Security Services and an original contributor to the NIST Cybersecurity Framework. Last updated .