The WISP & ABA Cybersecurity Checklist for Solo & Small Law Firms

Solo practitioners and firms up to about 25 attorneys — litigation, transactional, family, IP, personal injury, immigration, whatever the practice area. The rules are the same. The exposure — trust account fraud, spoofed wire instructions, ransomware on the document management system — is disproportionately higher for small firms because they are easier targets and lawyers are prime social-engineering targets.

Nothing here is legal advice for your specific ethics obligations. Check your state bar’s technology rules and any state-specific data protection statute. The checklist below reflects the pattern most bar associations converge on.

Three Model Rules do the heavy lifting for law firm cybersecurity. Between them and a handful of Formal Opinions, the ABA has been clear for years: lawyers must take reasonable steps to protect client data, and doing nothing is not reasonable.

Depending on where your firm operates or where your clients reside, you may have a written information security program statutory obligation on top of ethics rules.

• ✓Massachusetts (201 CMR 17.00). Applies to anyone owning or licensing personal information about a Massachusetts resident. Requires a written information security program with specific controls, including encryption of portable devices and transmitted PI.
• ✓New York (SHIELD Act + 23 NYCRR 500 for firms that qualify as financial institutions). SHIELD requires reasonable safeguards for private information of NY residents. Firms handling financial matters may separately qualify under Part 500.
• ✓California (CCPA/CPRA). Rare for a firm to be directly covered, but if you provide services to a covered business, contractual obligations flow to you.
• ✓State-specific bar guidance. New York, California, Pennsylvania, Texas, and Illinois bar associations have all published formal opinions on cloud storage, encryption, and vendor use. Check yours.

If you cannot say for certain whether you are covered, assume you are and build the program. The controls are the same either way.

A written information security program for a small law firm does not need to be fifty pages. It needs to be complete. At minimum:

• ✓Named security coordinator. The partner or attorney responsible. Can be the managing partner in a small firm. Named in writing.
• ✓Scope statement. What information the WISP covers — client files, trust ledger, email, employment records — and where it lives.
• ✓Risk assessment. Reasonably foreseeable threats. For law firms in 2026: business email compromise wiring fraud, ransomware on the DMS, phishing of paralegals, stolen laptops, insider misuse.
• ✓Administrative safeguards. Access policies, employee onboarding/offboarding, training, sanctions, vendor management.
• ✓Technical safeguards. MFA, encryption, patching, backups, logging. Detailed enough that a new IT vendor could follow it.
• ✓Physical safeguards. Locked file rooms, clean-desk policy for confidential matters, visitor sign-in, laptop cable locks or lockable drawers.
• ✓Incident response plan. What happens the day something goes wrong. Contacts, notification decisions, evidence preservation.
• ✓Ongoing review. Reviewed at least annually, plus after any incident or material change (new practice area, office move, adoption of new tools).

• ✓Multi-factor authentication on email. The single most important control. Business email compromise fraud against law firms is a multi-billion-dollar industry; nearly every case begins with a stolen mailbox password. Turn on MFA today if you have not.
• ✓MFA on the document management system, portal, and any tool holding client data. Includes iManage, NetDocs, Clio, MyCase, Filevine, and every one of their peers. If a vendor does not offer MFA, that is a question to raise with them.
• ✓Full-disk encryption on every device. Laptops, workstations, tablets, phones. In Massachusetts and a growing list of other states, transmitting or storing unencrypted PI is itself a violation.
• ✓Encrypted email or secure client portal for privileged material. ABA Opinion 477R does not require encryption for every email — but sensitive matters, financial instructions, and personally identifiable information warrant it. When in doubt, encrypt.
• ✓Wire-instruction verification protocol. Never accept new or changed wire instructions by email alone. Call the client at a phone number from your file — not one supplied in the email. Document the call. This single practice defeats most social-engineering wire fraud.
• ✓Access controls — matter-based. Attorneys and staff can access the matters they work on. Ethical walls for lateral hires and conflicts. Terminated staff removed within 24 hours.
• ✓Unique named user accounts. No shared ‘paralegal’ login. Every human has their own account with their own MFA.
• ✓Automatic backups, tested. Cloud-based DMS handles this for the most part. Verify what your backup actually captures and restore a test document quarterly.
• ✓Patching on a schedule. Operating systems and apps updated automatically. End-of-life OS retired.
• ✓Endpoint protection. Modern EDR or reputable antivirus on every device. Managed by whoever handles your IT.
• ✓Logging and monitoring. At least sign-in logs enabled on email and DMS. Reviewed periodically. Alerting for impossible-travel sign-ins.

Every third party you rely on to handle client information falls under your Rule 5.3 obligation.

• ✓Written vendor list. Every service that could see client data. DMS, e-signature, court filing, litigation support, transcription, virtual receptionist, cloud storage, IT provider.
• ✓Confidentiality and security terms in every contract. The vendor commits to protect the data and notify you of incidents on a defined timeline.
• ✓Independent assurance where practical. SOC 2 report, ISO 27001 certificate, or written security responses. Ask; most reputable vendors will hand this over.
• ✓Periodic re-review. Once a year, glance at each vendor: still in business? still have a current SOC 2? still fits your workflow?
• ✓Cloud storage due diligence, per your state bar. Nearly every state bar has issued an opinion on cloud storage. Read yours, apply it. Reasonable care is fact-specific; note what you considered.

Opinion 483 imposes specific duties when a data breach occurs. The practical checklist:

• ✓Detect and stop. Have monitoring in place that would surface an incident (BEC, ransomware, unauthorized access). Detection is itself a competence obligation.
• ✓Restore. Backups you can restore from. Contact list on paper for your IT provider, incident response firm, and cyber insurance carrier.
• ✓Preserve evidence. Do not power off compromised systems in a way that destroys forensic data. Talk to counsel and your IR firm before you touch things.
• ✓Notify affected clients. Opinion 483 says you must notify current clients whose confidential information was materially affected. State breach laws add additional notification duties for personal information.
• ✓Document decisions. Write down what happened, when you knew, what you decided, who you told. Both a defense against a bar complaint and a training artifact.
• ✓Update the WISP. Post-incident review feeds back into the program. That closes the loop the rules expect.

1. Turn on MFA today, on every account that offers it. This is the highest-leverage action on the whole list.
2. Name your security coordinator. Write it down. This is the first page of your WISP.
3. Do a data inventory. Where does client information live? DMS, email, laptops, shared drives, paper files.
4. Adopt or adapt a wire-verification protocol. Write it, share it with staff, put it on the wall near anyone who touches IOLTA or trust funds.
5. Draft your WISP. Cover the eight sections above. Sign and date it.
6. Build the incident-response contact card. Print it. Store it offline.
7. Put “annual WISP review” and “annual training” on the calendar for next year.

VylintShield generates the written documents a small firm needs from a short questionnaire about your firm: the risk assessment, the incident response plan, the compliance checklist, and the access-control, data-handling, and staff-security-awareness policies that make up the body of a WISP — written against ABA Model Rules 1.1, 1.6, 5.1 and 5.3, not a generic template. You assemble them into your written program, and they are yours to keep.

The checklist above is the whole program. If you finish it in house, you are in far better shape than the median firm — and that is the point of publishing it.