35-Point Cybersecurity Checklist for Legal Businesses in Orange County (2026)

Require employees to verify identity with a second factor (authenticator app, SMS, or hardware key) when logging into email. This prevents unauthorized access even if passwords are compromised. Check your email provider's MFA setup guide and enforce it within 48 hours.

Use TLS encryption (Transport Layer Security) or client-side encryption tools to encrypt emails containing confidential client information. Configure your email server to require encryption for external recipients or use a secure email gateway like Proofpoint or Mimecast.

Send fake phishing emails to staff and track who clicks malicious links or opens dangerous attachments. Use results to identify high-risk employees for additional training. Document test results for compliance records.

Document rules about password sharing, forwarding client emails, opening attachments from unknown senders, and reporting suspicious emails. Require staff sign-off. Reference ABA Model Rule 1.6 (confidentiality) in the policy.

Configure email servers to block rules that forward messages to non-company domains. This prevents attackers from exfiltrating client data if they compromise an employee account.

Configure your email gateway to block executable files (.exe, .bat), macro-enabled documents, and other high-risk formats. Enable sandboxing to detonate attachments in an isolated environment before delivery.

Configure your file server or cloud storage so attorneys only access files for cases they work on. Use folder permissions, security groups, and case-based naming conventions. Test access controls quarterly to verify no unauthorized access is possible.

Use AES-256 encryption for files stored on servers and laptops. Enable TLS 1.2+ for files in transit. If using cloud storage (OneDrive, SharePoint, Google Drive), verify encryption is enabled in settings. Document encryption methods in your security policy.

Use tools like ShareFile, Citrix ShareFile, or your practice management software's portal to share documents with clients. Portals provide audit trails, expiring links, and watermarking—requirements for ABA compliance and e-discovery.

Review your file structure and classify documents as Public, Internal, Confidential (Client), or Highly Confidential (Privileged). Apply metadata tags and labels. Train staff on classification rules. This supports ethical walls and e-discovery requirements.

Configure your file server or cloud storage to automatically delete or archive files after their retention period ends (per your document retention policy). This reduces breach risk and ensures compliance with State Bar record-keeping requirements.

Create a quarterly access review process. Document who has access to what data, remove former employees within 24 hours of termination, and update ethical wall configurations. Use a spreadsheet or IAM tool to track changes.

Enable BitLocker (Windows) or FileVault (Mac) on every device. Require strong passphrases. Track encryption status in your device inventory. If a laptop is stolen, encrypted data cannot be accessed without the passphrase.

Use MDM software (Intune, MobileIron) to require PIN/biometric locks, encrypt data, enforce app restrictions, and remotely wipe devices if lost or stolen. Configure policies that block rooted/jailbroken devices from accessing client data.

Configure devices to lock automatically after 10 minutes of inactivity. Require passwords of at least 14 characters with complexity rules. Use Group Policy (Windows) or Mobile Device Management to enforce organization-wide.

Deploy EDR tools like CrowdStrike, Microsoft Defender for Endpoint, or Sophos on all devices. EDR monitors for malware, ransomware, and suspicious behavior, and provides rapid response capabilities if a device is compromised.

Create a Bring Your Own Device (BYOD) policy that prohibits personal phones, tablets, and laptops from accessing confidential client information. If personal devices must be used, require MDM enrollment and compliance with company security standards.

Use Group Policy, Device Manager, or endpoint security software to block USB drives, external hard drives, and other removable media. This prevents data exfiltration. Whitelist approved devices (printers, monitors) only.

Deploy a VPN server (or use cloud-hosted VPN) and mandate VPN connections for anyone accessing client data outside the office. Use AES-256 encryption, strong authentication, and certificate-based VPN when possible. Document VPN policy in your security handbook.

Install or upgrade to a business-grade firewall (Cisco, Fortinet, Palo Alto) that inspects incoming and outgoing traffic, blocks malicious IPs, and includes intrusion detection/prevention (IDS/IPS). Enable logging for audit trails.

Separate office printers, guest WiFi, and development systems from servers storing client data. Use network segmentation to limit lateral movement if a device is compromised. Document your network topology.

Update WiFi routers to WPA3 (or WPA2 if WPA3 unavailable) with a strong passphrase. Disable WPS (WiFi Protected Setup) and hide SSID broadcast. Create separate guest WiFi without access to internal networks.

Use network monitoring tools (Wireshark, SolarWinds) or your firewall's logging to identify unusual traffic patterns, data exfiltration attempts, or unauthorized connections. Review logs weekly or set up automated alerts.

Maintain three copies of client data: original files, one local backup (external drive or NAS), and one offsite backup (cloud or remote data center). Test restores monthly. Ensure backups are immutable (cannot be deleted by ransomware). Document your backup schedule.

Simulate a data loss or ransomware scenario by attempting to restore from backup to a test environment. Document how long recovery takes. If recovery exceeds your Recovery Time Objective (RTO), adjust backup frequency or storage location.

Write a plan that details steps for identifying breaches, isolating systems, preserving evidence, notifying affected clients, and reporting to regulators. Assign roles (incident commander, legal, IT). Include contact info for forensics vendors, attorneys, and insurance brokers. Review with staff annually.

Create a spreadsheet with phone numbers for your IT support, cyber liability insurance provider, forensics firm (e.g., Mandiant, CrowdStrike), employment attorney, and California Bar legal hotline. Keep it updated and accessible to key staff.

Obtain a policy that covers breach notification costs, client notification, forensics, legal defense, and regulatory fines. Work with an Orange County insurance broker familiar with law firm risks. Review policy limits and exclusions annually.

Establish a process for notifying clients, opposing counsel, and the California Attorney General if a breach exposes personal information. Follow ABA Model Rule 4.4(d). Create a notification template and test sending notifications to a subset of clients.

Hire an external firm (BRITECITY or similar Orange County MSP) to perform a comprehensive security assessment, vulnerability scan, and penetration test. Use findings to create a remediation roadmap. Document audit results for compliance and insurance purposes.

Deploy automated tools (Nessus, Qualys) to scan your systems weekly for known vulnerabilities. Prioritize critical findings for patching within 30 days. Maintain a vulnerability register and track remediation progress.

Schedule monthly Windows/Mac updates (second Tuesday of month) and apply patches within 30 days for critical vulnerabilities. Document patching in a change log. Use Group Policy or patch management software to automate updates when possible.

Require attorneys, paralegals, and office staff to complete training on ABA ethics rules, confidentiality, phishing, password hygiene, and incident reporting. Use a learning management system or vendor platform. Track completion and maintain certificates for compliance records.

Send brief security tips (phishing red flags, password best practices, social engineering) to staff monthly via email or Slack. Include recent news about law firm breaches. Create a culture of security by celebrating staff who report suspicious activity.

Create written policies covering acceptable use, password standards, remote work, incident response, and data classification. Require staff sign-off annually. Update policies when regulations change or breaches occur. Store policies in a version-controlled system.