The legal profession has become a primary target for cyber-criminals, not because firms are poorly defended, but because the data they hold is uniquely valuable. M&A deals, litigation strategy, trust-account information, and privileged client records are exactly what attackers monetize best. Here is what "reasonable efforts" looks like in 2026.
01The ethics rules have caught up.
ABA Formal Opinion 477R, updated guidance on competence (Model Rule 1.1), and parallel Florida Bar opinions now explicitly require lawyers to take reasonable steps to protect client information, including technological competence. "I'm not a technology person" is no longer a defensible position.
What counts as "reasonable" is not defined as a single checklist. But there is now a clear consensus from insurance carriers, regulators, and bar associations about the baseline controls a competent practice should have in place.
02The 2026 law-firm baseline.
The same core controls that define a modern managed-IT program map directly onto the legal-ethics baseline. Treat this as the minimum, anything above depends on firm size, practice areas, and client contractual obligations.
- MFA on every system, M365, DMS, VPN, time-and-billing, banking
- EDR with a monitored SOC on every endpoint
- Immutable, tested backups of email and DMS data
- Encrypted laptops and mobile devices (BitLocker, FileVault, MDM)
- Email security (Defender or equivalent) with anti-impersonation
- Quarterly phishing simulation and training
- Written incident response plan and client-notification protocol
- Annual third-party risk assessment
03Ethical walls and matter-level access.
Conflict-of-interest walls in the DMS are a technical problem with an ethical blast radius. Every firm should be able to demonstrate that a walled-off matter cannot be accessed, by search, by directory browsing, or by accidental link, from the barred user.
Modern DMS platforms (iManage, NetDocuments, Clio Manage) all support this, but most firms haven't configured it properly. An annual conflict-wall audit, conducted by IT alongside the ethics or conflicts partner, is a best practice we bake into our legal-client program.
04Client security questionnaires are now normal.
Corporate clients, especially in finance, healthcare, and technology, increasingly send vendor security questionnaires, sometimes 100+ questions, before opening a new matter. Firms that can answer these quickly and accurately win the work. Firms that can't, lose it.
We maintain a living security-attestation document for every law-firm client, updated quarterly, formatted to SIG Lite and CAIQ, and ready to paste into the next questionnaire that arrives.
05Trust accounting and wire-fraud defense.
Real-estate and transactional practices are prime targets for wire-fraud schemes. A dual-control policy on outbound wires, a call-back verification requirement, and email-rule monitoring to detect inbox-rule manipulation (a common attacker post-compromise move) are table stakes at this point.
The incidents we've seen all look alike: compromised paralegal mailbox, attacker inserts a rule to hide replies, attacker emails a fake wiring instruction to the closing agent. A 60-second phone-call verification would have stopped every one of them.
Greenwire serves roughly a dozen Naples, Bonita Springs, and Fort Myers law firms, from 6-attorney plaintiff shops to 40-attorney full-service practices. The program is priced per-attorney, scoped around the DMS you already use (iManage, NetDocuments, Clio), and co-managed with your office administrator.