Law Firms
Managed IT and Security for Law Firms That Hold Client Confidences.
We understand security and regulated businesses. A law firm holds privileged files, settlement funds and the details of its clients' worst days. We run the IT and the security around them, and the documentation clients and insurers ask for.
Small and mid-sized law firms and solo practitioners, from a single lawyer with an assistant to a multi-partner practice.
What a Law Firm Needs From an MSP
What Does Client Confidentiality Mean for Our IT?
The ABA Model Rules of Professional Conduct, Rule 1.6(c), say a lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client. Comment 18 to that rule lists factors for judging reasonableness: the sensitivity of the information, the likelihood of disclosure without added safeguards, the cost and difficulty of the safeguards, and how much they get in the way of representing clients.
Those factors read like a security plan. We run the technical safeguards, such as multi-factor authentication, patching, endpoint protection, encryption and backups, and write down what is in place. Whether the firm's efforts meet its own duties is for the firm and its bar to confirm.
Does Technology Competence Apply to My Firm?
Comment 8 to ABA Model Rule 1.1 says a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology. Virginia's comment to its Rule 1.1 asks lawyers to pay attention to the benefits and risks associated with relevant technology. Your state bar sets the rule that applies to you.
You do not have to become an IT expert. You need people who are, and a record of what they run. That is what managed IT and a virtual CISO give a firm.
Managed IT and Help Desk for Law Firms · Virtual CISO for Law Firms
How Do We Send Client Documents and Email Safely?
ABA Formal Opinion 477R addresses securing communication of protected client information. It says a lawyer generally may send client information over the internet where the lawyer has made reasonable efforts to prevent unauthorized access, and that special security precautions may be needed when the client or the law requires them, or when the information calls for a higher degree of security.
In practice that means multi-factor authentication on every mailbox, encrypted or access controlled sharing for sensitive files, and email filtering. Some clients, such as corporate legal departments, will also ask for specific measures in their outside counsel guidelines.
How Do You Stop Wire Fraud on Trust Account Funds?
Settlement and closing money moves by wire, and an attacker who reads a lawyer's email can pose as a client, a title company or opposing counsel and change the wiring instructions. Lawyers hold other people's money in trust, so the loss lands on clients and on the firm.
We protect the mailboxes, watch for the sign-in and forwarding rules that precede these attacks, and help the firm set a written call-back procedure for any change in payment details. Rules on trust accounts are set by your state bar; confirm the details with your counsel or bar.
What Happens if the Firm Has a Breach?
ABA Formal Opinion 483 addresses a lawyer's obligations after an electronic data breach or cyberattack. It says that when a breach involves, or has a substantial likelihood of involving, material client information, lawyers have a duty to notify clients and to take other reasonable steps. A written incident response plan, made before it is needed, helps the firm act in the right order.
We help write the plan, run the response with you, and restore from clean backups. What notice the firm owes, and to whom, is for the firm and its counsel to decide.
Can You Help With Client Security Questionnaires?
Corporate and institutional clients often send outside counsel guidelines and security questionnaires before they hand over work. Each answer has to be true and backed by something the firm can show. A virtual CISO reads the questionnaire against your environment, fills the gaps and prepares the supporting documents.
Can You Support Us On-Site in Northern Virginia?
Yes. We are based in Leesburg, Virginia, and work on-site across Northern Virginia. Support is remote first, and someone comes to the office when the work needs hands.
How We Cover It
6 SERVICESManaged IT and Help Desk
Lawyers and staff supported remotely, with patching and monitoring built in.
Microsoft 365 and Email Security
Mailboxes protected against phishing and wiring instruction fraud.
MDR and 24/7 SOC
Accounts, devices and cloud watched around the clock.
Backup and Ransomware Recovery
Matter files and mail backed up off-site and tested.
Security Awareness Training
Staff trained to spot phishing and payment change requests.
Our Services for Law Firms
5 SERVICESManaged IT and Help Desk
When a lawyer cannot open a matter file before a hearing, the cost is not only time. We run the computers, accounts and network a firm depends on, with security built in.
Microsoft 365 and Email Security
Client confidences and settlement money both travel by email. We run your Microsoft 365 tenant and the protection around the inbox, so a convincing message does not become a transfer.
Managed Security Monitoring (MDR and SOC)
Law firms are targets because of what they hold. Our monitoring watches your endpoints, accounts, cloud and network around the clock, and responds when something is wrong.
Backup and Ransomware Recovery
A court date does not move because the file server is encrypted. We back up the matters, mail and discovery data the firm runs on, keep a copy off-site and encrypted, and prove it restores.
Virtual CISO (vCISO)
Someone has to own security decisions, answer the questionnaire from your biggest client and tell the partners where the risk is. A virtual CISO does that part time, with our team behind them.
Compliance
We Run the Safeguards. Your Ethics Duties Are Yours to Confirm.
We are not a law firm and do not give legal advice. The ethics rules that apply to your firm are set by your state bar, and whether your safeguards meet them is for the firm and its bar to confirm. We run the technical safeguards and keep the evidence. Formal compliance engagements are delivered by our Compliance Division, Capital Cyber Compliance. Firms that want independent proof of their program can also look at CyberCert SMB1001 certification.
Start With Capital Cyber Compliance · CyberCert SMB1001 Certification
Frequently Asked Questions
5 QUESTIONSDo you give legal or ethics advice?
No. We are not a law firm. We run the IT and security, and explain what we run. What your state bar requires of your firm is for the firm and its bar to confirm.
Do you work with solo practitioners?
Yes. This page is written for solo practitioners and small and mid-sized firms. The service is scoped to the people and systems you have.
Do you support our case management and document management software?
We support the computers, accounts, network and security those systems run on, and work with the vendor's support when the problem is on their side. You choose your legal software.
Can you help with a client's outside counsel guidelines?
Yes. A virtual CISO reads the security requirements against your environment, helps close gaps and prepares the documents you send back.
How is it priced?
Managed IT and security are a fixed monthly cost scoped to your firm. We give you the number on the call.
Services for This Industry
Managed IT and Help Desk
Unlimited remote support, monitoring and maintenance at a fixed monthly cost.
Microsoft 365 and Email Security
Microsoft 365 set up, secured and run, with email protection against phishing and spoofing.
Managed Security Monitoring (MDR and SOC)
Round the clock monitoring, detection and response from a security operations center.
Backup and Ransomware Recovery
Encrypted, off-site backups that are tested, and a plan to restore the business after an attack.
Virtual CISO (vCISO)
Senior security leadership, a roadmap and governance, without a full-time hire.
Talk Through Your Firm's Security.
Pick a time. Tell us how many lawyers and staff you have and what software holds your client files.
Looking for CMMC? Our Compliance Division, Capital Cyber Compliance, delivers it.
Under 25 people? Apply for an in-kind cybersecurity grant from Cyber Grants Alliance, a nonprofit. No cost to you.