What a law firm's IT has to handle
Most firms run on a short list of systems that all have to work at once: a document management system or shared file store, email, a practice management and billing platform, e-filing portals, video for remote hearings and depositions, and phones. When one of them stops, billable work stops with it, and court deadlines do not move because a server did.
Law firms are also attractive targets. They hold deal terms, litigation strategy, medical records in personal injury files, and trust account details. Attackers know that a firm moving settlement funds can be tricked into wiring money to the wrong account, so business email compromise is one of the most common and costly threats a firm faces. Our guide to business email compromise shows how these scams unfold.
- A document system with permissions set per matter, not one shared drive everyone can open
- Email retention that supports litigation holds instead of auto-deleting what you must preserve
- Stable video and audio for remote appearances and depositions
- A firm rule that wire instructions are confirmed by phone at a known number before any money moves
- Remote access for attorneys at home or in court that does not expose the office network
The rules behind law firm IT
There is no single federal security rule for law firms, but the professional obligations are real. In California, Business and Professions Code section 6068(e) requires a lawyer to maintain inviolate the confidence, and at every peril to themselves preserve the secrets, of a client. Since March 2021, the comment to Rule 1.1 on competence has said that a lawyer's duty includes keeping up with the benefits and risks of relevant technology. The American Bar Association says much the same in its formal opinions on securing client communications and responding to data breaches; see our summary of ABA cybersecurity guidance.
Clients add their own layer. Corporate legal departments, insurers and healthcare clients now send outside counsel guidelines that read like security contracts: encrypt this data, enforce multi-factor authentication, report a suspected breach within a set number of hours, destroy files when the matter ends. A firm that receives patient records from a healthcare client may also need to sign a HIPAA business associate agreement. And if a breach exposes personal information, California Civil Code section 1798.82 sets out who must be told.
For most firms, compliance comes down to one question: can you show reasonable safeguards for client files, email and remote access when someone asks? We set up IT so the answer is yes, with the records to back it up.
Ethical walls and need-to-know access
An ethical wall, also called a screen, keeps a lawyer or staff member away from a specific matter, usually because of a lateral hire, a former employer, or a conflict between two clients. The written notice is the easy part. The hard part is technical: making sure the screened person cannot open the matter's files, search results, email folders or billing entries, and being able to show that they never did.
In many small firms, everyone can see everything by default. We set up matter-level permissions in your document system and Microsoft 365, build walls quickly when a conflict appears, and run regular access reviews so departed staff and old matter teams do not keep access they no longer need. Our article on ethical walls for law firms covers the steps in detail.
AI tools, privilege and client data
Generative AI tools are now in most firms, invited or not. The ABA's Formal Opinion 512 (July 2024) says lawyers who use them must protect client confidences, understand how a tool handles what is typed into it, and review the output. In practice that means deciding which tools are approved, using business versions that do not train on your data, and blocking consumer apps that might.
A short written AI policy, matched to how your attorneys actually work, does more than a ban nobody follows. Read more in AI and cybersecurity in law firms.
How GlobeVM supports a law firm
We build on our standard security with the pieces that matter most to legal work: matter-level access control, email security tuned for wire-fraud attempts, secure file sharing with clients and opposing counsel, and backups you can restore to a point in time when a document is overwritten.
When a client sends a security questionnaire, we help you answer it accurately and close the gaps it uncovers. When a filing is due at midnight and something breaks, you reach a person in Los Angeles, often one of the owners, in under 15 minutes.