For most businesses, a weak IT setup is an operational problem. For a law firm, it can also be a professional responsibility problem. The rules that govern lawyers now speak directly to technology, and a misdirected wire, a lost laptop or a careless use of an AI tool can raise questions about competence and confidentiality, not just downtime.
Here's what the rules actually say, and the practical decisions that follow from them.
What do the ethics rules require?
Three sources do most of the work.
- Competence includes technology. Comment 8 to ABA Model Rule 1.1 says lawyers should keep abreast of "the benefits and risks associated with relevant technology." Most states, including New York, have adopted similar language.
- Confidentiality requires reasonable safeguards. Model Rule 1.6(c) requires reasonable efforts to prevent unauthorised disclosure of client information. ABA Formal Opinion 477R (2017) explains that "reasonable" depends on the sensitivity of the information, the likelihood of disclosure and the cost of safeguards. Routine email may be fine. Highly sensitive matters may call for encryption or a secure portal.
- Generative AI is covered too. ABA Formal Opinion 512 (July 2024) says lawyers must understand the risk of client information being disclosed through AI tools, and that putting client information into a self-learning tool generally requires informed client consent, not boilerplate.
New York has also made this part of training. Since July 2023, New York attorneys must complete at least one CLE credit hour in cybersecurity, privacy and data protection in each biennial cycle.
Six technology decisions that matter most
Alt text: Checklist of six IT controls for law firms: email and wire verification, MFA, document access, encryption, AI policy and offboarding. Image: original graphic created by RDE Technologies for this article. You're free to publish it with the post.
1. Lock down email and verify every wire
Law firms move money: settlements, escrow and real estate closings. That makes them prime targets for business email compromise, which cost victims just over $3 billion in 2025 according to the FBI's Internet Crime Complaint Center. Turn on multi-factor authentication for every mailbox, set up email authentication (SPF, DKIM and DMARC) for your domain, and adopt one non-negotiable rule: any change to wire instructions is confirmed by phone, using a number you already had.
2. Put MFA on everything reachable from outside
Email is the start. Remote access, the practice management system, the document management system and any cloud storage need it too. Prefer an authenticator app to text-message codes.
3. Control who can see which matters
Many firms give everyone access to every file because it's easier. Ethical walls, conflicts and simple need-to-know argue for matter-level permissions in your document management system, with access reviewed when people change teams.
4. Encrypt devices and use a client portal
Full-disk encryption on every laptop turns a lost bag into an inconvenience rather than a reportable event. For sensitive documents, a secure client portal is easier to defend under Opinion 477R than an email attachment.
5. Write an AI policy before staff write their own
People are already using AI tools, approved or not. Decide which tools are permitted, what client information may go into them and how output is checked. Opinion 512 makes the lawyer responsible for the result, including verifying any citations the tool produces.
6. Offboard people properly
When a lawyer or paralegal leaves, accounts should be disabled the same day, mobile access revoked and shared passwords changed. Departures are one of the most common ways firms lose track of who can still reach client files.
What about backups and retention?
Ransomware can hit any firm. Keep at least one backup copy that's offline or immutable, test a restore regularly and know how long it would take to recover your document management system. Check that your retention settings match your file retention policy, so you're not deleting what you must keep or keeping what you've promised to destroy.
Where should a small firm start?
If the list feels long, sequence it by risk. Start with the two controls that stop the most expensive losses: MFA on email and a firm-wide wire verification rule. Both can be in place within a week. Next, encrypt every laptop and tidy up document permissions, which mostly takes time rather than money. Then write the AI policy and the offboarding checklist, and put a date in the calendar to review all six each year.
Keep a short record of what you did and when. If a client, insurer or disciplinary body ever asks whether your safeguards were reasonable, a dated one-page summary is a much better answer than a recollection.
Do you need in-house IT?
Rarely, for a small or mid-sized firm. What you need is someone accountable for these controls who can document them when a client, insurer or court asks. Many firms get there with outside IT support for law firms that understands both the technology and the confidentiality obligations behind it. Whoever you choose, ask how they handle wire-fraud prevention, matter-level permissions and AI tools. The answers will tell you whether they understand legal work or just computers.
The bottom line
The ethics rules don't ask lawyers to become IT experts. They ask for reasonable, informed decisions, and for proof you made them. A short written policy, the six controls above and a yearly review will put most firms well ahead of where they are today.
Sources: ABA Model Rules of Professional Conduct 1.1 (Comment 8) and 1.6(c); ABA Formal Opinion 477R (2017); ABA Formal Opinion 512 (2024); New York State CLE Board, Cybersecurity, Privacy and Data Protection FAQs; FBI Internet Crime Complaint Center, 2025 Internet Crime Report.
About the author: Nathan Spitalny is the CEO of RDE Technologies, a managed IT and cybersecurity provider founded in 2009 in Oceanside, New York. His team supports healthcare practices, senior-living facilities and small businesses across New York City and Long Island.
