Priorities for a small firm
| Priority | Control | Effort |
|---|---|---|
| 1 | Multi-factor authentication on email, document storage and practice tools | Low |
| 2 | Password manager and unique passwords | Low |
| 3 | Automatic updates and device encryption | Low |
| 4 | Phishing awareness and payment-change verification | Medium |
| 5 | Tested, separate backups | Medium |
| 6 | Vendor review and access cleanup | Medium |
| 7 | Written incident response plan | Medium |
Law-specific risks
- Payment-redirection fraud: confirm any change of bank details by phone using a known number, especially in property or settlement transactions.
- Impersonation of clients or partners by email.
- Lost laptops and phones holding client files.
- Departing staff with lingering access.
- Staff pasting client details into consumer AI tools.
The ethics angle is consistent across many jurisdictions: take reasonable steps to protect client information, supervise staff and suppliers, and be ready to inform affected clients if something goes wrong. Check your own regulator for specifics.
A 90-day plan
- 1
Month 1
Turn on MFA everywhere, install a password manager, enable device encryption and updates.
- 2
Month 2
Audit who has access to what; remove stale accounts; set up backups and test a restore.
- 3
Month 3
Run a phishing exercise, adopt an AI-use policy, write the incident plan.
Track these tasks as items in a Notion database with owners and due dates. LawyerOS focuses on matters and deadlines, so create a simple Security tasks database yourself if you want one; the template does not provide security tooling or monitoring.
Frequently asked questions
- What is the most important control?
- Multi-factor authentication on key accounts, followed closely by updates and backups.
- Do small firms need cyber insurance?
- Many consider it. Read the policy for conditions such as MFA requirements and notify your insurer as required.
- How often should staff be trained?
- On joining and at least annually, with shorter reminders about current scams.
- Can Notion improve our security?
- It can help you organise tasks and policies, but it is not a security tool.
About the author
Raghav Handa trained as a lawyer, then spent years building legal technology, from enterprise legal products to custom systems for law firms.
Keep reading
- Security and ethicsCloud storage security for legal files: a 2026 practical guideHow to keep legal files secure in cloud storage in 2026: classification, access, sharing, backups, devices and exit planning, with a checklist small firms can use.3 min read · 17 October 2026
- Security and ethicsFirm AI policy template for lawyers (fill-in outline)A fill-in outline for a law firm AI use policy: scope, approved tools, confidentiality, verification, client disclosure, training and review. General guidance only.3 min read · 17 October 2026
- Security and ethicsIs Notion secure enough for lawyers? Confidentiality, ethics and setupIs Notion safe for client data? Its certifications and encryption, the ABA's reasonable-efforts standard, the real risks and how to configure it.4 min read · 17 October 2026
- Security and ethicsCloud vendor due diligence checklist for law firmsA practical checklist for vetting any cloud or AI vendor before putting client data in it: security evidence, data handling, contracts, exit and ongoing review.3 min read · 17 October 2026