Corporate clients increasingly send outside counsel guidelines and security questionnaires before engaging a firm. The requests are predictable: MFA, encryption, incident notification, data return and destruction at matter end, vendor controls. The ethical baseline (Model Rule 1.6(c) and ABA Opinion 483), the common asks, and how mid-sized firms meet them without an enterprise security team.
Model Rule 1.6(c) requires reasonable efforts to prevent unauthorized access to or disclosure of client information, and ABA Formal Opinion 483 (2018) sets out duties after a breach, including notifying current clients. Clients now put more specific expectations in writing.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Deletion: firms keep everything forever because nobody owns the decision, which turns every breach into a larger one.
Shadow file sharing: personal cloud accounts used to exchange documents with clients and experts.
Old systems: a practice management or document server past its support date, still on the network.
Evidence: controls exist but nobody can produce proof quickly when a questionnaire arrives.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
Legal Holds and Records Retention on AWS: S3 Object Lock, Versioning and Getting Deletion Right
Retention is two opposite duties: keep what you must, delete what you should. S3 Object Lock gives you write-once storage with retention periods and legal holds that even administrators cannot bypass in compliance mode. How the modes work, how a legal hold differs from a retention period, and a design that keeps both duties straight.
Read
Generative AI for Law Firms: What ABA Opinion 512 Requires, and a Private Setup That Meets It
ABA Formal Opinion 512 applies existing duties to generative AI: competence, confidentiality, communication, candour and reasonable fees. Informed client consent is needed before putting client information into tools that learn from it, and boilerplate engagement language is not enough. The options for firms, from business chat plans to a private assistant on AWS, and what each means for those duties.
Read
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.