General information only. This post summarizes professional conduct rules and ethics opinions as published when we wrote it. It is general information, not legal or ethics advice. Check the current text of the rules that apply in your jurisdiction.
What do the ethics rules expect from a law firm's IT?
The ABA Model Rules of Professional Conduct set the baseline most firms work from. Comment 8 to Model Rule 1.1 says competent representation includes keeping abreast of the benefits and risks associated with relevant technology. Model Rule 1.6(c) requires a lawyer to make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.
New Jersey has its own version of the confidentiality duty. RPC 1.6(f) uses the same reasonable-efforts language, and in January 2024 the New Jersey Supreme Court pointed to it again in its preliminary guidelines on lawyers' use of artificial intelligence.
Two ABA opinions turn those rules into practical expectations:
- Formal Opinion 477R (2017)says a lawyer may generally send client information over the internet if the lawyer has made reasonable efforts to prevent unauthorized access, and that more sensitive matters may call for stronger measures such as encryption.
- Formal Opinion 483 (2018)covers what happens after a data breach or cyberattack. It says lawyers must act reasonably and promptly to stop a breach and limit the damage, and must notify current clients when their information is affected.
Neither opinion lists specific products. The test is reasonableness, which depends on how sensitive the information is, how likely a disclosure is without more safeguards, and the cost and difficulty of adding them. That is why a written checklist matters: it shows what you considered and what you did.
The checklist for a small firm
Work through these in order. The first few close the gaps that most often lead to a breach.
1. Multifactor authentication on every account
Turn on MFA for email, the document management system, practice management software, the bank, the court e-filing account and every admin account. Email is the account attackers want most, because it opens password resets for everything else. Use an authenticator app or a hardware key, and avoid text messages where you can.
2. Email security that fits legal work
- Filter inbound mail for phishing and malicious attachments.
- Publish SPF, DKIM and DMARC records for the firm's domain, so criminals have a harder time sending mail that looks like it came from you.
- Set a rule that wire instructions and changes to payment details are always confirmed by phone, using a number you already have on file. Closing funds and settlement payments are a common target.
- Give staff an easy way to send encrypted email for sensitive matters.
3. Encrypted, managed devices
Every laptop and desktop that touches client files should have full-disk encryption (BitLocker on Windows, FileVault on a Mac), automatic screen lock, current patches and endpoint protection. If a laptop is left on the train to Hoboken, encryption is what keeps a lost device from becoming a disclosure. Phones that receive firm email should have a passcode and the ability to be wiped remotely.
4. One place for client files, with permissions that match the matter
Client documents scattered across personal OneDrive folders, desktop copies and USB drives are hard to protect and hard to produce. Pick one system (a legal document management system, or SharePoint set up properly), move files into it, and restrict sensitive matters to the people working on them. Turn off "anyone with the link" sharing, or limit it to approved cases with expiration dates.
5. Backups you have actually restored
Back up the document system, email and practice management data, and keep at least one copy that ransomware on your network cannot reach. Then test it: restore a full matter folder at least once a quarter and time how long it takes. A backup that has never been restored is an assumption.
6. Vendor due diligence
Opinion 477R calls for due diligence on vendors that provide communication technology. In practice, keep a short list of every cloud service that holds client data (document management, billing, e-discovery, e-signature, AI tools) and record for each one where data is stored, whether it is encrypted, who at the vendor can access it, and how you get your data back if you leave.
7. Staff training and supervision
Model Rules 5.1 and 5.3 make supervising lawyers responsible for reasonable measures over the people who work for them, including nonlawyer staff. Run short phishing awareness sessions a few times a year, and make sure paralegals and assistants know the wire-confirmation rule as well as the partners do.
8. A written incident response plan
Write down who to call if an account is compromised or files are encrypted: your IT provider, your cyber insurance carrier, outside counsel for breach response, and the firm's malpractice carrier. Opinion 483 expects prompt action, and a one-page plan saves the first hours that usually get lost.
9. Offboarding on the last day
When a lawyer or staff member leaves, remove access to email, documents and practice software the same day, collect firm devices, and change any shared passwords they knew.
Watch shared passwords. Small firms often share one login for a court system, a research service or the bank. Each shared password is a door you cannot close when someone leaves. Move to individual accounts wherever the service allows it.
What about generative AI tools?
Staff are already pasting text into chat tools. Before that touches client matters, decide which tools are approved, whether they run on business accounts with training on your data turned off, and what may never be entered. The New Jersey Supreme Court's 2024 preliminary guidelines make clear that the existing duties, including confidentiality, apply to AI use. Write that policy down before the first matter goes into a chat window.
How much IT support does a small Bergen County firm need?
A firm of five to fifteen people rarely needs an in-house IT person, but it does need someone who answers when the document system is down the morning of a filing deadline. Kildaris help desk and monitoring starts at $75 per user per month and runs 24x7x365. Patching, backup with restore tests, identity management and cybersecurity are add-ons quoted to your environment. Our Bergen County IT support page covers on-site visits across the county, and the legal industry page covers the systems law firms tend to run.
If you want a second look at your firm's setup against this list, book a free 30-minute call. We will tell you which items to fix first.