Law Office CyberSecure
Starter Kit$149
Professional$249
Law firm cybersecurity guide
Law firm cybersecurity policy template, mapped to ABA Formal Opinions 477R, 483 and 512
Lawyers have an ethical duty to protect client information, respond to breaches and use AI tools carefully. Here is what the ABA guidance says in plain English, and editable policies that put it in writing.
- Plain English
- Editable Word & Excel
- Free self-assessment
Updated October 18, 2026 · Get the free self-assessment
The requirement
What the ABA guidance expects, in plain English
Model Rule 1.6(c) requires lawyers to make reasonable efforts to prevent unauthorized access to or disclosure of client information. Rule 1.1 (competence, including Comment 8 on technology) and Rules 5.1 and 5.3 (supervising lawyers and staff) extend that duty across the firm.
Formal Opinion 477R (2017) explains what reasonable efforts look like for electronic communications: understand your risks, use appropriate security such as encryption for sensitive matters, train staff and vet vendors.
Formal Opinion 483 (2018) covers what to do after a data breach: monitor for breaches, act reasonably to stop them and restore systems, and tell current clients when their information was or may have been compromised.
Formal Opinion 512 (2024) applies these duties to generative AI. Lawyers must understand the tools they use, protect confidential information put into them, supervise their use and be candid about fees.
Requirement by requirement
Where each requirement is covered in the Law Office CyberSecure kit
Every document is editable Word or Excel. Items marked Pro are in the Professional Edition only.
| Requirement | What it means for you | Kit documents |
|---|---|---|
| Reasonable security (Rule 1.6(c), Op. 477R) | Written security program scaled to your firm and clients. |
|
| Secure communications (Op. 477R) | Encrypt sensitive email and files; secure remote work. |
|
| Access control and MFA | Lock down document management, email and billing systems. |
|
| Supervision and training (Rules 5.1, 5.3) | Train attorneys and staff and get signed acknowledgments. |
|
| Vendor and cloud diligence (Op. 477R) | Vet cloud and IT providers before trusting them with client data. |
|
| Breach response and client notice (Op. 483) | Detect, stop and recover, then evaluate client notice. |
|
| Generative AI (Op. 512) | Rules for which AI tools may be used, and how. |
|
| Trust account and wire security | Verify every wire and payment instruction change. |
|
| File retention | Keep and dispose of client files on a schedule. |
|
See a sample page
What the Information Security Policy looks like
Plain-language templates with bracketed fields for your details, policy IDs that stay the same when you upgrade, and a footer reminding you to customize before use.
- Download right after checkout
- Edit in Microsoft Word, Google Docs or any word processor
- One-time price: Starter $149 · Professional $249
What's inside
Every file in each edition
Policy numbers carry over from the Starter Kit to the Professional Edition, so you can start small and upgrade without renumbering.
Starter Kit
$14922 editable files
Policies 15
- LO-CYB-001Information Security Policy
- LO-CYB-002Cybersecurity Roles & Responsibilities Policy
- LO-CYB-003Risk Management Policy
- LO-CYB-004Password & Authentication Policy
- LO-CYB-005Access Control Policy
- LO-CYB-006Multi-Factor Authentication Policy
- LO-CYB-007Acceptable Use Policy
- LO-CYB-008Security Awareness & Training Policy
- LO-CYB-009Email & Phishing Security Policy
- LO-CYB-010Endpoint Security Policy
- LO-CYB-011Mobile & Remote Work Policy
- LO-CYB-012Data Protection & Encryption Policy
- LO-CYB-013Backup & Recovery Policy
- LO-CYB-014Incident Response Policy
- LO-CYB-015Business Continuity & Disaster Recovery Policy
Plans, guides & assessments 6
- WordProfessional Implementation Guide
- WordEmployee Cybersecurity Guide
- WordIncident Response Plan
- Word30-60-90 Day Action Plan
- Word50-Point Cybersecurity Checklist
- WordCybersecurity Maturity Assessment
Workbook 1
- ExcelLaw Office CyberSecure Toolkit
Professional Edition
$24940 editable files
Policies 21
- LO-CYB-001Information Security Policy
- LO-CYB-002Cybersecurity Roles & Responsibilities Policy
- LO-CYB-003Risk Management Policy
- LO-CYB-004Password & Authentication Policy
- LO-CYB-005Access Control Policy
- LO-CYB-006Multi-Factor Authentication Policy
- LO-CYB-007Acceptable Use Policy
- LO-CYB-008Security Awareness & Training Policy
- LO-CYB-009Email & Phishing Security Policy
- LO-CYB-010Endpoint Security Policy
- LO-CYB-011Mobile & Remote Work Policy
- LO-CYB-012Data Protection & Encryption Policy
- LO-CYB-013Backup & Recovery Policy
- LO-CYB-014Incident Response Policy
- LO-CYB-015Business Continuity & Disaster Recovery Policy
- LO-CYB-016Vendor & Cloud Provider Security Policy
- LO-CYB-017Generative AI Acceptable Use Policy
- LO-CYB-018Vulnerability & Patch Management Policy
- LO-CYB-019Client File Retention & Litigation Hold Policy
- LO-CYB-020Wire Transfer, Trust Account & Payment Security Policy
- LO-CYB-021AI Governance Policy
Plans, guides & assessments 8
- WordProfessional Edition Implementation Guide
- WordIncident Response Plan & Playbooks
- WordTabletop Exercise Kit
- Word30-60-90 Day Action Plan
- WordAttorney & Staff Cybersecurity Quick Guide
- Word50-Point Cybersecurity Checklist
- WordCybersecurity Maturity Assessment
- Word50-Question Law Office Cybersecurity Self-Assessment
Forms & templates 10
- FORM-01Wire & Payment Verification Form
- FORM-02Access Request Form
- FORM-03Departure & Offboarding Checklist
- FORM-04Ethical Wall Screening Notice
- FORM-05Security Exception Request
- FORM-06Incident Intake Form
- FORM-07Vendor Security Questionnaire
- FORM-08Policy Acknowledgment Form
- FORM-09Client Notice Evaluation Worksheet
- FORM-10Management Review Record
Workbook 1
- ExcelLaw Office CyberSecure Professional Toolkit
Questions
Frequently asked questions
Are lawyers required to have a cybersecurity policy?
The Model Rules don't name a specific document, but Rule 1.6(c) requires reasonable efforts to protect client information. A written policy is the clearest way to show what your firm does and to train the people you supervise.
What does ABA Formal Opinion 483 require after a breach?
Monitor for breaches, act reasonably and promptly to stop a breach and mitigate the harm, and inform current clients when a breach has compromised, or may have compromised, their confidential information.
Does the kit include a generative AI policy?
Yes. The Professional Edition includes a Generative AI Acceptable Use Policy and an AI Governance Policy that reflect the themes of Formal Opinion 512.
Do state bar rules differ from the ABA?
Yes. Your state's rules and ethics opinions control. Check them and adjust the templates.
Is this legal advice?
No. These are editable templates and education. Cybriva is not affiliated with the ABA.
Free download
Free Law Office cybersecurity self-assessment
Answer 50 yes / no / not sure questions across 10 areas. Score your results and get clear next steps for your industry.
- Small Business, Law Office, Real Estate, Healthcare, Accounting & Tax, Insurance Agency, Financial Advisor, Auto Dealer, Mortgage & Title, and Cyber Insurance Readiness editions
- Starred priority questions and a scoring table
- Printable PDF
Your assessment is ready
Thanks. Your download should start automatically. If it doesn't, use the button below.
Download the PDFQuestions about your results? Email info@cybriva.ai.
Ready to put it in writing?
Get the Law Office CyberSecure kit
Start with the Starter Kit or get every policy, form and workbook in the Professional Edition. Policy numbers carry over if you upgrade.
See the full Law Office CyberSecure pageSources
- LawNext: ABA's first ethics opinion on generative AI (Formal Opinion 512)
- ABA Formal Opinion 512: Generative AI tools (overview, National Law Review)
- Oregon Lawyers Mutual: ABA opinions on lawyers' duty for cybersecurity (477R, 483)
This guide is plain-English education, current as of October 18, 2026. It is not legal advice, an audit or a compliance determination, and Cybriva is not affiliated with any regulator or standards body named here. Rules change and vary by state; confirm how they apply to you with your attorney or compliance advisor.