California Attorney Cybersecurity Rules

Cybersecurity Obligations for California Attorneys — What the Bar Requires, What’s at Stake, and How LBT Closes the Gap

lbttechgroup.com · +1 (916) 333-1062 · Sacramento, California · Veteran-Owned

WHY THIS FRAMEWORK IS DIFFERENT

Every other compliance framework threatens your business. This one threatens your license.

HIPAA fines, PCI penalties, and FTC enforcement are financial and operational consequences — serious, but ultimately absorbed by the firm as a business liability. The California Rules of Professional Conduct (RPC) are different in kind. A cybersecurity failure that exposes client data doesn’t just create a regulatory fine — it can trigger a State Bar disciplinary investigation, a formal complaint before the State Bar Court, and consequences that include public reproval, suspension, and disbarment.

For California attorneys, cybersecurity competence is not an IT matter. It is a professional duty — one that attaches personally to every licensed attorney in the firm, regardless of whether they ‘handle’ the technology. The attorney who doesn’t know what their MSP does, or doesn’t know whether client data is encrypted, is not absolved of their duty by ignorance. They are exposed by it.

Rule 1.1

competence includes technology

Rule 1.6

confidentiality — affirmative duty

2010-179

State Bar Formal Opinion on e-data

Personal

discipline attaches to the attorney

THE GOVERNING RULES

Four California RPC provisions every attorney’s IT program must satisfy.

The California Rules of Professional Conduct do not contain a dedicated cybersecurity provision. Instead, attorney cybersecurity obligations arise from the intersection of four existing rules applied to the digital handling of client information. Taken together, they create a comprehensive — and personally enforceable — duty of technological competence.

RULE 1.1 Competence

Obligation: A lawyer shall not intentionally, recklessly, or repeatedly fail to perform legal services with competence. Competence is defined to include the legal knowledge, skill, thoroughness, and preparation reasonably necessary for the representation — and since 2012, this has been interpreted to include technological competence.

Cybersecurity relevance: An attorney who does not understand the cybersecurity risks associated with their practice — how client data is stored, transmitted, and protected — is not competent within the meaning of Rule 1.1. The State Bar has consistently held that competence requires staying current with relevant technology developments. Ignorance of how your IT environment handles client data is itself a competence failure.

RULE 1.6 Confidentiality of Information

Obligation: A lawyer shall not reveal information protected by the attorney-client relationship unless an exception applies, and shall make reasonable efforts to prevent the unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.

Cybersecurity relevance: Rule 1.6 imposes an affirmative, ongoing obligation — not just a prohibition on intentional disclosure. ‘Reasonable efforts’ to prevent unauthorized access is a cybersecurity standard. Firms that lack encryption, MFA, endpoint monitoring, or access controls are failing this duty every day, regardless of whether a breach has occurred. The failure is the absence of the safeguards, not only the resulting disclosure.

RULE 1.15 Safekeeping Funds and Property of Clients and Other Persons

Obligation: A lawyer shall hold property of clients or third persons that is in the lawyer’s possession in connection with a representation with care required by law and shall keep it identified as such.

Cybersecurity relevance: Client files, documents, and data held in digital form are client property within the meaning of Rule 1.15. The obligation to safeguard client property applies to digital client data with the same force it applies to trust account funds. Failure to implement appropriate security controls for digitally held client files is a breach of this safekeeping duty.

RULE 5.1 / 5.3 Responsibilities Regarding Lawyers & Non-Lawyer Assistance

Obligation: Partners, managers, and supervisory attorneys have an obligation to make reasonable efforts to ensure that the firm has measures in place that give reasonable assurance that all lawyers’ and non-lawyer personnel’s conduct conforms to the Rules of Professional Conduct.

Cybersecurity relevance: Supervisory attorneys are responsible for the conduct of those they supervise — including non-lawyer staff who handle client data, and third-party vendors like IT providers and cloud services who process or store client information. If an MSP or vendor mishandles client data, the supervising attorney’s duty under Rules 5.1 and 5.3 requires them to have taken reasonable steps to prevent it. Vendor selection, oversight, and contractual safeguards are attorney duties, not IT decisions.

STATE BAR FORMAL GUIDANCE

What the California State Bar has specifically said about attorney cybersecurity.

State Bar Formal Opinion 2010-179

The California State Bar addressed attorney duties regarding electronic client data in Formal Opinion 2010-179, which concluded that attorneys transmitting confidential client information via the internet must take ‘reasonable steps’ to prevent unauthorized access. The Opinion identified factors relevant to what constitutes ‘reasonable’ in context:

• The nature of the threat to confidentiality of the electronic communication

• The degree to which the client’s confidential information is sensitive

• The possible impact on the client if confidentiality is breached

• The availability and cost of enhanced security measures

• The need for prompt communication with the client

The Opinion confirmed that attorneys may not simply transmit client data using default settings of third-party services without first assessing whether those defaults provide appropriate protection. The duty of reasonable care applies to the choice of technology, not just its use.

ABA Model Rule 1.6(c) — California Equivalent

The ABA amended Model Rule 1.6 in 2012 to add subsection (c): ‘A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.’ California’s Rule 1.6 incorporates equivalent language. The ABA has since issued a series of Formal Opinions (including 477R, 483, and 498) clarifying that ‘reasonable efforts’ includes assessing the security of cloud storage, remote access, and third-party vendor practices — all of which are squarely within the scope of a managed IT program.

DISCIPLINARY EXPOSURE

This is what non-compliance actually costs a California attorney.

STATE BAR DISCIPLINARY CONSEQUENCES

Suspension or Disbarment

Unlike financial penalties that a firm absorbs as a business cost, State Bar discipline attaches personally to the licensed attorney. Consequences escalate from private reproval through public reproval, actual suspension, and — in cases involving willful misconduct or harm to clients — disbarment. A disciplinary record is public, permanent, and searchable.

Outcome

Description & Permanence

Private Reproval

Issued by the State Bar; not public but recorded in the attorney’s confidential bar file. May be considered in future disciplinary matters.

Public Reproval

Publicly issued and searchable on the State Bar website. Appears in attorney profile indefinitely. Reputational consequences with clients, referral sources, and insurers.

Probation

Attorney placed on probation with conditions — may include ethics training, reporting requirements, and supervision. Violation triggers suspension.

Actual Suspension

Attorney prohibited from practicing law for a defined period. Must notify all clients, opposing counsel, and courts. Devastating to practice continuity.

Disbarment

Permanent revocation of license. Attorney may apply for reinstatement after five years but faces an extremely high burden. Effectively ends the legal career.

Civil Liability

A disciplinary finding creates strong evidence in a client’s malpractice action. Breach of Rule 1.6 — unauthorized disclosure of client information — directly supports a negligence claim.

Cyber Insurance Denial

Failure to implement ‘reasonable’ security measures — as required by the RPC — may constitute grounds for a cyber insurer to deny coverage on the basis that the firm failed to meet its own professional obligations.

HOW BREACHES TRIGGER DISCIPLINARY EXPOSURE

Three scenarios Sacramento law firms face — and what happens next.

Scenario

RPC Exposure

LBT Prevention

Ransomware encrypts client files

Rule 1.6 — failure to implement reasonable safeguards. Rule 1.1 — failure to understand technology risks. Bar complaint from affected client is likely. Civil malpractice exposure for damages caused by delay or disclosure.

EDR + 24/7 monitoring detects ransomware at execution. Immutable backups enable recovery without data loss. Documented incident response plan demonstrates reasonable efforts.

Staff email compromised, client funds diverted via BEC

Rule 1.15 — failure to safeguard client property. Rule 1.6 — unauthorized access to client communications. Disciplinary exposure plus trust account liability. Client’s financial loss may not be recoverable.

MFA prevents credential-only account access. Email security platform blocks spoofed wire instructions. SIEM detects anomalous login patterns before funds transfer.

Cloud storage vendor breached; client documents exposed

Rule 5.3 — failure to oversee third-party vendor. Rule 1.6 — unauthorized disclosure of client information. Bar may find failure to conduct reasonable due diligence on vendor security practices.

Vendor risk assessment and contractual security requirements. Encryption of all client data before cloud storage. Documented vendor oversight program satisfies Rule 5.3 duty.

WHAT ‘REASONABLE’ MEANS IN PRACTICE

The security measures the Bar expects a competent attorney to have in place.

The California State Bar and ABA Formal Opinions have collectively identified the following controls as components of a ‘reasonable’ security program for attorneys handling digital client data. Absence of any of these — in the event of a breach or Bar complaint — will be examined as evidence of a failure to meet the Rule 1.1 competence and Rule 1.6 confidentiality standards.

Security Measure

RPC Relevance

Multi-factor authentication (MFA)

Directly required to prevent unauthorized account access — Rule 1.6. Absence is indefensible in any post-breach disciplinary proceeding.

Encryption of client data at rest and in transit

Required under Formal Opinion 2010-179 for electronic transmission of confidential information. Applies to email, cloud storage, and portable devices.

Endpoint detection & response (EDR)

Demonstrates the ‘reasonable efforts’ standard of Rule 1.6 — proactive monitoring for threats targeting client data on firm devices.

Access controls & least privilege

Staff access to client files should be limited to what their role requires. Broad, uncontrolled access is a Rule 1.6 failure waiting to be discovered.

Vendor due diligence & written agreements

Rule 5.3 requires oversight of third parties handling client data. Written security agreements with cloud providers, IT vendors, and co-counsel are required, not optional.

Incident response plan

Required to demonstrate ‘reasonable efforts’ under Rule 1.6 — a firm that cannot respond coherently to a breach has not taken reasonable precautions against one.

Employee security awareness training

Rule 1.1 competence and Rule 5.1/5.3 supervisory obligations require ensuring staff understand and follow appropriate data security practices.

Regular security assessments

Formal Opinion 2010-179 requires ongoing evaluation of whether existing security measures continue to provide appropriate protection as threats evolve.

THE CYBER INSURANCE INTERSECTION

Your professional obligation and your insurance qualification are the same program.

California attorneys are increasingly required by clients, by firm professional responsibility committees, and by their own malpractice carriers to demonstrate that they maintain appropriate cybersecurity controls. The good news: the security program that satisfies the California RPC ‘reasonable efforts’ standard is the same program that qualifies a law firm for affordable cyber liability coverage.

What Cyber Insurers Require from Law Firms

The controls that underwriters require — MFA, EDR, encrypted backups, access controls, documented incident response plans, and security awareness training — are exactly the controls that satisfy the California RPC’s reasonable efforts standard. A firm that cannot qualify for cyber insurance at standard premiums has almost certainly not met its professional cybersecurity obligations either.

LBT’s managed program delivers both: the documented, continuously monitored security posture that satisfies Rule 1.6 and produces the underwriter-ready evidence package that qualifies for coverage — as a byproduct of normal operations.

COMMON COMPLIANCE GAPS IN SACRAMENTO LAW FIRMS

Where firms most often fall short — and where the Bar looks first.

⚠ No MFA on email or client matter management systems — the single most exploited access point and the most visible absence in any post-breach review

⚠ Client data stored in personal cloud accounts (Google Drive, Dropbox consumer) without security assessment or vendor agreement

⚠ No written security agreement with IT provider or cloud vendors — a direct Rule 5.3 violation that supervisory attorneys are personally exposed for

⚠ Unencrypted email used to transmit privileged communications — directly addressed by Formal Opinion 2010-179 as requiring reasonable precautions

⚠ No documented incident response plan — absence demonstrates the firm has not taken ‘reasonable efforts’ to prepare for a foreseeable breach

⚠ Staff with access to all client matters regardless of involvement — violates access control principles and creates unnecessary Rule 1.6 exposure

⚠ No security awareness training for non-attorney staff who handle client communications, documents, and financial data

⚠ Remote access via personal, unmanaged devices with no endpoint controls — client data on devices outside the firm’s security perimeter

HOW LBT BUILDS YOUR RPC-COMPLIANT SECURITY PROGRAM

A managed program that satisfies your professional obligations — documented and continuously maintained.

LBT Technology Group delivers a fully managed cybersecurity program for Sacramento law firms that is designed from the ground up to satisfy the California Rules of Professional Conduct’s reasonable efforts standard — and to produce the documentation that demonstrates compliance to the State Bar, to clients, and to cyber insurance underwriters.

✓ Security Risk Assessment (Rule 1.1 & 1.6)

A formal, documented assessment of cybersecurity risks specific to your firm’s environment, data types, and practice areas — satisfying the Formal Opinion 2010-179 requirement to evaluate the nature of threats to client confidentiality before relying on any technology.

✓ MFA & Access Control Implementation (Rule 1.6)

Configuration and ongoing management of multi-factor authentication across all firm systems, plus role-based access controls ensuring staff access only the client data their role requires.

✓ Email & Data Encryption (Formal Opinion 2010-179)

Implementation of email encryption, secure client portal alternatives to email for sensitive communications, and encryption of client data at rest on firm devices and cloud storage.

✓ Vendor Security Review & Written Agreements (Rule 5.3)

Assessment of all third-party vendors handling client data, with written security addenda or data processing agreements that document the vendor’s security obligations and satisfy the supervisory attorney’s duty of oversight.

✓ Written Incident Response Plan (Rule 1.6)

Development and annual testing of a written incident response plan that addresses detection, containment, client notification, and State Bar reporting obligations — demonstrating the ‘reasonable efforts’ standard in documented, auditable form.

✓ 24/7 Monitoring & EDR (Rule 1.6)

Continuous monitoring of all firm endpoints, servers, and email systems with endpoint detection and response — providing the proactive threat detection that the reasonable efforts standard requires and that most firm IT setups completely lack.

✓ Security Awareness Training (Rule 1.1 & 5.1/5.3)

Annual attorney and staff security awareness training covering phishing recognition, safe data handling, remote work security, and client confidentiality obligations — satisfying the supervisory attorney’s duty to ensure staff conduct conforms to professional obligations.

✓ Compliance Documentation Package

A maintained documentation set — risk assessment, security policy, vendor agreements, training records, incident response plan — that demonstrates to the State Bar, to clients, and to cyber insurers that reasonable efforts have been made and are ongoing.

Is Your Firm Meeting Its RPC Cybersecurity Obligations?

Schedule a complimentary scoping consultation. LBT will review your firm’s IT environment against the California RPC’s reasonable efforts standard, identify gaps that create disciplinary exposure, and show you exactly what it takes to close them — at no cost and no obligation.

BOOK YOUR FREE LEGAL SECURITY ASSESSMENT →

+1 (916) 333-1062 · lbttechgroup.com · Sacramento, California

This document is for informational purposes only and does not constitute legal advice. Consult qualified legal counsel regarding your specific professional responsibility obligations.