Law firms are trusted with some of the most sensitive information there is: litigation strategy, merger details, family matters, financial records, and personal histories. When a firm chooses a cybersecurity provider, it's deciding who will help protect all of it.

The challenge is that many providers sound the same in a sales meeting. Everyone mentions firewalls, antivirus, and "24/7 monitoring." The right questions help you see past the buzzwords.

Here are the questions we recommend law firms ask, grouped by topic, along with what a strong answer looks like.

Understanding Legal Practice

"Which other law firms or professional practices do you support?"

Look for: Experience with firms of similar size and practice areas. Providers familiar with legal work understand practice management systems, document management, court e-filing, and the pressure of filing deadlines.

"How do you handle our confidentiality obligations?"

Look for: Clear policies about which technicians can access firm systems, how access is logged, and a willingness to sign confidentiality agreements. A good provider understands that their staff may encounter privileged material.

Protection and Prevention

"How will you protect our email from business email compromise?"

Look for: Specific controls such as multifactor authentication, email filtering, domain protection (SPF, DKIM, DMARC), and alerts for suspicious mailbox rules. Wire fraud targeting law firms is common enough that this answer should be detailed.

"What's your approach to protecting laptops and remote work?"

Look for: Endpoint protection, encryption on laptops, secure remote access, and the ability to remotely lock or erase a lost device.

"How do you train our attorneys and staff?"

Look for: Short, regular training and phishing simulations, not just a single annual video. Ask how they handle partners who are too busy for training.

Detection and Response

"What happens when you detect something suspicious at 2 a.m.?"

Look for: A clear explanation of who monitors alerts, how quickly they act, and when they contact the firm. Vague promises of "24/7 coverage" deserve follow-up questions.

"Will you help us during a breach, and how does that work with our cyber insurance?"

Look for: Understanding that insurers often require their own approved forensic firms and breach counsel. A good provider coordinates with them rather than competing.

Backup and Recovery

"How would we recover from ransomware?"

Look for: Backups that are protected from ransomware, regular restore testing, and realistic recovery timeframes for your document management and practice management systems.

"When did you last test a full restore for a client like us?"

Look for: A specific answer. Backups that have never been tested are a hope, not a plan.

Service and Accountability

"What does your service agreement commit to?"

Look for: Clear response times, defined escalation paths, and plain language about what's included. Our guide on what to look for in a managed IT SLA explains common red flags.

"How will you report to firm leadership?"

Look for: Regular reviews with partners or the firm administrator covering security status, open risks, and recommended improvements. Quarterly conversations, like those in six questions smart companies ask every quarter, keep everyone aligned.

"What happens if we decide to leave?"

Look for: A clear offboarding process that returns documentation, passwords, and administrative access without delay. Providers who make leaving difficult often make staying difficult too.

Questions to Ask Yourself

Before choosing, firm leaders should also consider:

• Did the provider explain things in plain language?
• Did they ask about our practice, or only talk about their tools?
• Would our staff feel comfortable calling them?
• Can they help us answer client security questionnaires?

Choosing With Confidence

The right cybersecurity provider becomes a long-term partner in protecting your clients and your firm's reputation. Take the time to ask detailed questions and expect detailed answers.

Maise Technology provides cybersecurity services for professional practices, including law firms throughout Utah. We're happy to answer every question on this list. Schedule A 15 Minute Discovery Call to start the conversation.

In the first 24 hours after a suspected data breach, a law firm should contain the problem, preserve evidence, bring in the right help, notify its cyber insurance carrier, and begin evaluating its legal and ethical notification duties. Acting quickly and in the right order protects clients, limits damage, and keeps options open.

Below is an hour-by-hour guide. Every incident is different, so treat this as a framework, not a script.

Hour 0 to 1: Recognize and Contain

Breaches often start with a small clue: a client asking about an email you didn't send, a ransom note on a screen, or a strange login alert.

• Don't panic, and don't start deleting things. Deleting emails or wiping computers can destroy evidence you'll need later.
• Isolate affected devices. Disconnect them from the network by unplugging the network cable or turning off Wi-Fi. Leave them powered on if possible.
• Reset compromised passwords from a device you know is clean, and turn on multifactor authentication if it isn't already enabled.
• Write down what you've seen, including times, screens, and messages.

Hour 1 to 3: Assemble Your Response Team

Call the people who need to be involved right away:

• Managing partner or designated incident lead.
• Your IT provider or security team, to help investigate and contain.
• Your cyber insurance carrier. Many policies require prompt notice and may require you to use approved breach counsel and forensic firms. Calling the wrong vendor first can affect coverage.
• Breach counsel, often provided through your insurer, to guide legal decisions and help protect privilege over the investigation.

Keep the group small and communicate by phone if email may be compromised.

Hour 3 to 8: Preserve Evidence and Investigate

Forensic investigators will want to know how the attacker got in, what they accessed, and whether they're still present. Help them by preserving:

• System and email logs.
• Affected computers, untouched.
• Suspicious emails, with headers intact.
• Records of mailbox rule changes and sign-in history.
• Any ransom notes or attacker communications.

If ransomware is involved, do not contact the attackers or pay a ransom without guidance from counsel and your insurer. Payments can raise legal issues, and payment doesn't guarantee data recovery. CISA's StopRansomware site offers federal guidance, and our article on preventing ransomware covers how to reduce future risk.

Hour 8 to 16: Keep the Firm Running

Clients still need representation while the investigation continues.

• Identify court deadlines and filings due in the next several days.
• Decide whether to request extensions where appropriate.
• Set up temporary, secure communication if firm email is unavailable.
• Restore critical systems from clean backups once investigators approve.

This is where a business continuity plan pays off. Firms with one can keep serving clients while recovery happens.

Hour 16 to 24: Evaluate Notification Duties

Notification is where legal and ethical obligations come together. With counsel, consider:

• Client notification. ABA Formal Opinion 483 discusses lawyers' duties after a data breach, including the obligation to inform current clients when their information may have been compromised. Check your state's rules of professional conduct and ethics opinions.
• State breach notification laws. Utah's Protection of Personal Information Act and the laws of other states where affected people live may require notice to individuals and, in some cases, to state authorities, within set timeframes.
• Contractual obligations. Some clients, especially businesses and healthcare organizations, have agreements requiring notice.
• Law enforcement. Reporting to the FBI through ic3.gov is often recommended.

You may not have all the facts within 24 hours, and that's normal. The goal is to start this evaluation early so deadlines aren't missed.

Common First-Day Mistakes

• Wiping and rebuilding computers before evidence is collected.
• Hiring a forensic firm before calling the insurance carrier.
• Communicating about the breach over compromised email.
• Making public or client statements before facts are known.
• Assuming the attacker is gone after changing one password.

Prepare Before You Need It

The best time to plan for a breach is now. A one-page incident response plan should list your insurance carrier's claim number, breach counsel contact, IT provider contact, and who leads the response. Keep a printed copy somewhere outside the office network.

Maise Technology helps law firms prepare for and respond to security incidents through our cybersecurity services. Have questions about building your firm's response plan? Get In Touch.

This article is for general information and is not legal advice. Consult qualified counsel about your firm's specific obligations after a security incident.

Law firms share files all day. Draft agreements go to clients. Discovery goes to opposing counsel. Medical records come in from providers. Financial statements move between accountants, lenders, and the firm.

Every one of those exchanges carries confidential information. And the method a firm uses to share it matters more than many attorneys realize.

This article compares the most common file-sharing methods law firms use, explains where each one creates risk, and offers a practical way to choose the right tool for each situation.

The Professional Duty Behind the Technology

Lawyers have an ethical duty to protect client information. ABA Model Rule 1.6(c) asks lawyers to make reasonable efforts to prevent unauthorized access to or disclosure of client information. The ABA's Formal Opinion 477R discusses how that applies to electronic communications and suggests that the level of protection should match the sensitivity of the information.

In plain terms, a routine scheduling email and a sealed settlement agreement don't need the same treatment. Firms should think about what they're sending, who it's going to, and what could happen if it ended up in the wrong hands. Each state adopts its own version of these rules, so check your state bar's guidance.

Comparing Common File-Sharing Methods

Regular email attachments

Where it works: Low-sensitivity documents such as public filings or meeting agendas.

Where it falls short: Attachments live forever in multiple inboxes. They can be forwarded without your knowledge. If either party's mailbox is compromised, every attachment in it is exposed. You also can't take a file back once it's sent.

Encrypted email

Where it works: Sensitive documents sent to clients who are comfortable with email.

Where it falls short: Encryption protects the message in transit, but recipients may still download and forward files. Some clients find the extra login steps confusing, which can lead them to ask for "just a regular email."

Cloud sharing links (OneDrive, SharePoint, and similar tools)

Where it works: Larger files, collaborative drafting, and ongoing matters.

Where it falls short: Links are only as secure as their settings. A link set to "anyone with the link" can be opened by anyone who receives it, including someone it was forwarded to. Links also tend to stay active long after a matter closes.

Client portals

Where it works: Recurring exchanges with clients, especially in estate planning, family law, and business practices.

Where it falls short: A portal only helps if clients actually use it. Poor usability drives people back to email.

Personal file-sharing accounts

Where it works: It doesn't. Staff using personal cloud storage accounts to move client files creates serious risk, because the firm has no control over who has access or what happens when the employee leaves.

This last category is a form of "shadow IT," which we cover in how employees using unauthorized apps put your business at risk.

A Simple Decision Guide

Many firms find it helpful to sort documents into three tiers:

Writing this down and training staff on it removes guesswork. It also gives the firm a defensible answer if a client asks how their information was protected.

Cloud Sharing Settings Worth Reviewing

If your firm uses Microsoft 365 or a similar platform, a few settings make a large difference:

• Restrict "anyone with the link" sharing, or turn it off entirely.
• Default new links to specific people rather than everyone.
• Set expiration dates on external links.
• Require external users to verify their identity.
• Review externally shared files when a matter closes.

Our cloud services help firms configure these settings so they protect clients without frustrating attorneys.

Don't Forget the Other Side of the Exchange

Files coming into the firm deserve attention too. Phishing emails often disguise themselves as shared documents from clients or courts. Train staff to be cautious with unexpected sharing links, especially ones that ask them to sign in before viewing.

A Quick Example

An associate shares a folder of a client's tax returns with the client's accountant using an open link. Months later, the accountant forwards an email containing that link to a mortgage broker. The broker's assistant forwards it again. Nobody at the firm knows the documents are still accessible.

Had the link been restricted to the accountant's email address with a 30-day expiration, the chain would have stopped at the first forward.

Building Confidence With Clients

Clients increasingly ask how their information is protected. A clear file-sharing approach answers that question and strengthens trust. Maise Technology helps law firms put the right cybersecurity and data protection controls in place.

If you'd like help reviewing your firm's sharing practices, Schedule A 15 Minute Discovery Call.

This article is for general information and is not legal advice.

The email looks routine. Opposing counsel's paralegal sends updated wiring instructions for a settlement payment. The signature block is right. The case number is right. The tone matches every other message in the thread.

The only thing wrong is the bank account. And by the time anyone notices, the money is gone.

This is business email compromise, often shortened to BEC. For law firms, it's one of the most expensive and embarrassing threats there is, because it targets the exact moment when large sums move on a client's behalf.

What Business Email Compromise Looks Like in a Legal Practice

BEC isn't usually a virus. It's a con. Attackers either break into a real email account or create a look-alike address that's one letter off. Then they wait for the right moment to insert themselves into a conversation about money.

In law firms, the most common targets are:

• Settlement disbursements where funds move to or from opposing counsel.
• Trust account transfers involving client funds.
• Real estate closings handled by the firm.
• Vendor payments such as court reporters, experts, or e-discovery providers.
• Client retainers where a fake message asks the client to pay into a new account.

The FBI's Internet Crime Complaint Center (IC3) consistently ranks business email compromise among the costliest types of reported cybercrime.

Warning Signs Worth Pausing For

Most BEC attempts share a few patterns. None of them prove fraud on their own, but each one is a reason to slow down.

A change in payment instructions

This is the biggest red flag. Legitimate parties rarely change bank details in the middle of a matter. Any change should be treated as suspicious until confirmed by phone.

Urgency that discourages checking

"The court needs this today." "Our bank is closing the old account." Pressure is designed to make you skip verification.

A slightly different email address

Look closely. "smithlaw.com" can become "smith1aw.com" or "smithlaw-firm.com." On a phone screen, these are easy to miss.

Requests to keep things quiet

Messages that ask you not to copy a partner or to handle something "between us" deserve extra scrutiny.

Replies going somewhere unexpected

Attackers who control a mailbox sometimes create hidden rules that forward or delete messages. If clients say they never got your replies, investigate.

Building a Verification Habit That Actually Holds

Technology helps, but the strongest defense against BEC is a firm-wide rule that money doesn't move on email alone.

A practical verification procedure looks like this:

1. Collect wiring details early through a secure method, and record a verified phone number for the receiving party at the start of the matter.
2. Never use contact details from the email requesting payment. Call the number already on file.
3. Confirm any change in instructions by phone with someone you know, before funds move.
4. Require a second person to approve outgoing wires above a set amount.
5. Tell clients in writing that your firm will never change payment instructions by email.

That last step protects clients too. Attackers increasingly impersonate the law firm to trick clients into paying the wrong account.

Technical Controls That Reduce the Risk

Good habits work best with strong email security behind them. Key controls include:

• Multifactor authentication on every mailbox, so a stolen password isn't enough to log in.
• Email authentication records (SPF, DKIM, and DMARC) that make it harder for others to send mail pretending to be your domain.
• External sender warnings that flag messages coming from outside the firm.
• Alerts for new mailbox rules, especially forwarding to outside addresses.
• Look-alike domain monitoring to spot fake versions of your firm's name.

Out-of-office replies can also help criminals time their attacks. Our article on why your vacation auto-reply might be a hacker's favorite email explains why.

Professional Responsibility Considerations

Lawyers have duties around competence and safeguarding client property. ABA Model Rule 1.1 and its comments address technology competence, and Rule 1.15 governs safekeeping property. The ABA has also issued formal opinions on securing client communications. Requirements vary by state, so firms should check their own state bar's rules and guidance.

This isn't meant to alarm anyone. It's a reminder that wire fraud prevention isn't just an IT issue. It's part of protecting clients.

If a Wire Goes to the Wrong Account

Speed matters more than anything else.

• Call your bank immediately and ask them to recall the transfer.
• File a report at ic3.gov as quickly as possible.
• Preserve the emails and don't delete anything.
• Contact your cyber insurance carrier and legal counsel.
• Have the affected mailbox reviewed to find out how the attacker got in.

To see how one large scam unfolded, read the holiday scam that cost one company $60 million.

Protecting Your Firm Before the Next Settlement

Business email compromise succeeds when trust and routine meet a lack of verification. A clear process, strong email security, and staff who feel comfortable slowing down can stop most attempts.

Maise Technology helps law firms strengthen email and cybersecurity protections without adding friction to client service. When you're ready to review how your firm handles wires and mailbox security, Schedule A 15 Minute Discovery Call.

This article is for general information and is not legal advice.