Cybersecurity for Law Firms: An Oklahoma Lawyer's Practical Guide
Cybersecurity for law firms is no longer an IT preference. It is part of a lawyer's ethical duty. Firms hold exactly what criminals want: settlement figures, medical records, trade secrets and money moving through trust accounts. Yet many small practices still run on shared passwords, no incident plan and an IT contractor who only shows up when the printer breaks. This guide covers what the Oklahoma rules require, the threats aimed at legal practices and a step-by-step plan any firm in Oklahoma City, Tulsa or elsewhere can follow.
Get Protected
Endpoint Detectives watches law firm computers around the clock for $150 per workstation per year, billed annually up front. No hidden fees.
Why Is Cybersecurity Important for Law Firms?
Cybersecurity is important for law firms because they hold confidential client information that attackers can sell, ransom or use for fraud, and because the rules of professional conduct require reasonable efforts to protect it. A breach can mean lost clients, malpractice exposure and a bar complaint.
Law firms are attractive targets for three reasons. They hold sensitive data on many clients at once. They move money, which invites wire fraud. And smaller firms often have less security than the corporate clients whose information they hold, which makes the firm the easier door.
The industry's own numbers show the risk. In the ABA 2023 Cybersecurity TechReport, 29% of respondents said their firm had experienced a security breach, up from 27% the year before, and 19% did not know.
What Are a Lawyer's Ethical Duties for Cybersecurity in Oklahoma?
Oklahoma Rule of Professional Conduct 1.6(c), adopted by the Oklahoma Supreme Court in 2016 OK 91, says a lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.
That duty pairs with competence. Comment 6 to Oklahoma Rule 1.1 says competent lawyers should keep abreast of the benefits and risks associated with relevant technology. You do not need to become a security engineer, but you do need to understand the risks well enough to manage them or hire someone who can.
National guidance fills in the details. ABA Formal Opinion 477R addresses securing communication of protected client information, and ABA Formal Opinion 483 addresses lawyers' obligations after a data breach or cyberattack. Both stress reasonable, risk-based effort rather than perfection.
What Does Oklahoma Breach Law Add for Law Firms?
Oklahoma's breach notification law applies to law firms like any other business. Under Oklahoma SB 626, effective January 1, 2026, an entity must notify the Oklahoma Attorney General no later than 60 days after notifying affected residents when a breach affects 500 or more Oklahoma residents.
The same law rewards preparation. Under Oklahoma SB 626, an entity that used reasonable safeguards and gave the required notice faces no civil penalty and has an affirmative defense in a civil action. Our incident response plan guide shows how to document those safeguards before a breach.
What Threats Target Law Firms?
The main threats to law firms are phishing, business email compromise, ransomware and attacks through vendors. Most start with a person, not a piece of malware.
- Business email compromise. An attacker takes over or imitates an email account and sends fake wiring instructions before a closing or settlement.
- Ransomware. Files and case management systems are encrypted and often stolen first. The Verizon 2026 Data Breach Investigations Report found ransomware was present in 48% of breaches.
- Credential theft. Stolen passwords let attackers log in like an employee. The CrowdStrike 2026 Global Threat Report found 82% of detections were malware-free.
- Vendor compromise. E-discovery, billing and cloud document providers hold your data too. The Verizon 2026 DBIR found third-party involvement appeared in 48% of breaches, up from 30%.
Step 1: Inventory Client Data and Where It Lives
Start by mapping where client information sits. You cannot protect files you do not know you have.
List your practice management system, document storage, email, billing software, laptops, phones, backups and any cloud services. Note who can access each one. Pay special attention to old matters, personal devices and shared folders nobody has reviewed in years.
Step 2: Lock Down Email and Logins
Email is where most law firm attacks begin, so secure it first. Turn on multifactor authentication for every account, starting with partners and anyone who handles money.
There is room to improve. The ABA survey found 54% of respondents said two-factor authentication was available at their firm. Available is not the same as required. Make it mandatory.
Then add a wire verification rule. Any change to payment instructions gets confirmed by phone, using a number you already have on file, never one from the email.
Step 3: Protect Every Computer With EDR and Monitoring
Antivirus is not enough for a firm that holds privileged information. Use endpoint detection and response (EDR) on every workstation and server, and make sure someone watches it around the clock.
EDR records activity on each device so analysts can spot an attacker using stolen credentials, then isolate the machine before files are encrypted. Our managed EDR runs CrowdStrike on every endpoint, and our managed detection and response services add a 24/7 SOC (security operations center) to act on alerts. Endpoint Detectives analysts can respond to a confirmed threat in as little as 15 minutes.
Get Protected
Every Endpoint Detectives subscription includes the CrowdStrike EDR license, endpoint monitoring, network monitoring, cloud monitoring, vulnerability scanning, SIEM log aggregation, a 24/7 SOC and remote incident response.
Step 4: Write and Test an Incident Response Plan
An incident response plan tells everyone what to do in the first hours of an attack: who to call, what to shut off and how to preserve evidence. Most firms do not have one.
The ABA survey found only 34% of respondents said their firm had an incident response plan, down from 42% the year before. Your plan should name your outside IT and security contacts, your cyber insurer, outside breach counsel and the partner in charge. Our incident response plan guide has a starting outline.
Step 5: Review Insurance, Vendors and Client Requirements
Finally, look outward. Check your cyber coverage, your vendors' security and what your clients expect from you.
Insurance is thinning out. The ABA survey found 40% of respondents said their firm had cyber liability insurance, down from 46% in 2022. Clients are asking harder questions too: 27% of respondents had been asked by clients for the firm's security requirements, and 22% had been asked to complete a security questionnaire. A documented security program makes those questions easier to answer.
Independent review helps. The survey found 29% of respondents said their firm had a full security assessment performed by a third party. Our free cybersecurity risk assessment template is a practical place to begin.
What Should a Law Firm Do After a Data Breach?
After a data breach, a law firm should contain the attack, preserve evidence, bring in its insurer and breach counsel, and then work through its notice duties to clients and regulators. The order matters, and so does speed.
In the first hours, isolate affected computers rather than wiping them, reset compromised passwords and stop any pending wires. Call your cyber insurer early, because many policies require you to use approved forensic firms and lawyers. Document every decision and the time you made it.
Then work through notice. ABA Formal Opinion 483 discusses a lawyer's duty to inform current clients about a breach that affects their information. Oklahoma's breach law sets separate duties to affected residents and, for larger breaches, the Attorney General. Your breach counsel can help you meet both without saying more than the facts support. Our incident response services give you hands-on help during containment.
How Does Endpoint Detectives Compare for Law Firms?
Here is how a typical small firm setup compares with managed protection.
| Typical small firm setup | Endpoint Detectives | |
|---|---|---|
| Endpoint protection | Basic antivirus | CrowdStrike EDR, included |
| 24/7 monitoring | None | 24/7 SOC included |
| Email and cloud visibility | Limited | Cloud monitoring included |
| Vulnerability scanning | Rare | Included |
| Incident response | Hourly, after the fact | Remote incident response included |
| Price | Varies | $150 per workstation per year |
Common Mistakes to Avoid
- Trusting email for wire instructions. Always confirm by phone.
- Sharing logins. Every person needs a named account with multifactor authentication.
- No plan for a breach. Deciding who to call during an attack wastes the hours that matter most.
- Ignoring vendors. Ask how your cloud and e-discovery providers protect your data.
- Assuming you are too small. Solo and small firms are targeted precisely because they are less protected.
Tips for Oklahoma Law Firms
- Put security on the agenda of partner meetings at least twice a year.
- Train staff to spot phishing, especially around closings and settlements.
- Encrypt laptops and phones that hold client files.
- Keep backups offline or immutable so ransomware cannot reach them.
- Review the Oklahoma breach law with your malpractice carrier.
FAQ
Why is cybersecurity important for law firms?
Law firms hold confidential client data and move money, which makes them targets. Oklahoma Rule 1.6(c) also requires reasonable efforts to prevent unauthorized access to client information.
What are a lawyer's ethical duties for cybersecurity?
Lawyers must make reasonable efforts to protect client information and stay competent about the risks of relevant technology, under Oklahoma Rules 1.6(c) and 1.1.
Do law firms need cyber insurance?
Most firms benefit from it. Coverage helps pay for forensics, notification and legal costs after a breach. Insurers often ask about multifactor authentication and EDR.
What should a law firm do after a data breach?
Contain the threat, preserve evidence, call your insurer and breach counsel, then follow client notice duties and the Oklahoma breach notification law.
Conclusion
Cybersecurity for law firms is a professional duty, a client expectation and, in Oklahoma, part of breach law. Map your data, lock down email, put EDR and 24/7 monitoring on every computer, write a response plan and review your insurance and vendors. Reasonable effort, documented well, is what the rules ask for.
This article is general information, not legal or ethics advice.
Get Protected
Endpoint Detectives is headquartered in Oklahoma City and protects firms nationwide with 24/7 MDR for $150 per workstation per year, billed annually up front. No hidden fees. You deploy the agent yourself with our easy-to-follow guide. Contact us.
Born in Oklahoma. Hunting threats everywhere. Real humans. Real response. No corporate runaround. No hidden fees. No mercy for threats.
Last updated: October 28, 2026