Cybersecurity for Law Firms: The Controls That Matter Most
/ Key takeaways
- Why law firms are targeted
- The controls that matter most
- Stop payment diversion before it reaches client money
The controls that protect most law firms are multi-factor authentication, prompt patching, a payment-verification step, tested backups and an incident plan that partners have approved. None of them is new. The gap at most firms is that nobody checks they are working.
Why law firms are targeted
Firms hold client names, addresses, banking details and commercially sensitive documents, and they move client money. The Law Society's guidance cites the UK Legal Sector Cyber Threat Report: the Solicitors Regulation Authority published 278 scam alerts between January 2022 and January 2023. In the US, ABA Model Rule 1.6(c) requires reasonable efforts to prevent unauthorised access to client information, which puts security inside a lawyer's professional duties.
The controls that matter most
| Control | What good looks like | How to check it |
|---|---|---|
| Multi-factor authentication | On every account, starting with administrators and email | A report of accounts without MFA should be empty or have named exceptions |
| Patching | Operating systems, browsers and practice software kept current, with known-exploited vulnerabilities fixed first | A patch report showing devices that are behind |
| Administrator rights | Removed from everyday user laptops | A list of who holds admin rights and why |
| Device encryption | Turned on for every laptop | A device report showing encryption status |
| Email security | Filtering, sender authentication and warnings on external mail | A test of how a spoofed message from your own domain is handled |
| Backups | Copies held separately from live systems, with partial and full restores tested | The date and result of the last restore test |
| Incident plan | Contacts, first steps and who decides, approved by the partners | When it was last reviewed or rehearsed |
The US Cybersecurity and Infrastructure Security Agency's guidance for small businesses lists the same priorities: MFA for administrator accounts, patching vulnerabilities in its Known Exploited Vulnerabilities catalogue, tested backups, removing admin rights from user laptops and disk encryption. It also notes that FIDO authentication is the only widely available phishing-resistant method, which is worth considering for partners and finance staff.
Stop payment diversion before it reaches client money
Fraudsters impersonate clients, other firms and suppliers to change bank details on a completion or invoice. Technical controls reduce how many of these messages arrive, but the defence that holds is a verification step outside the email thread: call a number you already hold, not one in the message. The NCSC's business payment fraud guidance covers what to do if a payment has already gone.
Write the step down, tell clients at the start of a matter that you will never change bank details by email, and make sure staff know they will not be criticised for delaying a payment to check it.
Watch for fake IT support calls
Attackers also pose as the firm's own helpdesk to get a password, an MFA approval or remote control of a laptop. Our post on fake IT support calls targeting law firms explains what staff should do during the call and afterwards.
What to ask whoever manages your IT
- Which accounts do not have MFA, and why?
- How many devices are behind on updates today?
- Who has administrator rights?
- When did we last restore a matter folder, and could staff open it?
- Who do we call first if we think we have been breached, including out of hours?
If those answers take more than a day to produce, start there. For a wider view of what your IT support should include, read the law firm IT support checklist or see how BPro approaches IT services for law firms.
/ Article map
Why law firms are targeted
The controls that matter most
Stop payment diversion before it reaches client money
Watch for fake IT support calls
What to ask whoever manages your IT
Sources
Frequently Asked Questions
What are the most important cybersecurity controls for a law firm?
Multi-factor authentication on every account, prompt patching, removing admin rights from user laptops, device encryption, email security, tested backups, a payment-verification step and an approved incident plan.
Are law firms required to have cybersecurity measures?
In the US, ABA Model Rule 1.6(c) requires reasonable efforts to prevent unauthorised access to client information, and state rules apply. In England and Wales, data protection law and SRA requirements apply. Your firm and its advisers decide exactly which obligations apply.
How can a law firm prevent payment diversion fraud?
Verify any change to bank details through a contact you already hold, never through the message requesting the change. Tell clients at the start of a matter that bank details will not change by email, and back this up with email security and MFA.
/ Choose the next step
Move from article guidance to a practical review path.
Pick the route that best matches the issue behind the article so the next conversation starts with the right scope.
Security review
Check these controls in your firm
We review access, email, devices, backups and incident contacts, then give you a short list of priorities ranked by risk and effort.