Office hardening
Hardware-key sign-in on firm email, a password manager for the whole office, encrypted laptops and phones, and backups we restore once to prove they work. Fixed scope, a few days, one plain report.
For solo & small firms · Chicagoland
Your duty of confidentiality now runs through your laptop.
We harden small law offices, stop the wire-fraud email before it costs a client their settlement, and write the AI-use policy your firm will need. You stay the lawyer. We handle the machines.
Taking first conversations now · engagements start January 2027
“A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.”
Illinois Rule of Professional Conduct 1.6(e), effective January 1, 2016
What we do
Wire-fraud controls
Retainers and settlements move money, and changed payment instructions arrive by email. We set up a call-back rule, train the office on it, and lock down the mailboxes attackers aim for.
AI-use policy and tool review
A written policy and an approved-tool list, built on ABA Formal Opinion 512 and the Illinois Supreme Court's AI policy. We read each tool's data terms so you don't have to. We draft; you decide.
Breach-ready in one page
Who to call, what to preserve and what to tell clients if something goes wrong, written before it does. Plus a 45-minute session for staff on the emails that start most incidents.
Thirty seconds, and nothing leaves this page
Tick what is already true at your firm. No script reads these boxes, this page's security policy forbids it from making any connection, and the stylesheet that draws them is ten kilobytes you can read: nothing you tick can go anywhere. Each unticked line says which duty it touches and what the fix looks like.
Confidentiality, 1.6(e). The mailbox is where client files and wire fraud both live. The fix: hardware-key sign-in on every mailbox, the administrator's first.
Safekeeping client funds, 1.15. Changed wiring instructions by email are how settlements go missing; a misdirected wire is a 1.15 problem before it is anything else. The fix: a written call-back rule, trained, kept by every desk that moves money.
Confidentiality, 1.6(e). A lost laptop with an unencrypted drive discloses every file on it. The fix: full-disk encryption on, screen lock within five minutes, remote wipe for phones.
Competence, 1.1 cmt. 8. A backup nobody has restored is a hope. The fix: a copy the office network can't delete, restored once to prove it.
Confidentiality, 1.6(e). One reused password turns someone else's breach into yours. The fix: a manager for the whole office, one login per person.
ABA Opinion 512; the Illinois Supreme Court's AI policy. You stay accountable for what a tool does with client information. The fix: a one-page policy and an approved list, each tool's data terms read first.
Communication with clients, 1.4; ABA Opinion 483. Clients must hear about a material breach of their information. The first hour of an incident goes to finding phone numbers unless they are written down. The fix: a breach one-pager: carrier, counsel, IT, what to keep, what to tell clients.
Supervision, 5.3 and cmt. 3. Every administrator account is a key to everything, including the ones your IT provider holds. The fix: list them, remove the ones nobody can explain, keep two.
All eight in place. The next step is proving it once a year, in writing.of eight in place. The unticked lines are where we would start.
General information, not legal advice; your obligations depend on your practice and your clients. The ticks live only on your screen and vanish when you leave.
The insurance questionnaire, decoded
Cyber-insurance applications ask small firms roughly the same ten questions, and a “no” raises the premium or ends the conversation. Each one in plain words, and what answers it. Carriers differ; these are the ones that recur. Not insurance advice.
“Do you enforce multi-factor authentication on all email accounts?”
Every mailbox needs a second step to sign in, with no exceptions for partners. It is the first question carriers ask. Answered by: office hardening (hardware keys on email).
“Is MFA enforced for remote access and for administrator accounts?”
Anything reachable from outside the office (remote desktop, VPN, cloud admin consoles) needs the second step too, and the accounts that can change everything most of all. Answered by: office hardening.
“Do you run endpoint detection and response (EDR) on all computers?”
Antivirus that someone actually watches: software on every machine that reports what it sees to a person who will act. Microsoft's business-tier Defender (for Business or for Endpoint) usually qualifies; the free Windows antivirus on its own does not. Answered by: office hardening.
“Are backups kept offline or immutable, and are they tested?”
A copy that ransomware on the office network cannot reach or delete, and a restore someone has actually done. Answered by: office hardening (backups we restore once to prove they work).
“Do you have email filtering and anti-phishing protection?”
The filtering your mail service already offers, turned on and tuned, plus a warning on mail from outside the firm. Answered by: wire-fraud controls.
“Do employees receive security awareness training?”
A short session, repeated, with a record of who attended and when. Carriers like to see phishing exercises too. Answered by: breach-ready in one page (the 45-minute staff session).
“Do you have a documented incident response plan?”
Not a binder: one page with names, numbers and the first steps, dated within the last year. Answered by: breach-ready in one page.
“Is there a procedure to verify changes to payment or wiring instructions?”
A written rule that any change to where money goes is confirmed by phone on a number you already had, and that everyone who moves money knows it. Answered by: wire-fraud controls.
“Are systems patched promptly, and is any software past end of life?”
Updates turned on and applied within days, and no computer still running a version its maker no longer fixes. Answered by: office hardening.
“Are laptops and mobile devices encrypted?”
Full-disk encryption on every laptop and phone that touches client files, with a lock screen. A lost encrypted laptop is a lost laptop; an unencrypted one is a breach. Answered by: office hardening.
The duties we build around
- Competence includes technology.Illinois Rule Comment 8 to Rule 1.1 (2016): to keep the requisite knowledge and skill, a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks of relevant technology. (2016): keep abreast of the benefits and risks of relevant technology.
- Confidentiality includes reasonable security.Illinois Rule Rule 1.6(e) (2016): a lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client. (2016), and ISBA Professional Conduct Advisory Opinion 16-06 (2016): a lawyer may store client files with a cloud provider if the lawyer takes reasonable steps to ensure the information stays confidential and secure. on storing client files in the cloud.
- Generative AI is permitted, and you remain accountable.Illinois Supreme Court Policy on Artificial Intelligence (effective January 1, 2025): AI use by lawyers and litigants is permitted; existing rules of professional conduct and court rules continue to apply, and the person using the tool is responsible for the result. (effective January 1, 2025) and ABA Formal Opinion 512 (July 2024): generative AI tools engage the duties of competence, confidentiality, communication, candor, supervision and reasonable fees. (2024): competence, confidentiality, client communication, candor, supervision, reasonable fees.
- You supervise the people and tools you rely on.Rule 5.3: a lawyer with managerial authority makes reasonable efforts to ensure the firm has measures giving reasonable assurance that non-lawyer assistants' conduct is compatible with the lawyer's obligations, and a supervising lawyer makes the same efforts directly. Comment 3 extends this to services outside the firm. That includes vendors, and it includes us. covers non-lawyer assistance, including us.
Tap a citation to read it in place. How we work: written authorization before we touch anything, you approve every change, every change can be undone, and you get a record of everything we did on your systems. Citations are paraphrased from the published text; confirm against the official sources.
Talk to us
Our mailbox is being set up. The address appears here the day it's live.
Chicago Legal Cyber is a technology and security service, not a law firm. Nothing on this site or in our work is legal advice, and no attorney-client relationship is formed by contacting us. Please don't send us confidential client information by email.