Short answer: Law firm cybersecurity in DC is an ethics question before it’s an IT question. D.C. Rule of Professional Conduct 1.6(f) says a lawyer “shall exercise reasonable care to prevent” the unauthorized access to client confidences or secrets, and to keep staff and outside helpers from disclosing them. The rule doesn’t list products. It asks whether your precautions were reasonable for the information you hold.
That word “reasonable” is where most small firms get stuck. What does it mean for a six-lawyer office on K Street, or a solo practitioner who works from home two days a week? Here’s how we read it as an IT provider, and what we’d fix first.
One note before we start: we’re an IT company, not your ethics counsel. For questions about your own obligations, talk to the D.C. Bar’s ethics resources or your own lawyer. What we can tell you is what “reasonable care” tends to look like inside a real office network.
What the DC rule actually says about cybersecurity
D.C. Rule 1.6 protects two kinds of information. “Confidences” are covered by attorney-client privilege. “Secrets” are everything else you learn in the relationship that the client asked you to keep private, or that would embarrass or harm them if it got out. That second bucket is wide. It covers most of what sits in a typical document management system, inbox or billing platform.
Paragraph (f) is the part that touches technology. It requires reasonable care to prevent two things:
- Your employees, associates and others whose services you use from disclosing or using client confidences or secrets.
- Unauthorized access to client confidences or secrets.
Comment [40] adds the practical detail. When you transmit or store client information, you have to take reasonable precautions to keep it from reaching unintended recipients. Special security measures aren’t required if the method gives a reasonable expectation of privacy, but special circumstances can call for them. The factors the comment lists are the sensitivity of the information, whether law or a confidentiality agreement protects it, the cost of the security measures, and how hard they are to put in place.
The comment also says a client and lawyer can agree on stronger security than the rule requires, and a client can give informed consent to skip measures that would otherwise be required. For sharing information with vendors outside the firm, it points to Rule 5.3.
What “reasonable care” looks like in a small DC law office
Nobody can promise a firm will never be breached, and the ethics rules don’t ask for that. The American Bar Association said as much in ABA Formal Opinion 483: the duty is one of reasonable efforts, not strict liability. ABA opinions interpret the Model Rules rather than DC’s own text, but they’re a useful reference for what reasonable efforts look like in practice.
In our experience, a small firm that has the following basics in place, and can show it, is in a much stronger position than one that doesn’t.
Multi-factor authentication on every account that touches client files. Email first, then the document system, the practice management platform, remote access and the bank. A stolen password alone shouldn’t be enough to read a client’s file.
Encrypted laptops and phones. If a device with client files is lost in a cab or left on the Metro, encryption is the difference between an awkward afternoon and a reportable incident.
Access that matches the job. Paralegals don’t need the managing partner’s mailbox. Departed associates shouldn’t still have OneDrive links working six months later.
Backups that are tested. A backup nobody has ever restored from is a hope, not a plan.
Patching and supported software. Old versions of Windows, PDF tools and VPN appliances are a common way in.
A short written policy and staff training. The rule talks about your employees and others whose services you use. That’s a people problem as much as a technical one.
Email is still the weakest link
If we had to pick one place where DC firms get hurt, it’s email. Wire instructions on a real estate closing, settlement payments, retainer refunds: attackers know law firms move money and that clients trust messages from their lawyer.
When we review a firm’s Microsoft 365 for the first time, a few things come up again and again:
- Mailbox forwarding rules nobody remembers creating, quietly copying mail to an outside address.
- Shared logins for a front-desk or intake mailbox, with no MFA because “everyone uses it.”
- Old accounts for former staff that were never turned off.
- Legacy sign-in methods left on, which can get around MFA.
Each of these is cheap to fix. Our Microsoft 365 security checklist walks through the settings in order, and it’s the same list we start from on a new law firm client.
A simple office habit helps too: any change to payment instructions gets confirmed by phone, using a number you already have on file, not one in the email. If someone on your team does click a bad link, here’s what to do in the first hour after a phishing click.
Vendors, cloud apps and your IT provider
Most firms now keep client files with someone else: Microsoft 365, a cloud practice management system, an e-signature tool, a backup service, an outside IT company. Comment [40] to Rule 1.6 points to Rule 5.3 for sharing information with nonlawyers outside the firm, which covers this kind of arrangement.
In plain terms, you should know who has access to your systems and on what terms. A few questions worth asking every vendor that holds client data:
- Where is our data stored, and who on your side can see it?
- Is it encrypted in storage and in transit?
- Do you support MFA and single sign-on for our users?
- How and how fast will you tell us if you have a security incident?
- How do we get our data back if we leave?
That last one matters more than people think. Getting files out of a practice management system at the end of a contract can be harder than getting them in.
Your IT provider belongs on that list too. Whoever runs your network can usually see everything on it. Ask them how their own staff accounts are protected, and how they log admin access to your systems.
If something goes wrong: ethics duties and DC’s breach law
ABA Formal Opinion 483 describes what lawyers should do after a data breach or cyberattack. It says lawyers should make reasonable efforts to monitor their technology and vendors so a breach isn’t found by accident, act quickly to stop it, work out what happened, and notify current clients when material client information was, or likely was, accessed, lost or made unavailable.
That’s the ethics side. The statute side is separate. DC’s breach notification law can require notice to affected DC residents and, when 50 or more are affected, to the DC Attorney General. We covered the details in our guide to the DC data breach notification law.
The firms that handle an incident well usually have three things ready before it happens: a short incident response plan, logs that show who signed in and from where, and backups that can bring files back quickly. Ransomware that locks the document system for a week is a client-service problem as well as a security one.
A practical 30-day starting plan
If your firm hasn’t looked at this in a while, here’s the order we’d tackle it:
Week 1: Turn on MFA for every Microsoft 365 or Google Workspace account, starting with partners and anyone who handles billing or trust accounts. Remove accounts for people who’ve left.
Week 2: Check every laptop and phone that touches client files for encryption and current updates. Confirm which devices you actually own.
Week 3: Review mailbox forwarding rules, shared mailboxes and external sharing links in OneDrive, SharePoint or your document system.
Week 4: Test a restore from backup, write a one-page incident plan with phone numbers, and list every vendor that holds client data.
None of this needs a big budget. It does need someone to own it. For many small DC firms, that’s where an outside provider earns its keep. Our IT support for law firms covers this work, and our cybersecurity services handle monitoring and protection for offices across the District. We support Washington, DC businesses from our Fairfax, VA office.
Get a free Microsoft 365 security scan
Not sure where your firm stands? We’ll run a free Microsoft 365 security scan (normally $1,500) and walk you through what we find: MFA gaps, risky forwarding rules, old accounts and sharing settings. No pressure and no long contract to sign. Call Xala Tech Services at (703) 340-1110 to set it up.
Frequently asked questions
Does the DC Rule of Professional Conduct 1.6 cover cybersecurity?
Yes. Rule 1.6(f) requires a lawyer to exercise reasonable care to prevent unauthorized access to client confidences or secrets, and to prevent employees and others whose services the lawyer uses from disclosing them. Comment [40] applies this to transmitting and storing client information.
What counts as reasonable cybersecurity for a small DC law firm?
The rule doesn’t list specific tools. Comment [40] weighs the sensitivity of the information, legal or contractual protections, the cost of security measures and how hard they are to implement. In practice, most firms start with multi-factor authentication, encrypted devices, limited access, tested backups, patching and staff training.
Is a law firm in violation of Rule 1.6 if it gets hacked?
Not automatically. ABA Formal Opinion 483 describes the duty as one of reasonable efforts, not strict liability, so a breach alone doesn’t mean a lawyer violated the rule. What matters is whether reasonable precautions were in place and what the firm did after the breach.
Do DC lawyers have to tell clients about a data breach?
ABA Formal Opinion 483 says lawyers should notify current clients when material client information was, or likely was, accessed, lost or made unavailable. Separately, DC’s data breach notification law can require notice to affected DC residents and to the DC Attorney General when 50 or more residents are affected.
Can a law firm store client files in Microsoft 365 or other cloud services?
Generally yes, as long as the lawyer takes reasonable precautions. Comment [40] says special security measures aren’t required when a storage method affords a reasonable expectation of privacy, and Rule 5.3 applies when sharing information with nonlawyers outside the firm. Settings like MFA, encryption and sharing controls still need to be configured.