Most law firms do not get breached because they got unlucky. They get breached because a predictable gap existed: a forgotten MFA enrollment, an unpatched test laptop, or a vendor portal password that has not changed since 2019. Attackers know exactly how small firms are built, and they only need one gap.
This checklist therefore walks through the ten controls that separate firms that survive incidents from firms that lose clients over them. We work with law practices across South Florida and these are the items that come up in nearly every security review alongside common productivity gaps you can explore in the BTX App Store.
Quick takeaways
- Attackers target small firms specifically because they assume weak defenses: prove them wrong with the basics below.
- MFA and patching close the largest share of real-world breaches, and neither requires enterprise budget.
- Backups only count if you have tested a restore in the last quarter.
- Email compromise is the top financial threat to legal practices, ahead of ransomware.
- Your insurance policy is part of your security program: most cyber policies now define the minimum controls you must maintain.
Why law firms are a deliberate target, not an accidental one
Firms hold exactly what criminals monetize: client correspondence, transaction data, settlement figures, and privileged strategy. Add the reality that many small firms operate lean IT without formal vendor management, and the economics are obvious. You do not need to be the biggest firm in the market to be the easiest one on the block.
There is also an obligation layer. The ABA's position on technology competence expects counsel to understand the risks of the tools they use. Clients increasingly send security questionnaires before engagement. The checklist below is simultaneously your defense posture and your answer both audiences.
1. Multifactor authentication everywhere it counts
Start with email, remote access, the practice management system, your document repository, and domain registrar. Prefer app-based factors over SMS where possible. This is a twenty-minute change with the single highest breach-prevention return of anything on this list.
2. A patch and update policy that is actually enforced
Patching is not optional maintenance, it is a security control. Auto-updates should be on for operating systems, browsers, and office software. An endpoint management platform or a managed IT provider can verify patch state across every device in the firm, including the laptop an associate takes to depositions.
3. Business-class email security, not the free tier
Email remains the primary attack channel against attorneys: forged client emails, spoofed wire instructions, and invoice fraud aimed at closing transactions. Ensure SPF, DKIM, and DMARC are configured, enable external-sender banners, and rehearse a verbal confirmation policy for any wire or payment change. A single intercepted wire instruction can exceed everything else on this list combined.
4. Threat monitoring you don't have to watch yourself
Antivirus alone stopped being a complete answer years ago. Modern endpoint detection watches for behavior, isolates infected machines, and alerts someone who can respond. The important distinction: the monitoring produces action, not another dashboard you will check weekly and then never.
5. The 3-2-1 backup rule with quarterly restore tests
Three copies, two different media, one off-site, then - and this is the step everyone skips - actually restore. Schedule a quarterly restore drill: pick a matter folder and a mailbox and prove you can recover them. Untested backups are a hope, not a plan.
Test restores, not backup reports
Successful backup logs say nothing about recoverability. A restore test catches broken retention settings, silent sync conflicts, and ransomware that quietly corrupted archives days earlier.
6. Access reviews on a calendar
Permissions only grow. departing paralegals, former vendors, and stale service accounts accumulate silently. Cut with a 15-minute quarterly review: who has what, including shared drives, calendars, and the credit card portal. Revoke broadly first and reinstate by request.
7. Device policies for a mobile practice
Firm data now lives on personal laptops and phones. Require disk encryption (a checkbox in Windows and macOS), automatic screen lock, and remote wipe for anything holding client files. Pair it with a four-line written policy: acceptable devices, lost-device reporting, and personal use boundaries.
8. Security training that is short, frequent, and real
Annual compliance videos do not change behavior. Quarterly fifteen-minute sessions with real examples - including law-firm-specific scenarios like fake case-document attachments - measurably reduce clicks. Consider sending simulated phishing and treating clicks as training moments rather than discipline.
9. A written incident response plan on one page
When something happens at 7am on a filing deadline, nobody wants to invent a process. One page: who to call, who decides to disconnect systems, how client notification works, and what your cyber insurer requires in the first 24 hours. Then store it where you can reach it without the network.
10. A documented vendor chain
If your IT provider, document automation vendor, or e-signature service has access to client data, you inherit their security posture. Keep a simple vendor list with access levels and review dates, and confirm your providers carry cyber insurance and document access terms where relevant. For a look at how a structured review works, see our onboarding process.
What this looks like month by month
| Timeline | Focus | Outcome |
|---|---|---|
| Week 1 | MFA on email, remote access, and finance systems | Account takeover risk collapses |
| Weeks 2-3 | Patch enforcement plus endpoint protection rollout | Known vulnerabilities closed automatically |
| Weeks 4-6 | Email security controls and wire-policy rehearsal | Financial fraud attempts face multiple speed bumps |
| Ongoing | Quarterly restore drill, access review, short training | Controls stay true instead of decaying |
Frequently asked questions
Is this realistic for a solo or two-attorney firm?
Yes. Every item scales down: MFA and patch policies are built into tools you already pay for, and the remaining items are process disciplines measured in minutes per quarter. The order matters more than the spend.
We have cyber insurance. Isn't that enough?
Insurers increasingly require the exact controls on this list before binding coverage, and they exclude incidents that stem from neglected requirements. A policy responds to an event; it does not prevent losing the client that event exposes.
What is the single most common entry point for firms our size?
Compromised email credentials. AttackersPhish the inbox, watch conversations, then send convincingly-timed payment or document requests from inside. That is why MFA and email security appear first above.
How do we know we are actually protected after completing the list?
Run a simple verification pass: confirm MFA is on for every account, watch a restore complete successfully, and review who currently has access. If you want an outside set of eyes, one of our security-focused managed IT plans includes exactly this assessment and produces a prioritized gap list you can act on immediately.