Law Firm Cybersecurity: Testing Around Privilege and Client Confidentiality

Law firm cybersecurity carries a constraint no other vertical has. The evidence you generate while assessing a firm can end up in an opposing party's hands, and most of the data you touch during the test belongs to somebody who never hired you. MSP Pentesting runs legal sector testing under your brand, channel-only, and a real share of every scoping call is about what we are not allowed to look at. Get that wrong and you've handed a client the discovery problem they paid you to prevent.

None of what follows is legal advice. We aren't lawyers. The firm's general counsel or its outside ethics counsel makes every call below, and state rules differ from the model ones.

Your job is to know enough to ask the right questions before the kickoff call.

The rules that drive the whole conversation

The ABA Model Rules of Professional Conduct aren't law anywhere. Each state adopts its own version, so read the client's state rules. That said, the four that come up in every legal engagement are worth knowing by name.

Rule 1.1, competence. Comment 8 says a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology. Most states have adopted some version of that comment. It's why a managing partner who used to wave you off now sits in on the security meeting.

Rule 1.6(c), confidentiality. The text is short and it's the one you'll quote most. A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client. Comment 18 lists the factors for judging reasonable: sensitivity of the information, likelihood of disclosure without extra safeguards, cost of those safeguards, difficulty of implementing them, and whether they'd get in the way of representing clients.

Read that factor list again as an MSP. It's a risk-based standard, not a control checklist, and it means the firm has to be able to show its reasoning. Which means somebody has to document the analysis. That's a service, and most firms haven't bought it.

Rule 1.4, communication. The duty to keep a client reasonably informed. This is what converts a security incident into a client notification obligation.

Rule 5.3, responsibilities regarding nonlawyer assistance. This one's about you. A firm using an outside provider has to make reasonable efforts to ensure that provider's conduct is compatible with the lawyer's own professional obligations. That's the rule behind the security questionnaire, the confidentiality addendum and the request for your SOC 2 report.

What Formal Opinion 483 actually says

ABA Formal Opinion 483, issued in 2018, is the one everybody cites and few people read. It addresses a lawyer's obligations after an electronic data breach or cyberattack, and it leans on Rules 1.1, 1.4, 1.6, 5.1 and 5.3.

The parts that matter to an MSP:

• Competence includes an ongoing obligation to monitor for a breach, then act promptly to stop it and restore systems.
• After an incident, the lawyer has to make reasonable efforts to determine what actually happened. You can't notify anyone about a thing you never investigated.
• Notice to a current client is required when material client confidential information was misappropriated or destroyed, or when the breach substantially impaired the lawyer's ability to do the work.
• On former clients, the committee declined to impose a duty, saying it was unwilling to require notice as a matter of legal ethics absent a black letter provision. It pointed instead at Rule 1.9(c) and recommended firms settle file disposition at the end of a matter.

Two practical consequences follow, and neither is obvious.

First, ethics duties sit on top of state breach notification statutes, not instead of them. A firm can owe a client notice under Rule 1.4 in a situation where no state statute triggers, because the rule covers confidential information generally, not just defined personal data.

Second, that former-client gap is exactly why old matter files are a liability. A firm holding twenty years of closed matters has multiplied its exposure without adding a dollar of revenue. Retention policy is a security control at a law firm, and it's the cheapest one on the list.

Why privilege changes how you test

On a normal internal test, proving access means grabbing a file and putting a screenshot in the report. Do that at a law firm and you've just copied privileged material belonging to a third party who never consented to anything.

So you invert the rule. Minimum evidence, not maximum proof.

Prove reachability, then stop. A directory listing shows access. A file hash shows you could have read it. A record count shows the exposure size. None of those require carrying the contents out of the environment.

Then there's the report itself. It's a document that describes exactly how to reach a firm's most sensitive systems, it names the weaknesses, and it exists on somebody's laptop. Agree in writing who holds it, how it moves, how long it lives and what happens to the working data when the engagement ends. Encrypted delivery, named recipients, a stated destruction date.

Ethical walls deserve their own line item. Firms build matter-level access restrictions to separate teams working opposite sides of related matters, and in most firms those walls are configured once and never verified. Testing whether the wall actually holds inside the document management system is one of the highest-value findings you can produce at a legal client, and almost nobody offers it.

Incident response is where privilege really breaks

The standard playbook says retain outside counsel, have counsel engage the forensics firm, and the resulting report is protected work product. Courts have been picking that apart.

In the Capital One consumer data breach litigation, a federal court in Virginia ordered production of the Mandiant forensic report in 2020. The firm had a long-standing pre-existing relationship with Mandiant, the scope of work under the counsel arrangement wasn't meaningfully different from the existing statement of work, and the report went to internal security teams, outside accountants and regulators. The label didn't survive the facts.

In Wengui v. Clark Hill, decided in the District of Columbia in 2021, the defendant was itself a law firm. It argued it had run a two-track investigation, one for business purposes and one for litigation. The court found the record didn't support the story and ordered the forensic report produced.

Neither case says privilege is impossible. Both say the structure has to be real before the incident, not asserted after it.

Here's where that lands on your desk. During a live incident at a law firm, your engineers will want to write up a root cause summary and email it around. That instinct is correct in every other vertical and dangerous in this one. Agree the communication protocol with the firm's counsel before an incident, put it in the runbook, and let counsel decide what gets written and who receives it. You are not the person who decides what's privileged, and you shouldn't want to be.

What to actually test at a law firm

The technology list looks like any professional services firm until you get to the middle.

Trust account fraud is the loss event that actually happens to firms. Business email compromise, forged wire instructions on a closing, funds gone before anyone notices. Test the verification process, not only the mail filter, because the control that stops it is a phone call to a known number.

Scoping around the calendar

Healthcare clients have clinical uptime. Law firms have deadlines that a court will not move. Filing dates, trial, closings, statute deadlines.

Put blackout windows in the rules of engagement and get them from the practice group leads, not from IT. IT doesn't know that the litigation group files Thursday. Agree an abort path that any partner can invoke, and agree in advance that invoking it doesn't cost the firm the engagement fee. Firms will otherwise sit on a problem rather than lose money.

Where cyber insurance for law firms fits

Cyber security insurance for law firms is now the reason most of these projects get funded. Applications ask about MFA coverage, endpoint detection, backup testing, email filtering and, increasingly, whether the firm runs penetration testing and awareness training.

Those answers are representations. An inaccurate one is a coverage argument at exactly the wrong moment, and the person filling in the form is usually the office administrator who's guessing about your stack. Offer to complete the technical sections with evidence attached. It's an hour of work, it protects the client, and it makes renewal season a recurring touchpoint you own.

Corporate clients apply the same pressure from the other side. Outside counsel guidelines from banks, insurers and healthcare systems now carry security requirements and audit rights, and a firm that can't answer loses the panel seat. A documented security risk assessment is what turns those questionnaires from a fire drill into a form-fill.

What managing partners ask before they sign

Can we test if we already run the firm's IT?

You can run internal reviews all day. You can't be independent about work you performed, and firms whose corporate clients audit them get asked that question directly. This is the ordinary reason legal work goes out to a white-labeled testing partner under your brand while your team keeps the remediation.

Does the firm's client have to consent to the test?

That's a call for the firm and its counsel, and it depends on what the test touches and what the engagement letters say. Your job is to make the data handling narrow enough that the question gets easy to answer. Ask it early rather than at the report stage.

What do we do if we find client data somewhere it shouldn't be?

Stop, don't copy it, document the location and the access path, and escalate to the named contact the same day. Write down what you saw, not what it said.

Are the Model Rules binding on our client?

No. They're models. Every state adopts its own rules of professional conduct and the wording varies, sometimes materially. Cite the model rule to frame the conversation and let the firm's counsel confirm the local version.

Do small firms actually buy this?

Solo and small firms buy it when a corporate client's outside counsel guidelines force it, when an insurance renewal forces it, or after a colleague loses a wire transfer. Two of those three are calendar events you can predict.

Start where the wall has never been tested

Take your largest legal client and ask two questions. Who has access to closed matters from a decade ago, and how would we prove a wall held if a client asked us to?

Most firms can't answer either. That gap is the engagement.

Scope narrowly, write the data handling rules before anything else, and bring in an independent tester for the part your team built. Once the engagement letter is drafted, get a pentest quote. The confidentiality terms go into the scope document before anybody touches a mailbox.