ABA Model Rule 1.6 and cybersecurity
ABA Model Rule 1.6(c) requires lawyers to "make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client." This is not a suggested best practice — it is a professional obligation with disciplinary consequences.
ABA Formal Opinion 477R (2017) specifically addressed cybersecurity in the context of Rule 1.6, stating that lawyers must "take competent and reasonable measures to safeguard information relating to clients." The opinion explicitly mentions that the duty applies to password protection and access controls for devices, systems, and communications used in the representation.
In practical terms: if your credentials are compromised and client confidential information is exposed as a result, you have a potential Rule 1.6 violation and must notify the affected client. The standard for "reasonable efforts" rises with the sensitivity of the matter and the capability of available technology. Using weak passwords or no MFA when both are easily available is increasingly difficult to characterise as reasonable.
State bar cybersecurity requirements
Several states have gone beyond the ABA model rules to create explicit cybersecurity obligations for attorneys:
- California: The State Bar's cybersecurity guidance references NIST standards and explicitly recommends MFA, strong passwords, and password managers as components of a reasonable security program
- New York: Ethics opinions have stated that attorneys storing client data in cloud services must implement safeguards including strong authentication
- Florida: The Florida Bar's ethics guidance references password security and encryption for client communications
- Texas: The State Bar's cybersecurity guidance for attorneys includes specific password recommendations aligned with NIST 800-63B
Check your state bar's ethics opinions and cybersecurity guidance — the landscape has evolved quickly and state-specific requirements may exceed the ABA baseline.
What's actually at risk
A compromised law firm credential is uniquely valuable to attackers because of the breadth of sensitive information involved:
- Business email compromise: Law firms routinely handle large trust account transfers, real estate transactions, and corporate deals. A compromised email account can redirect wire transfers. The FBI reports that law firms are among the top BEC targets precisely because of high-value transactions.
- Client confidential information: Litigation strategy, M&A negotiations, pending intellectual property filings, personal injury settlements — information that opposing parties, competitors, or adversaries would pay to obtain.
- Privilege: Exposure of privileged communications can have consequences beyond the immediate security incident — potential waiver of attorney-client privilege in the matter.
- Ransomware: Law firms have been disproportionately targeted by ransomware operators who combine encryption with exfiltration threats. The threat of publishing confidential client information creates payment pressure beyond the immediate access loss.
Password standards for law firms
Based on ABA guidance, NIST 800-63B, and common state bar ethics opinions, the following represent reasonable and defensible password standards for legal practice:
Password managers for attorneys
A password manager satisfies multiple obligations simultaneously: it enables unique strong passwords for every system (Rule 1.6 reasonable safeguards), provides audit logs of credential access (relevant to ethics investigations), and handles the key management challenge of attorney-client privilege in stored credentials.
For law firms specifically, consider:
- 1Password Business: The most common choice for law firms. Shared vaults allow matter-specific or practice-group credential sharing. Admin policies can enforce password strength requirements. Audit logs satisfy ethics investigation requirements. US-based data storage available. 1Password Business →
- Bitwarden Teams: Open-source, self-hosted option. Suitable for firms with IT capacity to run on-premises infrastructure who want maximum data control. Bitwarden Teams →
Solo practitioners and small firms with limited budget: Bitwarden's free individual tier is a significant improvement over no password manager. The paid tiers add features useful for firm-level management but the core functionality of generating and storing unique passwords is available at no cost.
Client portal and cloud security
The shift to cloud-based practice management — Clio, MyCase, PracticePanther, NetDocuments, iManage — has made credential security central to legal cybersecurity obligations. These platforms hold client communications, documents, and billing information in cloud storage. The security of that data depends on the strength of the credentials protecting access.
- Every attorney and staff member should have individually provisioned credentials — no shared logins even on client portal platforms
- Verify that your practice management platforms support MFA and enable it — this should be a firm-wide requirement, not opt-in
- Review the data handling agreements with your cloud platforms — ABA Formal Opinion 477R requires that attorneys "take reasonable care to avoid disclosure of confidential information" when using cloud providers, which includes verifying the provider's security practices
- Ensure client-facing portal credentials (where clients log in to view documents) are not shared by multiple clients — each client should have individual credentials
MFA implementation for legal
MFA is the most effective single control against business email compromise — the leading cause of financial loss in law firm security incidents. Implementation priorities:
- Firm email — highest priority: Enable mandatory MFA on Microsoft 365 or Google Workspace at the tenant level. Use Conditional Access policies to require MFA for all users, including partners.
- Trust and IOLTA accounts: Contact your bank about MFA options for online banking access. If your bank does not offer hardware token MFA for business banking, consider whether your banking relationship meets the standard of reasonable security.
- Practice management software: Enable MFA in all matter management and document management platforms.
- Remote access (VPN, RDP): Any remote access to firm systems requires MFA without exception.
For MFA method selection: TOTP authenticator apps (Authy, Google Authenticator) are the minimum. For trust accounts, banking, and managing partner access, hardware keys (YubiKey) provide phishing-resistant authentication that eliminates the push fatigue and SIM swap risks of other methods.
Secure remote and travel access
Attorneys frequently work from courts, client offices, airports, and home. Each environment introduces credential risks that office-based work does not:
- Public WiFi: Never access client systems on public WiFi without a VPN. Even with a VPN, be aware of shoulder surfing when entering credentials in public spaces.
- Hotel WiFi: Treat hotel networks as hostile. Use cellular data or a personal hotspot for sensitive work.
- Client office networks: Visiting a client's office does not mean their network is secure. Use VPN regardless.
- Shared or firm-provided devices at court: If using a device not under your personal control, sign out of all accounts and clear session data before returning the device.
- Travel abroad: Some jurisdictions actively monitor network traffic. For travel to high-risk destinations, consider whether sensitive client matters should be accessed at all on that trip.
Third-party vendor due diligence
ABA Formal Opinion 477R notes that attorneys may have obligations regarding the security practices of vendors who handle client information. For credential-related due diligence:
- Ask vendors about their authentication requirements for staff who access your client data
- Verify that vendor portals you use to share client documents require MFA
- Include security requirements in vendor contracts — minimum password standards, MFA requirements, breach notification timelines
- Review vendor SOC 2 Type II reports or equivalent security certifications annually