October is Cybersecurity Awareness Month, making it a good time for law firms to ask a practical question — “What can we do right now to reduce our cybersecurity risk?” For solo and small firms, cybersecurity can seem overwhelming. The threats appear technical, the vendors expensive, and the consequences of a mistake dire. But better cybersecurity does not always require a major technology project. Many of the most effective improvements are inexpensive, easy to implement, and focused on changing everyday habits.

Law firms are considered “soft targets” because although they are not in the direct business of securing sensitive information, they remain attractive because they often hold client information, including financial and other business records, litigation strategy, personal data, and credentials for court, banking, and governmental systems. Still, lawyers have professional duties to understand the benefits and risks of technology, protect confidential client information, supervise lawyers and staff, and communicate appropriately with clients.^[1] The goal is not perfection but reasonable, repeatable safeguards that make the firm harder to attack and better able to recover if something goes wrong.

10 Low-Cost, Simple Steps Every Law Firm Can Take Today

1. Build a security-first culture.

Cybersecurity starts with people. Everyone in the firm should understand why cybersecurity matters — protecting client confidentiality, preserving trust, meeting professional ethical obligations, and keeping the firm operational. Make it routine to discuss security at staff meetings. Encourage questions and make clear that reporting a suspicious email or a possible security mistake is expected and will not be punished. A culture in which people slow down, think first, and speak up is one of the cheapest and most effective defenses a firm can create against cyber threats.

2. Turn on multifactor authentication.

Multifactor authentication (MFA), which is sometimes referred to as two-factor authentication (2FA), requires something more than just a password to authenticate access to an account. When MFA is enabled on an account, authentication will require something the user knows (the password) plus something the user has (the MFA security code). That code might be delivered via an authenticator app on a smartphone, a text or email message, a biometric prompt, or a physical hardware key.^[2] MFA should be turned on whenever available. Stolen passwords are common, and attackers often try them across other commonly used accounts to see which ones share the same password. MFA does not make an account impenetrable, but it makes unauthorized access much harder, even if an attacker has obtained the password for that account.

3. Use a password manager and stop reusing passwords across accounts.

Most lawyers and staff members have too many accounts to remember unique, strong passwords for each one. That is why password reuse is so common and so dangerous. A password exposed in one breach can let attackers into other accounts as well.

A password manager generates and stores long, unique passwords for each account. Pick a reputable password manager, protect it with a strong master password, and turn on MFA for the password manager itself.^[3] An added benefit of using a password manager is that it can detect fake or spam account login pages. Password managers work by having the user save the username and password inside the password manager, along with the account’s associated login page. When the user returns to that login page, the password manager recognizes it as a saved account and offers the username and password that the user has associated with that account. If a user goes to a fake or spoofed page, the password manager will not recognize it as the saved login page and therefore will not offer the username and password to sign into that account. This can be a red flag that something is wrong with the sign-in page.

4. Keep software updated.

Software updates are not only for new features. They often fix known security vulnerabilities that attackers can exploit. So, turn on automatic updates for operating systems, browsers, and office software. Do this on mobile devices, router firmware, network devices like printers and scanners, and any other internet-connected devices. Do not ignore prompts to restart the device after an update has been installed. A good firm policy is simple — install updates promptly unless there is a specific business reason to delay.

Hackers know the timing of software updates, so users should, too. In the security industry, the second Tuesday of each month is known as “Patch Tuesday” because Microsoft and other major vendors schedule security updates to fix known vulnerabilities. The second Wednesday of each month is known as “Exploit Wednesday” because hackers start using the disclosed vulnerabilities as an attack point to target organizations that are not up to date on their security patches.^[4]

5. Train everyone to recognize phishing and social engineering attempts.

Training does not need to be long or expensive to be useful. Short, regular reminders are often better than a single lengthy annual lecture. Train lawyers and staff to be cautious about unexpected links, attachments, payment changes, urgent requests, file-sharing notifications, password-reset messages, and messages that appear to come from a trusted person but seem slightly off or unlike past communications with that individual. Generative AI has made scam emails and text messages more polished, so the old advice to look only for misspellings and bad grammar as evidence is no longer enough. A better habit is to slow down, scrutinize, and if anything seems off, independently verify it.

6. Create a simple verification rule for money and sensitive information.

Many costly attacks succeed because someone trusted an email, text message, phone call, or video meeting that requested money, credentials, or confidential information. Adopt a firm-wide rule that any requests to change payment instructions, send wiring information, purchase gift cards, disclose credentials, or release sensitive client information must be verified via a separate trusted communication channel. Do not reply to the suspicious message or use the phone number it provided. Use a known number, a client portal, or a previously verified contact method.

7. Back up data and schedule test restoration.

Backups are one of the best defenses against ransomware, hardware failure, accidental deletions, and losses from natural disasters. A practical approach is the 3-2-1 backup method.^[5] This approach recommends keeping three copies of all important data or files at any given time, on two different types of media, with one copy stored offsite, such as in the cloud.

A backup system alone is not enough. The firm must confirm that the backup works. Schedule a test restore at least once or twice a year (like testing a smoke detector twice a year), and document who is responsible for performing the test and for confirming whether it works.

Also of Interest

Cybersecurity at WSSFC

State Bar of Wisconsin practice management advisor Brent Hoeft will present a cybersecurity session at this year’s Wisconsin Solo & Small Firm Conference (WSSFC) in Wisconsin Dells, October 22-24. Learn more and register at wssfc.org.

Listen: Practice Pulse Podcast

For more law firm cybersecurity tips, check out the September episode of the Practice Pulse Podcast. Visit wisbar.org/practicepulse or wherever you get your podcasts.

8. Encrypt devices and require screen locks.

Laptops, phones, tablets, portable drives, and backup devices that can be lost or stolen should be encrypted and locked when not in use. Encryption helps protect the information stored on these devices by making the data unreadable without the proper login credentials or recovery key. Most modern computers and smartphones include built-in encryption options, but firms need to confirm that encryption is turned on.^[6] Require passwords, PINs, biometrics, or other screen locks on every device used for firm work, including smartphones used for email or client communication. Make sure these devices also have a finite inactive-time setting after which the device automatically locks and requires the user to log in again. Because these devices are portable and mobile, they are more likely to be lost or stolen. Therefore, ensure they are secured with encryption, have automatic screen lock enabled, and can be remotely wiped if lost or stolen.

9. Limit access to what people need.

Not everyone in the firm needs access to everything. Granting access and authorization only to necessary portions of the law firm strengthens cybersecurity. Limit access to sensitive client files, financial accounts, payroll information, administrative tools, and firm-wide administrative settings to the people who need them for their daily work. That way, if credentials are ever compromised, the damage is contained to what that account could reach. Remember to remove access promptly when someone leaves the firm or changes roles. This does not require complicated technology; even a simple access list that is reviewed quarterly can reduce the risk of accidental disclosure, intentional misuse by an employee, or damage from a compromised account.

10. Write down the basics before there is a crisis.

A short, written information security policy (ISP) is better than an unwritten verbal understanding. The ISP should explain:

• who is responsible for security,

• how passwords and MFA are handled,

• how client information is stored and shared,

• how devices are to be protected,

• how and to whom suspicious messages or activities are reported,

• who is responsible for the backups, and

• what to do and whom to contact if something goes wrong.

The firm should also maintain a basic incident response contact list that includes:

• IT support,

• cyber insurance contacts,

• banking contacts,

• malpractice carrier information, and

• firm leadership.

When a breach or ransomware event occurs, the firm will not have time to invent a process from scratch. No firm should be winging it in the middle of a cyber incident.

It’s Okay to Start Small, but Start Now

Cybersecurity does not need to begin with costly investments or even a complicated plan. A solo or small firm can make meaningful progress by focusing on the basics covered in this article. These steps are not shiny or glamorous, but they reduce some of the most common risks.

Cybersecurity Awareness Month is a useful reminder of these things, but cybersecurity is not a set-it-and-forget-it exercise. It is a process, and it is ongoing. It is a set of habits that must be formed and a culture that must be created. The firms that do best are not necessarily the ones with the biggest technology budgets. They are the ones that understand the risks, train employees on those risks and the “why” behind cybersecurity, and create a culture in which everyone has permission to pause before clicking, sending, or sharing. For law firms, this is not just good technology practice; it is part of protecting clients, preserving trust, and ensuring that the good name the firm has built up over the years is not put in jeopardy.

Endnotes

[1] Wisconsin Supreme Court Rules chapter 20 and other rules are available at https://www.wicourts.gov/supreme/sc_rules.jsp. ^

[2] An example of a physical key is a Yubikey. Yubico, How the Yubikey Works, https://www.yubico.com/products/how-the-yubikey-works/ (last visited Sept. 7, 2026). ^

[3] See Brent J. Hoeft, Securing Your Digital Practice, Wisconsin Lawyer, 98 Wis. Law. 43 (May 2025), https://www.wisbar.org/NewsPublications/WisconsinLawyer/Pages/Article.aspx?Volume=98&Issue=5&ArticleID=31023 ^

[4] See Usman, What is Patch Tuesday & Exploit Wednesday? A Comprehensive Guide, Cyber Security, Data Governance, https://compliancedirectsolutions.com/what-is-patch-tuesday-exploit-wednesday-importance-cybersecurity/ (last visited Sept. 7, 2026). ^

[5] See Yev, The 3-2-1 Backup Strategy of Data Protection, Backblaze (May 23, 2024) https://www.backblaze.com/blog/the-3-2-1-backup-strategy/. ^

[6] See Raimundo Coelho, Device Encryption Setup: Protecting Data on Phones, Laptops, and Tablets, SafeToolsHub (March 17, 2026) https://www.safetoolshub.com/blog/device-encryption-setup ^