Legal and Professional Services
Cybersecurity for Law Firms and the Client Information They Protect
Valiell Tech helps legal and professional-services firms protect confidential information, strengthen identity and email security, prepare for cyber incidents, and maintain visibility across cloud and business systems.
Schedule a Security ReviewThe security environment
Law firms, title companies, accounting firms, and consulting firms run on email and document-heavy workflows, holding client and case information that's both valuable and legally privileged. That combination makes firms a frequent target for business email compromise and credential theft. Those attacks aim less at breaking in technically than at impersonating someone trusted, at exactly the moment money or sensitive documents are moving.
Challenges
Common cybersecurity challenges
- Business email compromise
- Phishing and credential theft
- Client confidentiality and privileged information
- Wire and payment fraud
- Account takeover
- Unauthorized mailbox and forwarding-rule changes
- Malicious or overprivileged OAuth applications
- Cloud file-sharing exposure
- Remote work and personal-device risks
- Third-party application access
- Ransomware and operational disruption
- Backup and recovery reliability
- Limited internal security personnel
What we provide
Relevant services and solutions
- Microsoft 365 and Google Workspace security assessments
- Email and collaboration security
- Identity and multifactor-authentication reviews
- OAuth application and third-party access reviews
- Cloud file-sharing and data-access assessments
- Continuous security monitoring
- Incident-response support and readiness
- Vulnerability assessments
- Security-awareness and phishing simulations
- Backup and recovery assessments
- Security-policy development
- Ongoing cybersecurity advisory services
How Valiell Tech supports legal and professional-services firms
Work is scoped around discretion and practicality: findings are reported clearly and directly to the people accountable for the firm's risk, with recommendations sized to fit day-to-day practice rather than a theoretical enterprise environment. We review the paths business email compromise actually uses (mailbox rules, OAuth grants, MFA gaps, forwarding changes) and prioritize what closes the most realistic exposure first.
Expected engagement outcomes
Stronger identity and email controls, improved visibility into mailbox and OAuth activity, a tested incident-response plan for the scenario firms actually face (email compromise, not a hypothetical), prioritized remediation instead of an unranked audit, and reduced exposure to wire-fraud-style attacks. We don't guarantee prevention of compromise, fraud, or breach.
Ethical duties
Helping firms meet their duties to protect client information
The ABA Model Rules of Professional Conduct and the ABA's formal ethics opinions set out what lawyers are expected to do to protect client information. They don't prescribe specific tools. They ask for informed, reasonable effort. Our work covers the technical side of that effort: a clear picture of your systems, practical safeguards, and a plan for when something goes wrong.
- ABA Model Rule 1.1, Comment 8: technology competence
- Comment 8 to the competence rule says lawyers should keep up with the benefits and risks of relevant technology. For most firms, that means knowing how email, cloud storage, and remote access are set up, and where the gaps are. A security assessment gives you that picture in plain language.
- ABA Model Rule 1.6(c): reasonable efforts to protect client information
- Rule 1.6(c) asks lawyers to make reasonable efforts to prevent unauthorized access to, or disclosure of, information relating to a client's representation. Multifactor authentication, locked-down mailboxes, controlled file sharing, and monitoring are the kinds of safeguards we help firms put in place and document.
- ABA Formal Opinion 477R (2017): securing client communications
- The opinion describes a risk-based approach: understand how client information is sent and stored, use reasonable security measures, train staff, and vet technology vendors. It also notes that some matters call for stronger protection. Our Microsoft 365 and Google Workspace reviews work through the same questions.
- ABA Formal Opinion 483 (2018): obligations after a breach
- The opinion covers monitoring for breaches, acting to stop them and restore systems, working out what happened, and informing current clients when their information is affected. Monitoring and incident-response planning help a firm be ready for each of those steps.
This section describes how our services support these duties. It isn't legal advice. Your firm's obligations depend on your jurisdiction and circumstances, so confirm them with your ethics counsel or state bar.
Questionnaires and insurance
Client security questionnaires and cyber-insurance requirements
Corporate clients now often send outside counsel a security questionnaire, and cyber insurers ask similar questions at application and renewal. The list of controls is usually the same. Here's how our existing services map to each one.
- Multifactor authentication (MFA)
- Identity & Access Management: we check where MFA is enforced across Microsoft 365, Entra ID, or Google Workspace, find the accounts and apps that skip it, and help close the gaps.
- Endpoint detection and response (EDR)
- We don't supply an EDR product. Through Security Monitoring & SOC Services, we monitor and respond to alerts from the EDR tool your firm already uses, 24/7. Vulnerability & Security Assessments include endpoint scanning and configuration review, so you can see which devices need attention.
- Backups
- Incident Response and Readiness includes a backup and recovery-readiness review, so you know whether you can restore, not just whether backups run.
- Incident-response plan
- Incident Response and Readiness: plan review and development, escalation and communication planning, and tabletop exercises that test the plan with the people who would run it.
- Email security
- Identity & Access Management reviews mailbox access and OAuth app grants, and Security Monitoring & SOC Services includes email and collaboration-platform monitoring.
- Security awareness training
- Security-awareness training and phishing simulations for attorneys and staff, so the firm can show that training happens and see how people respond.
Requirements differ by client and insurer. We help you put the controls in place and understand what you have; we don't set coverage terms or guarantee an insurer's decision.
Frequently asked questions
Will you need direct access to client files or privileged case data?
No. Assessments focus on the security controls protecting that data (identity, email, access, configuration), not its contents. Scope is agreed upfront.
Can Valiell Tech work alongside our existing IT provider?
Yes, engagements are built to complement an existing internal or outsourced IT team, not replace them.
What's included in a security review for a firm our size?
An assessment of identity, email/collaboration security, OAuth and third-party app access, and backup readiness, with prioritized findings and a remediation plan, scoped to the firm's actual environment and size.
How do you handle confidentiality around what you find?
Findings are shared only with the people the firm designates, and engagement terms can include standard confidentiality commitments; this is discussed and agreed before work begins.
Do you support both Microsoft 365 and Google Workspace?
Yes. Security assessments and ongoing monitoring are available for either platform.
What are a law firm's ethical obligations for cybersecurity?
Under the ABA Model Rules, lawyers have a duty of technology competence (Rule 1.1, Comment 8) and must make reasonable efforts to prevent unauthorized access to client information (Rule 1.6(c)). ABA Formal Opinions 477R and 483 add guidance on securing client communications and on what to do after a breach. State rules vary, so confirm your firm's obligations with your ethics counsel. We help with the technical safeguards; we don't give legal advice.
What security controls do clients and cyber insurers ask law firms for?
The most common requests are multifactor authentication, endpoint detection and response, tested backups, a written incident-response plan, email security, and security awareness training. Exact requirements vary by client and insurer, so check each questionnaire or application.
Does a law firm have to tell clients about a data breach?
ABA Formal Opinion 483 says lawyers have a duty to communicate with current clients about a data breach that affects their information. That ethical duty is separate from state breach-notification laws, which apply on their own terms and can require notice to clients, regulators, or others. Incident-response planning helps you know who makes that call and when. This isn't legal advice. Your firm's obligations depend on your jurisdiction and circumstances, so confirm them with your ethics counsel or state bar.