Law Firm IT Setup Guide: Security and Ethics in Virginia

Who this is for and how to read it

This white paper is for managing partners, firm administrators and office managers at Virginia law firms with roughly 5 to 100 people and no full-time IT department. Every recommendation is labeled:

• Required A rule or statute requires it today.
• Recommended Official guidance recommends it, or it is how firms normally show "reasonable efforts."

We cite Virginia's rule numbers, which differ from the ABA Model Rules. This is general guidance, not legal or ethics advice. For a specific question, the Virginia State Bar's ethics hotline and your own ethics counsel are the right resources.

The rules that apply today

Competence and confidentiality

Required In December 2015 the Supreme Court of Virginia added a technology comment to Rule 1.1 (Competence): "Attention should be paid to the benefits and risks associated with relevant technology." It also added Rule 1.6(d), which requires a lawyer to "make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to" client information. Both took effect March 1, 2016. The matching ABA Model Rules are Rule 1.1, Comment 8 and Rule 1.6(c).

Comment [19] to Virginia's Rule 1.6 lists the factors used to judge whether efforts were reasonable: how sensitive the information is, how likely disclosure is without more safeguards, the cost and difficulty of more safeguards, the effect on the lawyer's ability to represent clients, and "the employment or engagement of persons competent with technology."

Vendors, cloud storage and remote staff

Virginia's Legal Ethics Opinion 1872, "Virtual Law Office and Use of Executive Office Suites," was approved by the Supreme Court of Virginia on October 2, 2019. It says a lawyer using an outside vendor to store or handle client information must choose the vendor carefully, review its technology and terms of service, instruct it to keep information confidential, and get help from someone qualified if the lawyer cannot judge the vendor alone. It also says a lawyer "is not required, of course, to absolutely guarantee that a breach of confidentiality cannot occur." The opinion applies Rule 5.3's duty to supervise non-lawyer staff to staff who are not physically in the office.

Generative AI

The ABA's Formal Opinion 512 (July 29, 2024) applies the competence, confidentiality, communication and fee rules to generative AI tools. In practice, that means knowing where a tool sends the text you type into it before you paste in client information.

Virginia's breach law

Required Like every Virginia business, a law firm that loses unencrypted Social Security, driver's license or financial account numbers must notify affected residents and the Virginia Attorney General without unreasonable delay (Va. Code 18.2-186.6). Encrypted data is excluded unless the key was also compromised. The Attorney General can impose a civil penalty of up to $150,000 per breach.

Step 1: Accounts, passwords and multi-factor sign-in

• Recommended Multi-factor sign-in (MFA) on email, remote access, cloud apps and every admin account. CISA's ransomware guide asks for phishing-resistant MFA on all services, starting with email and remote access. Prefer an authenticator app, passkey or security key over text messages.
• Recommended Long passphrases and a password manager. Current NIST guidance (SP 800-63B, Revision 4) says passwords used alone should be at least 15 characters, should be checked against lists of leaked passwords, and should not be forced to change on a schedule unless there is a sign they were stolen.
• Recommended One login per person and separate admin accounts. Day-to-day work happens on standard accounts. Only a few people hold administrator rights, on separate logins.
• Recommended Access ends on the last day. When someone leaves, turn off email, remote access, shared passwords and building access the same day.

For a firm, the most important account is email, because it is where clients send documents and where criminals send fake wire instructions. Turn on MFA there first.

Step 2: Email and wire fraud

The FBI's 2025 Internet Crime Report recorded more than $3 billion in business email compromise losses, and Virginia ranked 10th in the country in total cybercrime losses ($476.1 million). Real estate closings, settlements and trust account disbursements are prime targets.

• Recommended A written call-back rule. Any new or changed wire instructions are confirmed by phone, using a number from the file or the engagement letter, never the number in the email. Tell clients in your engagement letter that you will never change wire instructions by email.
• Recommended Email authentication. The FTC tells businesses to publish SPF, DKIM and DMARC records so criminals cannot easily send email that looks like it came from your domain.
• Recommended Encrypted email or a secure client portal for sensitive documents, and external-sender tags on incoming email.
• Recommended If money moves to a criminal, act in minutes. Call your bank to request a recall, and report it to the FBI at ic3.gov. The FBI says its Recovery Asset Team froze about 58% of the money it tried to recover in 2025 (about $679 million).

Step 3: Computers, phones and remote work

• Recommended Encrypt every laptop and phone that holds work data, so a lost device is a hardware problem, not a data breach. NIST's small-business guide calls for full-disk encryption on laptops and tablets.
• Recommended Turn on automatic updates, and patch internet-facing systems and anything on CISA's Known Exploited Vulnerabilities list first.
• Recommended Replace unsupported systems. Windows 10 support ended October 14, 2025. Machines that cannot upgrade yet need Microsoft's paid Extended Security Updates, which are only available for a limited time, and should be replaced.
• Recommended Endpoint protection that someone actually watches, on every computer. Alerts that nobody reviews do not stop an attack.

Recommended Remote and hybrid work. LEO 1872 applies supervision duties to staff who work outside the office. Practical controls are firm-managed laptops (not personal home computers) for client work, MFA and a VPN or secure access service for remote connections, and a short written policy on working from home and public Wi-Fi.

Step 4: Office network and Wi-Fi

• Recommended Separate networks for staff computers, guest Wi-Fi, and printers, cameras and other smart devices. CISA calls for network segmentation and a current diagram of how data moves.
• Recommended WPA3 Wi-Fi where your equipment supports it, with a long passphrase that changes when staff leave. Guests get internet access only.
• Recommended No remote desktop open to the internet. CISA says remote desktop should never be exposed directly. Use a VPN or secure remote-access service with MFA.
• Recommended A supported business firewall, kept updated and replaced when the manufacturer stops supporting it.

Many firms share space or use executive suites. LEO 1872 discusses executive office suites directly. If you share a network with other tenants, treat it as untrusted: use your own firewall and Wi-Fi for firm devices.

Step 5: Client files, cloud services and vendors

• Recommended Choose cloud services with care, and write down why. Following LEO 1872, record what you reviewed for each practice management, document management, email and backup vendor: its security, its terms of service, where data is stored, and how you get your data back if you leave.
• Recommended Limit access by matter where your systems allow it, especially for conflicts, sealed matters and HR files.
• Recommended Control file sharing. Turn off "anyone with the link" sharing for client folders and review external shares regularly.
• Recommended Vet AI tools before anyone pastes client information into them, consistent with ABA Formal Opinion 512.

Recommended In 2022, CISA, the NSA, the FBI and allied agencies published joint guidance for organizations that use a managed service provider (MSP). It says your contract should require MFA on every account the provider uses, least-privilege access, defined incident reporting, backup and incident-response duties, and prompt removal of the provider's access when the contract ends. Ask any IT provider, including us, to show you those terms in writing.

Step 6: Backups and staying open after an attack

• Recommended Offline, encrypted, tested backups. CISA's guidance is to keep offline, encrypted backups of critical data and regularly test them. Many offices follow the "3-2-1" practice (three copies, two types of storage, one off-site) to meet it.
• Recommended Back up cloud email and files too. Cloud services keep your data running, but they are not a full backup plan on their own. Check what is covered and for how long.
• Recommended Test a restore on a schedule and write down how long it took.

Court deadlines do not move because of ransomware. Decide in advance which systems must come back first, usually email, calendar and docketing, and the document management system, and how the firm will meet deadlines if they are down.

Step 7: When something goes wrong

• Recommended Write a one-page incident plan: who to call (your IT provider, your cyber insurer and breach counsel, your bank), how to disconnect an infected computer, and how to reach staff and courts if email is down. Keep a printed copy. NIST's incident response guidance (SP 800-61, Revision 3, April 2025) is the current federal reference.
• Required Know your notice duties. Virginia's breach law requires notice without unreasonable delay when covered personal information is exposed. Your duty to keep clients reasonably informed may also apply. Talk to ethics counsel about what to tell affected clients.
• Recommended Report crimes to the FBI at ic3.gov.

One-page setup checklist

How JPert can help

JPert is a managed IT and cybersecurity company in Vienna, Virginia, near Tysons. Rule 1.6's commentary recognizes "persons competent with technology" as part of reasonable efforts; that is the role we play for law firms across Northern Virginia. Read about IT for law firms, or book a free IT assessment.

Related reading from our Chronicles: wire fraud prevention for law firms, law firm incident response plan and Microsoft 365 security for law firms.

Sources

Every recommendation above comes from these official sources, checked on November 1, 2026:

• Supreme Court of Virginia: Order amending Rules 1.1 and 1.6 (effective March 1, 2016)
• Virginia State Bar: Rule 1.6 Confidentiality of Information
• Virginia LEO 1872: Virtual Law Office and Use of Executive Office Suites
• ABA Formal Opinion 512: Generative Artificial Intelligence Tools (July 29, 2024)
• Va. Code 18.2-186.6 (breach of personal information notification)
• FBI: 2025 Internet Crime Report
• FTC: Cybersecurity for Small Business
• NIST SP 800-63B Rev. 4: Authentication and passwords
• CISA: #StopRansomware Guide
• CISA, NSA, FBI and allied agencies: Protecting against cyber threats to MSPs and their customers (AA22-131A)
• NIST SP 800-61 Rev. 3: Incident response recommendations (April 2025)
• Microsoft: Windows 10 end of support and Extended Security Updates
• Wi-Fi Alliance: Wi-Fi security and WPA3
• NIST SP 1300: Cybersecurity Framework 2.0 Small Business Quick-Start Guide

This white paper is general information about IT and security practices, not legal or ethics advice. Rules and ethics opinions change; we review this paper when they do. See our editorial policy.