Law Firm Cybersecurity: A Wisconsin Practical Guide

Law firm cybersecurity is a professional duty, not an IT preference. In Wisconsin, attorneys must make reasonable efforts to protect client information, notify affected people quickly after a breach, and be able to get back to work when something goes wrong. This guide covers what the rules require, which controls matter most for a small or mid-sized firm, and how to build a plan you can defend to a client, an insurer, or the State Bar.

TL;DR

Wisconsin lawyers must protect client data under SCR 20:1.1 (competence) and SCR 20:1.6 (confidentiality), and the effort must be commensurate with the risks of your practice.
Under Wis. Stat. § 134.98, notice of a breach of personal information generally goes out within 45 days of discovery.
The baseline that matters most: multi-factor authentication, standard (non-admin) accounts for daily work, least-privilege access, and backups you have actually tested.
Plan for recovery, not just prevention. Assume an incident will happen and decide in advance who you call and how fast you restore.
If no one at your firm has the technical depth to assess risk, the ethics guidance points you to an IT expert. That is where a managed partner fits.

Why law firms are a target, and why size does not protect you
What Wisconsin requires of your firm
The baseline controls every firm should have
Plan for resilience, not a perfect defense
AI tools are now part of the security conversation
A risk-based starting point: the first 90 days
In-house, co-managed, or fully managed
Perspective: what we see in Wisconsin law offices
How we help law firms
FAQ
Sources

Why law firms are a target, and why size does not protect you

A law firm holds what criminals want in one place: Social Security numbers, financial account details, medical records, deal terms, litigation strategy. It also holds something they can exploit with pressure: a client relationship that cannot tolerate days of downtime before a filing deadline.

The most common mistake we see in Wisconsin is the belief that a ten-person firm is too small to be worth attacking. Attackers do not pick targets by name. They scan for exposed remote access, stolen passwords, and unpatched systems, and they find small firms because small firms are easier. Recent ABA guidance on cybersecurity basics says attorneys continue to face rising cyber threats and carry ethical, legal, regulatory, and contractual duties to safeguard confidential information.

Ransomware and phishing are the threats that come up most. Ransomware encrypts your files and demands payment, and the attacker may also steal the data and threaten to publish it. NIST's ransomware risk management profile describes exactly that two-part extortion. Phishing is usually how the attacker gets in. A stolen mailbox login is often enough to read client email, impersonate a partner, or redirect a wire.

What Wisconsin requires of your firm

There are three layers: professional ethics, state breach law, and the contracts you have signed with clients and insurers.

Ethics rules: competence and confidentiality

SCR 20:1.1 requires competence, and Comment 8 extends that to the technology you use. SCR 20:1.6 requires reasonable efforts to prevent unauthorized access to client information. The State Bar's Formal Ethics Opinion EF-15-01 is the clearest statement of how that applies in practice. It says lawyers may use cloud computing if they use reasonable efforts to address its risks, and that those efforts must be commensurate with the risks presented. Factors include how sensitive the information is, the potential impact of a breach, and the cost of safeguards.

Two points follow from that wording:

There is no fixed checklist. What is reasonable for a firm handling estate planning differs from a firm handling employment disputes for a manufacturer. You need a documented, risk-based judgment.
You are expected to get help. The opinion's logic is that a lawyer who lacks the technical knowledge to assess these risks should consult someone who has it. Outsourcing the work does not outsource the responsibility, but not seeking expertise is a harder position to defend.

The State Bar's own materials for solo and small firms, Cybersecurity for Solo and Small Firms, open by tying information security to these same rules and to the data breach statute.

State breach notification: 45 days

Wis. Stat. § 134.98 requires most businesses operating in Wisconsin to notify individuals when an unauthorized person acquires their personal information. According to the Department of Agriculture, Trade and Consumer Protection, notice must be given within a reasonable time, not exceeding 45 days after discovery. Exceptions exist where the data was encrypted or there is no material risk of identity theft or fraud. If more than 1,000 people are affected, you must also notify the national credit reporting agencies.

The statute is a legal obligation, not a best practice. The practical consequence: you cannot spend six weeks figuring out what was taken. You need logs, a forensic partner, and a decision path ready before the day you discover a problem.

Client notice under the ABA model rules

Separately from the statute, your clients are owed communication. ABA Formal Opinion 483 states that a lawyer must communicate with current clients about a data breach where material client information was, or is reasonably suspected to have been, accessed or disclosed. Not every incident triggers that duty. A ransomware event that never made client information unavailable for a material time or exposed to others may not. But you can only make that call if you can prove what happened, which requires monitoring and logging in place beforehand.

If a client's engagement letter or outside counsel guidelines set stricter security terms, those apply too. Corporate clients increasingly send security questionnaires. Having documented controls turns those from a scramble into an afternoon.

The baseline controls every firm should have

The federal guidance for small businesses is consistent and not exotic. CISA's small and medium business guidance points to multi-factor authentication, standard user accounts for day-to-day work, least-privilege access to sensitive data, and tested backups. Here is how that translates into a law office.

Control	What it means in a law firm	Failure it prevents
Multi-factor authentication	On email, practice management, document management, VPN, and any cloud portal. Prefer app-based or hardware prompts over text messages.	A phished password becoming a mailbox takeover
Standard accounts for daily work	Attorneys and staff do not log in as local administrators	Malware inheriting full control of a workstation
Least privilege	Matter-level access: the family law team does not need the corporate deal room	Insider error and wide-scale data exposure
Patching and endpoint protection	Managed, monitored, and reported on, not left to each user	Exploits of known vulnerabilities
Encrypted laptops and phones	Full-disk encryption and remote wipe	A lost bag becoming a reportable breach
Tested, isolated backups	Copies the attacker cannot encrypt or delete, restored on a schedule to prove they work	Paying a ransom because recovery failed
Secure remote access	VPN or equivalent, with exposed remote desktop closed	The most common route into small networks
Security awareness training	Short, recurring, with simulated phishing	The click that starts the incident

Email is where most incidents begin

Client communication, trust account instructions, and settlement figures all travel by email, which makes it the favorite entry point. Beyond MFA and filtering, give staff a simple habit: any request to change payment details gets verified by a phone call to a known number. Some firms also use email risk detection to keep urgent, deadline-bearing messages from getting buried, which helps a busy inbox surface what needs a human decision.

Remote access needs special attention

Exposed remote desktop is a recurring ransomware entry point. We wrote up the fix in our post on remote desktop security. If anyone at your firm connects from home or a courthouse hallway, confirm that access goes through a protected path with MFA.

Backups: the difference between an incident and a crisis

A backup that sits on the same network as your file server can be encrypted along with it. Look for immutable backups that cannot be altered once written, and test restores on a schedule. Recovery is a process, not a product, which is the point of our article on why ransomware recovery is not a backup product. Our backup and disaster recovery service is built around that idea: defined recovery targets, not just copies.

Plan for resilience, not a perfect defense

The ABA's guidance describes a shift from protection alone to resilience: detection, response, and recovery matter as much as prevention, because incidents are increasingly treated as inevitable. For a small firm the stakes are concrete. Extended downtime without a verified recovery plan can threaten the practice itself.

A workable incident plan for a law firm fits on two pages and answers these questions:

Who is the incident lead, and who covers if they are on vacation?
Who is on the emergency call list? Include your IT provider, ethics or breach counsel, your cyber insurer's claims line, and a forensic responder. Collect the numbers now, on paper as well as in a system that may be offline.
How do you isolate affected machines without destroying evidence?
What is the restore order? Email and matter management first, billing second, archives last.
Who decides on client notice, and what is the 45-day statutory clock counted from?
How do you communicate if email is down? A personal phone tree or a separate messaging channel works.

Our ransomware response plan walks through the technical side. Run a tabletop exercise once a year: thirty minutes, one scenario, and a written list of what broke in the plan.

AI tools are now part of the security conversation

If your attorneys paste client facts into a public AI chatbot, you may have disclosed confidential information to a third party. Wisconsin State Bar AI policy guidance treats AI use as part of technological competence under Rule 1.1. It stresses understanding the risks, such as hallucinated output and bias, requiring security protocols for any AI vendor, and keeping the attorney responsible for accuracy. Disclosure of AI use is strongly encouraged, but supervision and verification are the real ethical test.

Practical steps: approve a short list of tools, confirm in writing how each vendor stores and trains on your data, block unapproved tools where you can, and write a one-page policy staff actually read.

A risk-based starting point: the first 90 days

Do not try to fix everything at once. Sequence the work by what reduces the most risk fastest.

Days 1 to 30: see where you stand

Inventory devices, cloud accounts, and where client data lives.
Turn on MFA for email and every system that holds client files.
Remove local admin rights from daily accounts.
Run a restore test from your backups and record how long it took.

A structured cybersecurity risk assessment turns this into a written baseline you can show a client, an insurer, or a regulator. The NIST Cybersecurity Framework 2.0 small business quick-start guide is a free, voluntary structure for organizing the same work if you want to begin on your own.

Days 31 to 60: close the big gaps

Move backups to an isolated, immutable copy.
Standardize patching and endpoint protection across every machine.
Encrypt laptops and phones.
Put a written incident plan and call list in place.

Days 61 to 90: make it routine

Launch recurring phishing training.
Review who has access to which matters and trim it.
Adopt an AI use policy.
Schedule the annual tabletop and a quarterly review of the risk assessment, as the ethics opinion's moving-target standard implies.

In-house, co-managed, or fully managed

Most firms under fifty people do not have a full-time security professional, and the ethics guidance does not expect them to. The question is how to get the expertise.

Option	Best for	Trade-off
Do it yourself with an office manager	Solo practitioners with simple needs	Limited monitoring, no after-hours coverage, single point of failure
Hourly break-fix support	Occasional repairs	Reactive by design, so nobody owns your risk
Co-managed IT	Firms with an internal IT person who needs backup and tooling	Requires clear division of responsibilities
Fully managed IT and security	Firms that want one accountable party for infrastructure and security	You must choose a provider who documents what it does

What matters is accountability. Ask any provider for a defined service level, a written scope of what is monitored, and how they report to you. A firm that can show documented controls is in a far stronger position when a client asks pointed questions.

Perspective: what we see in Wisconsin law offices

We work with more than 150 local organizations, and the pattern in professional services is consistent. Firms rarely get hurt by an exotic attack. They get hurt by a gap that was known and not owned: an old remote access rule, MFA turned on for some people but not all, a backup nobody had restored since it was set up.

That is why we do not sell security as a menu of tiers. We run a standardized, fully loaded stack at a fixed cost per user, with 24/7 monitoring, proactive support, and security built in, so the controls in the table above are the default, not an upsell. For a law firm, predictable pricing matters as much as the technology. You can budget it, and you can show a client exactly what protects their files.

Our advice: treat IT as infrastructure you own, not an expense you minimize. Start with an honest assessment, fix the highest-risk items first, and write down what you did and why. The written record is what "reasonable efforts" looks like when someone asks.

, Dustin Collett

How we help law firms

If you want a clear starting point, begin with our IT & Security Assessment. It gives you a documented view of your risks and a prioritized plan. From there, our managed IT services cover monitoring, help desk, backup, and security for a fixed cost per user, and our legal IT services page explains how that applies to law firms. If you already have an internal IT person, co-managed IT adds our tools and coverage to their work. You can also take our free IT risk score for a quick first read.

FAQ

Do law firms need cybersecurity even if they are small?

Yes. Wisconsin's ethics rules on competence and confidentiality apply to every lawyer regardless of firm size, and the breach notification statute applies to most businesses operating in the state. Small firms are not exempt, and attackers scan for easy targets, not famous ones.

How quickly must a Wisconsin law firm report a data breach?

Under Wis. Stat. § 134.98, notice to affected individuals must be given within a reasonable time, not more than 45 days after discovery, subject to exceptions such as encrypted data. Client notice duties under the professional conduct rules are separate, so involve ethics or breach counsel early.

What is the first thing a law firm should do to improve security?

Turn on multi-factor authentication for email and every system holding client files, then verify that your backups can actually be restored. Those two steps address the most common ways small firms are compromised and recovered from.

Can we use cloud software and AI tools with client data?

Wisconsin's ethics opinion allows cloud computing when you use reasonable efforts to address its risks. For AI, you need to vet each vendor's security, keep confidential information out of unapproved tools, and verify all output yourself. Document the review.