ABA Rule 1.6(c) and cybersecurity: reasonable efforts for law firms

ABA Model Rule 1.6(c) says lawyers must make reasonable efforts to prevent unauthorized access to or disclosure of client information. For a modern firm, that means email, devices, Wi-Fi, backups and vendors. Here is what bar guidance says and how we help small firms meet it.

Review my firm's security Call or text (760) 684-4139

✓ Solo and small firms★ San Bernardino County

The short answer

Rule 1.6(c) requires reasonable efforts to protect client information. It does not demand perfection, but it does expect a thought out security program.
ABA Formal Opinion 477R explains that reasonable efforts depend on how sensitive the information is and how likely and harmful a breach would be.
ABA Formal Opinion 483 covers what lawyers must do before and after a data breach, including monitoring systems and telling clients when their information is affected.
Technology competence is part of competence under Rule 1.1, and California has adopted the same idea.
Typical reasonable efforts include MFA, encrypted devices, secure email options, backups, updates, training and vetted vendors.

1.6(c)reasonable efforts rule

477Rsecuring client communications

483duties after a breach

1.1technology competence

What reasonable efforts look like in a small firm

Area	Reasonable safeguard
Email	MFA, phishing protection, and encrypted email for sensitive matters. See Microsoft 365 security.
Devices	Encrypted laptops and phones, screen locks and remote wipe
Network	A business firewall, separate guest Wi-Fi and secure remote access
Backups	3-2-1 backups with an offline or immutable copy. See the 3-2-1 rule.
People	Regular training on phishing and wire fraud
Vendors	Reviewing cloud, practice management and IT providers for security
Incidents	A written response plan and a way to notify clients

Risks bar guidance calls out

📧Hacked emailAttackers watch for settlements and trust account wires.

📶Public Wi-FiWorking from courthouses, hotels and coffee shops.

💻Lost devicesAn unencrypted laptop is a reportable problem.

🔒RansomwareLocked files can stop a practice and expose client data.

California lawyers

California lawyers also have the statutory duty of confidentiality in Business and Professions Code section 6068(e), and the State Bar has issued ethics opinions on technology, including Formal Opinion 2020-203 on data breaches. The practical steps are the same: protect client data, watch for breaches and respond properly if one happens.

How WENO helps law firms

1. Security reviewEmail, devices, network, backups and vendors checked against reasonable efforts.

2. Close the gapsMFA, encryption, a WatchGuard® firewall, secure remote access and backups.

3. Train the teamPhishing and wire fraud training for attorneys and staff. See phishing training.

4. Document itA written summary of safeguards your firm can show clients, insurers and the bar.

5. Breach helpFast technical response and the facts your firm needs to meet its duties.

Questions people ask

Do we have to encrypt every email?

Not necessarily. Opinion 477R says it depends on the sensitivity of the information. Highly sensitive matters may call for encryption or a secure portal.

Is cloud storage allowed?

Yes, with reasonable care in choosing and setting up the provider, including access controls and MFA.

Can you replace our ethics counsel?

No. We handle the technology. Your ethics counsel or the bar advises on your professional obligations.

Law firm cybersecurity Microsoft 365 security MFA explained Ransomware first hour plan Data breach reporting laws WatchGuard firewalls

Show your clients their files are safe.Reasonable efforts, put in place and documented.

Review my firm's security

Sources

General information, not legal advice. Consult ethics counsel about your obligations.