Cybersecurity Training
for Small Law Firms.
Protect Client Confidences.
Forty-plus state bars now require technology competence under Model Rule 1.1. Model Rule 1.6 demands reasonable measures to protect client confidentiality. Your malpractice carrier asks about training at renewal. This training covers all three areas, designed for firms where the managing partner handles IT.
Your ethical and regulatory obligations
Client confidentiality is a core ethical duty, and it now includes cybersecurity.
State bar associations across the country have made clear: the duty to protect client information extends to digital security. Training your attorneys and staff is one of the most frequently cited "reasonable measures" in ethics opinions addressing data security.
| Framework | Citation | What it requires |
|---|---|---|
| ABA Model Rule 1.1 | Competence, Comment [8] | Requires lawyers to keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology. Over 40 state bars have adopted the duty of technology competence. |
| ABA Model Rule 1.6 | Confidentiality of Information, Comment [18] | Requires reasonable efforts to prevent inadvertent or unauthorized access to client information. State bar ethics opinions consistently interpret this to include security awareness and data protection measures. |
| State Bar Ethics Opinions | Varies by state | Multiple state bar associations, including New York, California, Florida, and Pennsylvania, have issued formal ethics opinions stating that lawyers have an ethical obligation to implement reasonable cybersecurity measures, including staff training. |
| State Breach Notification Laws | All 50 states | Law firms holding client PII and financial data are subject to state breach notification laws. Most require notification within 30–60 days of discovering a breach. Law firms face additional obligations under professional conduct rules. |
This table summarizes key training-adjacent obligations. Consult qualified counsel for ethics interpretation specific to your jurisdiction and practice area.
Why this matters for small firms
Law firms are high-value targets, and small firms are hit disproportionately often.
Attackers know that small law firms hold concentrated sensitive data, client financials, trade secrets, M&A documents, litigation strategy, and often lack dedicated security resources. Training every attorney and staff member is the most cost-effective defense.
Law firms reporting a security breach in past 2 years
ABA 2023 Legal Technology Survey Report, firm security incident data across all firm sizes
Average cost of a data breach for professional services
IBM Cost of a Data Breach Report, 2024, professional services industry benchmark
Law firms with fewer than 10 attorneys breached
ABA 2023 Cybersecurity Report, breach distribution by firm size
What the training covers
Written for attorneys and legal staff, not for IT professionals.
Your people are lawyers, paralegals, and legal assistants, not cybersecurity analysts. This training speaks their language: ethics opinions, confidentiality obligations, client communication scenarios, and practical steps that work in a small firm without enterprise tools.
Duty of Technology Competence
What ABA Model Rule 1.1 Comment 8 actually requires, and what your state bar has done with it. Practical implications for small firms that do not have an IT director or CISO on staff.
Client Confidentiality in the Digital Age
How Model Rule 1.6 and state ethics opinions apply to email, cloud storage, mobile devices, and home networks, the tools your attorneys and staff use every day. Real-world ethics scenarios drawn from state bar disciplinary decisions.
Email Security and Privileged Communication
When email to opposing counsel, clients, or co-counsel risks waiver. How to recognize spoofed emails impersonating clients or partners. The simple steps that protect privileged communication without enterprise email security gateways.
Cloud Services and Third-Party Risk
Using cloud-based practice management, document storage, and e-discovery platforms, what due diligence looks like for a small firm. How to evaluate a vendor's security without a dedicated IT procurement function.
Mobile and Remote Practice Security
Many small-firm attorneys work from home, court, and client locations. How to protect client data on personal devices, public Wi-Fi, and shared computers without enterprise mobile device management software.
Breach Recognition and Ethical Obligations
What constitutes a data breach under state law and professional conduct rules. Who must be notified, how quickly, and what your professional liability carrier needs to know. Written for firms without an incident response team.
Recommended for your industry
Recommended training for legal teams
Not every employee needs every course. Start with the foundational awareness that supports your ethical and confidentiality obligations, then add specialized courses where your practice demands it.
Cybersecurity Awareness
Recommended for: Attorneys, paralegals, legal assistants, and administrative staff who handle client information.
Builds the everyday security habits attorneys and staff need to protect client confidentiality and support the duty of technology competence.
Phishing & Social Engineering
Recommended for: Firms that communicate with clients, co-counsel, and opposing counsel by email.
Provides targeted training on the spoofed emails and impersonation that specifically target law firms and privileged communication.
Cyber Insurance Readiness
Recommended for: Firms that carry or are applying for cyber or malpractice insurance.
Useful for firms that carry or are applying for cyber or malpractice insurance and want staff to understand the behaviors carriers expect.
Not sure where to start? For most firms, begin with Cybersecurity Awareness and Phishing & Social Engineering. Add data-privacy and insurance courses based on your practice areas and client data.
About your recommended courses
Frequently asked questions about your course recommendations
Our recommendations are built by mapping your industry's regulatory obligations and most common risks to specific courses. We organize them into tiers (Start Here, Highly Recommended, Recommended, When Applicable, and Based on Your Needs) so you can quickly see what's essential, what's broadly useful, and what's conditional on your specific situation.
Certificates and training records
When a bar inquiry, malpractice carrier, or client asks, you have records.
Each attorney and staff member receives a dated certificate mapped to ABA Model Rules 1.1 and 1.6, along with applicable state breach notification requirements. Every certificate includes a public URL where anyone can verify authenticity, no login required.
Manager reports show firm-wide completion status. Export a PDF. Include it with your malpractice renewal application or your response to a client security questionnaire. It is documented and verifiable.
Also applies to your profession
See how this training applies to other regulated small businesses.
Healthcare Practices
HIPAA Security Rule training for dental, medical, and chiropractic practices, no small-practice exemption.
View healthcare guideAccounting Firms
FTC Safeguards Rule, IRS Pub 4557, SOC 2, for CPA firms and tax preparers without dedicated IT staff.
View accounting guideMortgage & Real Estate
GLBA compliance and wire fraud prevention for independent originators and small brokerages.
View mortgage guideManaged Service Providers
CMMC, NIST CSF, ISO 27001, supply chain security training for small MSP teams.
View MSP guideInsurance Agencies
State regulation and NAIC model law training for independent agents and small brokerages.
View insurance guideFinancial Advisors
SEC and FINRA-aligned training for RIAs and independent advisors handling sensitive client financial data.
View financial advisor guideNonprofits
Donor data protection and grant compliance training for small charities and foundations without IT staff.
View nonprofit guide
Enroll your entire firm in four minutes. No IT staff, no sales call, no contract.
Partners, associates, paralegals, legal assistants, and administrative staff, everyone who handles or has access to client information completes the same program. Certificates issued instantly. Publicly verifiable. Completion records you can download as soon as people finish.
Fixed annual pricing per person. Cancel any time. Certificates remain valid and verifiable for 12 months. Training and documentation support ethical obligations, consult qualified counsel for jurisdiction-specific ethics interpretation.