Law firms hold confidential client communications, litigation strategy, financial information, identity data, and privileged system access. A useful checklist assigns owners, evidence, and review dates instead of promising that a product or one-time assessment makes the firm secure.
Current as of 2026-08-15
ABA Formal Opinion 512 addresses competence, confidentiality, communication, supervision, accuracy, and fees when lawyers use generative AI. It does not replace jurisdiction-specific rules or legal advice.
Decision summary
- Assign executive and legal ownership for cybersecurity risk.
- Protect identities, email, endpoints, remote access, and recovery together.
- Apply vendor due diligence to MSPs, cloud services, and AI tools.
- Test incidents and restores with attorneys and business operations.
Govern the information and identities
- Inventory client, matter, financial, HR, and administrative data.
- Classify systems and define retention, legal hold, and secure disposal.
- Use unique accounts, phishing-resistant MFA, least privilege, and timely offboarding.
- Review privileged, vendor, service, and emergency identities.
- Train personnel to report suspicious activity and mistakes quickly.
Harden communication and endpoints
Protect email with domain authentication, filtering, attachment and link controls, and payment-change verification. Keep supported endpoint configurations, EDR, encryption, patching, application control, and mobile management under evidence-based exception handling. Separate ordinary users from administrative tasks.
Prepare for ransomware and data loss
Use CISA’s Cross-Sector Cybersecurity Performance Goals to prioritize baseline safeguards. Maintain protected backups and test restoration of the systems that matter to client service. Exercise incident roles, out-of-band communication, insurance contact, evidence preservation, notification analysis, and client communication.
Control vendors and AI use
Document the services, data, access, subcontractors, notification duties, and exit steps for each critical provider. For AI, define approved accounts and data classes, review terms and permissions, validate output, supervise use, and retain qualified human responsibility. Rules and duties vary, so counsel should evaluate the firm’s jurisdiction and matters.
Next step for your environment
Turn this checklist into a firm-owned control register with one accountable owner, current evidence, due date, exception, and retest schedule per control. If you need a documented baseline before changing production systems, start with an ITECS technology and security assessment.
Record the accountable owner, current baseline, source date, decision, exceptions, acceptance evidence, and review trigger. Test consequential changes in a bounded environment, maintain a rollback path, and verify the real result before closing the work. Product names, model availability, pricing, legal requirements, and security guidance can change; recheck the primary sources whenever the decision is renewed or the environment changes.
Sources and update trigger
Review trigger: Review after material technology, client, vendor, insurance, professional-rule, threat, or incident changes.