Legal
Atlanta law firms should require phishing-resistant MFA, a centrally managed password manager, and role-based remote access for 100% of attorneys, staff, contractors, administrators, and third parties who can reach client, matter, billing, or administrative systems. These controls protect confidentiality without creating unnecessary friction for legal work.
What MFA standard should a law firm require?
Require multi-factor authentication for every account that can access firm information, including email, cloud storage, document management systems, practice-management platforms, remote-support tools, accounting, timekeeping, and client portals. Attorney-client privilege and work product can be exposed through a single compromised mailbox, so email should never be treated as a lower-risk exception.
Make phishing-resistant MFA the preferred method for privileged users and high-value systems. Security keys, passkeys, or certificate-based authentication are stronger choices than a password plus a text message because they are designed to resist common credential-phishing attacks. Firm administrators, managing partners, finance personnel, and people with broad Microsoft 365 or document-management access should be first in line.
Do not rely on SMS alone when stronger options are available. Text-message codes can provide a temporary fallback for users who cannot immediately use another method, but the firm should document the exception, assign an expiration date, and move the user to a stronger method promptly.
Require MFA at enrollment, not after an incident. New hires should receive an approved authenticator method before their account is active, while departing employees must lose access through a documented offboarding process. This matters when a firm uses contract attorneys, outsourced bookkeeping, e-discovery providers, or technology vendors.
- Enroll the user in an approved MFA method before activating firm access.
- Record an approved backup method and a process for lost or replaced devices.
- Document any temporary SMS exception, including its owner and expiration date.
- Revoke MFA methods, active sessions, and recovery options during offboarding.
For firms serving Atlanta metro clients while attorneys move between downtown offices, Buckhead meetings, court appearances, client locations, and home offices, MFA must work consistently without encouraging workarounds. Clear enrollment instructions, backup methods, and rapid lost-device support keep security practical.
Baseline requirement: MFA must protect 100% of accounts that can access firm systems or client data.
Takeaway: MFA should be universal, stronger for privileged access, and supported by a practical exception process.
How should attorneys and staff manage passwords?
Require a centrally managed business password manager for every attorney and staff member. It should generate and store long, unique passwords; allow secure sharing without exposing the credential; support access recovery; and give the firm administrative control when someone changes roles or leaves.
Every service needs its own credential. Reusing passwords between Microsoft 365, a legal research platform, a document management system, a court portal, a banking site, or a personal account turns one stolen password into a larger breach. Unique credentials reduce the impact of a vendor compromise or phishing incident.
Shared credentials should be the exception, not the operating model. When a shared account cannot be eliminated, place it in an approved shared vault with named access, MFA protection, an accountable owner, and periodic review. Never distribute credentials in email, chat, spreadsheets, handwritten notes, or an unprotected onboarding document.
Set a clear policy for administrator accounts. IT administrators and designated firm leaders should have separate standard and administrative identities, so routine email and document work does not occur from an account with elevated access. Privileged credentials belong in a restricted vault, limited to people with a documented business need.
Password resets should verify identity without relying on easily researched information. The help desk should use an approved verification process, record unusual requests, and watch for business email compromise attempts in which an attacker impersonates an attorney or executive and pressures staff to reset access quickly.
The goal is not to make users memorize more secrets. It is to make secure behavior easier than insecure behavior. GDS Technology's cybersecurity services can help firms establish password-management controls that remain usable for a busy legal practice and defensible during a client security review.
Takeaway: A managed password manager, unique credentials, and controlled sharing are the minimum standard for firm accounts.
What remote-access controls protect a law firm without disrupting work?
Remote access should be role-based, MFA-protected, encrypted, and limited to the applications and data each person needs. Attorneys need dependable access to matters, calendars, email, secure client portals, and approved collaboration tools. They do not need unrestricted access to every server, network share, or administrative platform.
Use managed firm devices for routine remote work whenever possible. Managed endpoints can receive security updates, encryption, endpoint detection, remote support, and configuration enforcement. If personally owned devices are allowed, establish a written bring-your-own-device policy defining permitted apps, data boundaries, security requirements, and the firm's authority to remove business data when employment ends.
Remote desktop and VPN access should not be exposed broadly to the internet without strong controls. Use an approved remote-access platform, restrict access by user and role, require MFA, keep software patched, log successful and failed access attempts, and remove unused accounts quickly. Review vendor remote access with the same care used for employees.
Separate attorney convenience from administrative privilege. A lawyer working from a hotel, a home office, or a client visit in the Indianapolis metro or Stamford may need a matter file, but that does not justify using a domain administrator account, saving documents locally without safeguards, or bypassing the approved secure workflow.
Mobile devices need controls too. Require screen locks, current operating systems, encryption where supported, and the ability to remove firm data from a lost or departed-user device. Define approved apps for client communication and file transfer so consumer messaging and personal email do not become informal repositories for matter documents.
For a detailed perspective on lingering service access, shared credentials, and turnover risk, listen to GDS Technology's Digital Keys in Building Operations episode. The same ownership and access-review discipline applies to legal technology.
Takeaway: Secure remote access gives lawyers the tools they need while limiting unnecessary paths into firm systems.
How should a law firm govern access for employees, vendors, and office changes?
Build access governance into the employee lifecycle. Before a hire starts, identify the systems required for that role. When responsibilities change, adjust access rather than adding permissions indefinitely. At departure, disable accounts, revoke sessions and MFA methods, recover firm devices, remove shared-vault access, and document completion.
Review access at least quarterly for privileged accounts, finance systems, administrative platforms, shared mailboxes, client portals, and vendor connections. Confirm that each person still needs the access they hold and remove inactive, duplicate, or orphaned accounts. This is a control exercise, not a checkbox.
Third parties require the same discipline. E-discovery consultants, managed print providers, court-reporting partners, building contractors, and software vendors may need temporary access. Give them a named account, narrow permissions, a defined end date, MFA, and an identifiable firm sponsor. Avoid permanent vendor accounts created for a one-time task.
Office moves and suite buildouts across Norcross, Duluth, Buckhead, and the broader Atlanta metro can create hidden access risks. New Wi-Fi, conference-room systems, surveillance, access-control platforms, cabling contractors, and internet providers introduce accounts and equipment that need owners. GDS Technology can coordinate structured cabling and low-voltage services alongside the security requirements that protect the legal operation using them.
Kawal, a professional-services client, described GDS follow-through this way: "GDS followed up the next day to make sure the door sensor issue is resolved. That kind of attention shows real customer service." Access control requires the same approach: resolve the immediate issue, then confirm that the environment remains secure and operational.
Takeaway: Every access path needs an owner, a purpose, an approval, and a removal process.
What should the written policy and response process include?
Write one plain-language access policy covering MFA, password-manager use, approved remote access, personal-device limits, lost-device reporting, secure sharing, prohibited workarounds, and remediation steps. Employees should acknowledge it at onboarding and receive short refreshers when tools or threats change.
Pair the policy with technical enforcement. A policy that says MFA is mandatory but allows unprotected legacy email protocols is incomplete. A policy that says passwords must be unique but gives users no password manager is unrealistic. Technology controls, training, and responsive support must reinforce one another.
Prepare for access incidents before they happen. Document who can disable an account, revoke sign-in sessions, reset passwords, preserve relevant logs, notify leadership, and engage legal counsel. Georgia firms should evaluate applicable breach-notification obligations, client contract requirements, and professional-responsibility duties when an incident affects confidential information.
Backups and recovery planning remain essential because identity compromise can lead to ransomware, destructive changes, or data loss. A firm should know which systems hold matter data, how restoration works, who authorizes recovery, and how the firm will continue serving clients if a core platform is unavailable. Include disaster recovery planning services in the broader access-control program.
GDS Technology serves law firms across the Atlanta metro, the Indianapolis metro, Stamford, and remote environments nationwide. Its managed IT, cybersecurity, and Microsoft 365 services help firms make access requirements enforceable while attorneys and staff keep client work moving.
Takeaway: A written policy works only when enforcement, training, monitoring, and recovery procedures support it.
Frequently Asked Questions
Should every attorney use MFA, even if they only access email and documents?
Yes. Email and document platforms often contain client communications, matter records, billing information, passwords, and password-reset links. Require MFA for every attorney, staff member, contractor, and vendor with access. Use phishing-resistant methods first for administrators, partners, finance users, and people with broad access to firm systems.
Can a law firm allow staff to use personal devices for remote work?
A firm can allow personal devices only under a written, enforced policy. Define approved applications, MFA, device-lock and update requirements, encryption where available, business-data separation, and removal procedures at departure. Managed firm devices remain the stronger default for users who regularly access client files or sensitive administrative systems.
Is a VPN enough to secure remote access for attorneys?
No. A VPN can encrypt a connection, but it does not replace MFA, endpoint management, least-privilege permissions, patching, logging, and access reviews. Secure remote work requires layered controls that verify the user, protect the device, limit reachable resources, and identify suspicious activity before it becomes a client-impacting incident.
How often should a law firm review access permissions?
Review privileged, finance, administrative, shared-mailbox, vendor, and client-portal access at least quarterly. Also review access immediately when an employee changes roles, leaves, or completes a temporary assignment. Regular review removes dormant accounts and excessive permissions before they become an opening for misuse or compromise.
