What is Evolving Technology Solutions?

Evolving Technology Solutions manages 5 data types including leads. Helps you organize, track, and share your work in 1 place for teams and solo users.

What are ABA cybersecurity obligations under Rules 1.1 and 1.6?

ABA Model Rule 1.1 (Competence) requires lawyers to understand relevant technology, including cybersecurity, as part of their duty of competence. Rule 1.6 (Confidentiality) requires reasonable measures to prevent unauthorized disclosure of client information. Together, they obligate firms to actively assess and manage cybersecurity risk, not simply avoid obviously negligent behavior.

What is zero-trust and why does it matter for law firms?

Zero-trust is a security architecture that assumes no user or device is inherently trusted, requiring continuous verification before granting access to any resource. For law firms, this means even internal users and devices must authenticate, authorize, and prove context before accessing client files or systems. It directly limits the blast radius of a compromised credential, the most common attack vector in legal-sector breaches.

How do you protect IOLTA accounts from wire fraud?

IOLTA wire fraud typically involves business email compromise (BEC), an attacker intercepts or spoofs communications to redirect transfers. Protections include multi-factor authentication on all email and banking portals, encrypted email for sensitive client communications, internal verification protocols for wire instructions received via email, and staff training on identifying BEC attempts.

Do small firms really get targeted by hackers?

Yes, and at disproportionate rates. Law firms are high-value targets because they hold client funds, privileged communications, M&A details, and litigation strategy. Attackers specifically target small and mid-size firms because they hold large-firm data with small-firm security budgets. The ABA's annual Legal Technology Survey consistently shows 25-30% of responding firms have experienced a security breach.

⚠ DRAFT, Update with real client metrics and obtain written client approval before publishing. Metrics shown are placeholders.

Back to Case Studies

LegalABA ComplianceZero-Trust Architecture

Securing Client Data: How a Michigan Law Firm Met ABA Cybersecurity Standards

ABA Compliant

Rules 1.1 & 1.6

IOLTA

Account Hardened

32% → 4%

Phishing Click Rate

24/7

Security Monitoring

The Challenge

A mid-size Michigan law firm with 25 attorneys needed to meet ABA Model Rule cybersecurity obligations (Rules 1.1 and 1.6), protect privileged client communications, and modernize aging on-prem IT that was a liability, particularly for IOLTA account security and encrypted client document management.

The Solution

Evolv delivered managed IT services with vCISO leadership, building a zero-trust architecture tailored to the firm's case management and client communication workflows.

✓Implemented zero-trust architecture with conditional access and device compliance policies
✓Deployed encrypted email and document management aligned to ABA confidentiality requirements
✓Enforced MFA across all attorney and staff accounts, including case management and email
✓Hardened IOLTA account controls: MFA on banking portals, BEC awareness training, wire verification protocols
✓Ran quarterly phishing simulations; click rate fell from 32% to 4% over three training cycles

The Results

ABA Cybersecurity Compliant

The firm's security posture now satisfies ABA Rules 1.1 and 1.6 obligations, with documented policies, annual risk assessments, and a named Security Officer.

IOLTA Account Hardened

MFA, BEC training, and internal wire-verification protocols eliminated the firm's most direct financial fraud exposure.

Phishing Click Rate 32% → 4%

Simulated phishing click rate fell from 32% at baseline to under 4% after three quarterly training cycles, a critical outcome given BEC is the #1 legal-sector threat vector.

24/7 Security Monitoring

CaaS monitoring covers all endpoints, email, and network egress around the clock, with escalation SLAs that meet the firm's duty-of-care obligations.

Frequently Asked Questions

Ready to assess your firm's security posture?

Schedule a Law Firm Security Assessment with an Evolv vCISO.

Schedule a Law Firm Security Assessment