Every law firm should require multifactor authentication, give each person a unique account, and limit access to the matters and systems they need. Protect email and managed devices, share client files through approved services, and keep tested backups. Assign an owner to each control, review access when roles change, and confirm the firm can restore critical data before a deadline depends on it.
How should a law firm control access to accounts and matter data?
Give every attorney and employee an individual account. Shared logins hide who viewed or changed a file, complicate investigations, and make it harder to remove access when someone leaves. Use a password manager and require unique passwords for email, document management, billing, practice applications, and client portals.
Require multifactor authentication for email, cloud services, remote access, administrator accounts, and other systems that hold sensitive information. Use phishing-resistant methods when the system supports them. Protect account recovery methods too; an attacker who can reset a password may bypass the protection around the password itself.
Grant access by role and matter. A person should be able to reach the files and tools needed for assigned work, not every client record by default. Review administrator privileges separately, and keep ordinary user accounts from installing software or changing security settings unless their duties require it.
Make onboarding, role changes, and departures part of a documented process. Include email, cloud files, practice systems, remote sessions, client portals, mobile devices, and vendor accounts. Name who approves access and who confirms that it was granted or removed. A checklist prevents a hurried handoff from leaving an old account active.
Review access on a recurring schedule and after a departure, role change, or matter-specific change. Keep a record of what was reviewed, what changed, and who approved exceptions. The record gives the firm a way to spot stale permissions instead of relying on memory.
Review user and administrator access at least quarterly, and sooner when a person's role or matter assignment changes.
For a broader view of the systems that support a legal practice, see technology services for law firms. Access should match the work, and someone should be accountable for checking it.
What protections should cover law firm email and devices?
Email often carries client documents, password reset links, and payment instructions. Configure protection for malicious attachments, unsafe links, impersonation, and spam. Restrict automatic forwarding to external addresses unless the firm has approved a specific business need, and review sign-in activity for unusual access.
For wire instructions, trust-account activity, or a change in payment details, verify the request through a second channel already on file. Do not treat a reply in the same email thread as independent confirmation. Give staff a short procedure for pausing and checking a request so the control works under pressure.
Firm-managed computers and mobile devices should run supported operating systems, receive security updates, use endpoint protection and encryption, and lock when unattended. Apply settings consistently and keep an inventory of devices that can reach firm email or documents. Set clear rules for personal devices, including what firm information may be stored and how access is removed.
Limit local administrator rights and control software installation. If a device is lost, the firm should be able to disable its access promptly and remove firm data where the device is configured to support it. Do not make the response depend on someone returning to the office or remembering every application where the device was signed in.
Controls also need to fit the way people work. GDS Technology customer Harold, in media, described support this way: "Cain responds quickly, knows his stuff, and solves problems fast. He never makes me feel behind on technology." That review does not describe a law-firm security result, but it shows why clear, responsive support matters when a security measure affects someone's ability to work.
Test security settings with the people who use them. If a legitimate task is blocked, fix the process rather than letting staff invent a workaround. Security should make the safe path workable.
For cybersecurity support and planning, see GDS Technology's cybersecurity services. Protect the accounts and devices that people rely on every day.
How can a firm share client files without losing control?
Use an approved client portal or managed file-sharing service for sensitive documents. Share files with named recipients, set an expiration date when appropriate, and avoid public links for confidential material. Before sending, confirm the recipient and matter, especially when names or email addresses look alike.
Decide where the authoritative copy of each matter's files belongs. Attachments in email, local downloads, personal cloud accounts, and duplicate folders can leave staff unsure which version is current or where records should be retained. Give the team a clear route for receiving, reviewing, and returning client materials.
Check external sharing permissions periodically and when a matter closes. Remove access that is no longer needed, but follow the firm's retention and litigation-hold procedures before deleting records. Technology should enforce the firm's records decisions, not make those decisions on its own.
Protect document-management and practice-management systems with role-based access, multifactor authentication where available, audit logging, and secure administrator accounts. Know which provider manages each setting and how to reach support if access needs to be changed quickly. The written policy should describe what the firm actually does.
Pick one sensitive workflow, such as sending a litigation production, and trace who can reach the files, how recipients authenticate, and when access ends. Check the workflow with the staff who handle it. That review can uncover open links or leftover permissions that a broad policy review misses.
- Confirm the recipient and matter before sharing.
- Use the firm's approved portal or managed file-sharing service, with named recipients rather than a public link.
- Set an appropriate access end date and document who owns the shared material.
- When the matter closes, review permissions and remove access that is no longer needed while honoring retention and litigation holds.
For practical guidance on protecting matter information, see GDS Technology's law firm technology resources. Each file-sharing route should have a clear owner and a clear end point.
What backup and recovery controls protect case continuity?
Back up the information and systems the firm needs to keep working, including document repositories, email, practice applications, and relevant configuration data. For each service, confirm what the provider backs up, how long copies remain available, and who can restore them. A provider's general assurance is not a recovery plan for the firm.
Protect backup administration with separate credentials and multifactor authentication. Where supported, keep recovery copies isolated or immutable so an account used for daily work cannot easily alter every copy. Limit who can change retention settings or delete backup data.
Test restores, not just backup job status. Restore representative files or systems, confirm the data is usable, and record the steps and people involved. Include staff who depend on the information so the test checks whether the firm can resume the work, not only whether a system can produce a file.
Set recovery priorities with firm leadership. Identify which systems must return first for client communication, matter access, deadline tracking, and billing. Decide how much recent data the firm can afford to lose and how quickly each system needs to return. Do not assume a vendor's default recovery settings match the firm's needs.
GDS Technology provides data backup and recovery services and disaster recovery planning. A scoped review can help a firm document its current recovery path, identify gaps, and set priorities based on its operations. Learn more about data backup and recovery and disaster recovery planning.
Keep evidence of restore tests and follow up on failures. A backup that has never been restored is an assumption, not a demonstrated recovery capability.
How should a law firm manage vendors and verify its controls?
Keep an inventory of systems that store, transmit, or can access client and case data. For each provider, record the internal business owner, administrator, support contact, data involved, authentication method, and contract or renewal date. Include outsourced IT, cloud platforms, document management, e-discovery, and temporary consultants where they have access.
Before granting vendor access, define the purpose, scope, approver, and end date. Use named accounts rather than shared credentials, require multifactor authentication when available, and supervise privileged work. When the work ends, remove the access path and retain evidence of approval and removal.
Ask vendors how they control access, report incidents, support recovery, and handle firm data when service ends. Keep the answers and supporting documents somewhere the firm can find them during a client review or an incident. Confirm that the contract and the actual service match the firm's expectations.
Assign an owner to each control and retain evidence such as access-review records, update reports, restore-test results, and incident exercise notes. A cybersecurity assessment can help document gaps and prioritize recommendations. It does not replace legal advice or determine whether the firm satisfies every legal, ethical, or contractual obligation.
Choose one workflow, such as onboarding a lateral attorney or sharing a client production, and verify the accounts, devices, vendors, and recovery arrangements it depends on. Then assign gaps to named owners with due dates. Small, tracked corrections reduce the chance that a known weakness remains unresolved.
Good controls are the ones the firm can explain, verify, and maintain as people and matters change.
Frequently Asked Questions
What is the most important cybersecurity control for a law firm?
No single control protects every workflow. Start with individual accounts, multifactor authentication, and least-privilege access because those measures protect email, cloud documents, remote access, and legal applications. Pair them with managed devices, secure file sharing, tested backups, and a response plan. Assign owners and check that the controls work as staff use them.
Does multifactor authentication protect a law firm from account takeover?
Multifactor authentication makes a stolen password less useful, but it does not eliminate account risk. Require it for email, cloud services, remote access, and administrator accounts, using phishing-resistant options where available. Also protect account recovery methods, review sign-in activity, restrict unnecessary forwarding, and train staff to report unexpected authentication prompts instead of approving them.
How often should a law firm test its backups?
Set a recurring restore-test schedule based on the firm's systems and the importance of its data, and test after significant changes. Confirm that restored files open and that responsible staff know the recovery steps. Record results and address failures. A successful backup report alone does not show that usable matter data can be recovered.
What should a law firm do when an attorney leaves?
Use a documented offboarding checklist covering email, cloud files, remote sessions, practice and document systems, client portals, mobile devices, and vendor access. Revoke sessions and credentials, recover firm equipment, and reassign records under firm policy. Coordinate timing with firm leadership so access ends appropriately while active matters and business records remain available.
Can cybersecurity tools make a law firm compliant?
No single tool proves that a law firm meets every legal, ethical, contractual, or client requirement. Tools can support specific safeguards, but the firm remains responsible for its policies, decisions, evidence, and applicable obligations. Use questionnaires and assessments to check actual practice, identify gaps, and assign owners rather than relying on product labels.
