Data, privacy and safety · Module 110
⚖️ Cybersecurity for Legal, Accounting and Professional Services™
For lawyers, CPAs, tax preparers, bookkeepers, financial advisers, consultants and the staff and IT providers who serve them: 6 long lessons on the duties of competence and confidentiality under the Idaho Rules of Professional Conduct and the ABA opinions, client data, e-discovery, cloud and AI tools, trust accounts and client money, the FTC Safeguards Rule and IRS rules for tax and accounting firms, engagement letters and incident response, and business email compromise and wire fraud, with sample policies. Rules stated as of October 28, 2026.
Read this first
This module is general education about the security and confidentiality duties of law, accounting, tax and other professional firms. It is not legal, ethics, compliance, audit, accounting, tax, insurance or engineering advice, and reading it creates no attorney-client, accountant-client, consulting or audit relationship. Reading or using any part of it, including the sample policies, does not make a firm compliant with any rule of professional conduct, the FTC Safeguards Rule, IRS requirements, SEC Regulation S-P or any standard. Rules, opinions, penalty amounts and deadlines change: every lesson states the rule version and the date it was checked, and you should check the current text from the Idaho State Bar, the Idaho Supreme Court, the regulator (eCFR, the Federal Register, the FTC, IRS and SEC) or your licensing board before relying on any point.
Defensive content only: nothing here explains how to attack a system or carry out a fraud. Never change a production system, a bank setting or a payment process because of a web lesson; involve your security lead, your bank and qualified security professionals.
The high level view
Who this affects. Law firms of every size, solo lawyers, paralegals and legal assistants; CPA firms, enrolled agents, tax preparers and bookkeepers; financial advisers and insurance agencies; engineers, architects and consultants who hold client files; and the IT providers who run their systems. Clients are affected most of all: these firms hold Social Security numbers, tax returns, bank records, deal secrets, medical records from lawsuits and money in trust. The FBI's Internet Crime Complaint Center counted 24,768 business email compromise complaints and about $3.05 billion in reported losses in 2025, and Idahoans reported $88.7 million in losses to all internet crime that year.
The main rules, as of October 28, 2026.
- For lawyers, the Idaho Rules of Professional Conduct (Idaho State Bar text current as of March 9, 2026): Rule 1.1 and its comment [8] on the benefits and risks of relevant technology, Rule 1.6(c) on reasonable efforts to prevent unauthorized disclosure of client information, Rule 1.4 on keeping clients informed, Rules 5.1 and 5.3 on supervising staff and vendors, and Rule 1.15 with Idaho Bar Commission Rules 1301 to 1309 on trust accounts. ABA Formal Opinions 477R, 483, 498 and 512 explain how these duties apply to email, breaches, remote work and AI tools.
- For tax preparers, CPA firms and other firms the FTC treats as financial institutions, the FTC Safeguards Rule (16 CFR Part 314, amended 2021 and 2023): a qualified individual, a written risk assessment, multi-factor authentication, encryption, a written incident response plan (firms with information on fewer than 5,000 consumers are excused from the written risk assessment, the incident response plan and a few other items) and, since May 13, 2024, notice to the FTC within 30 days when unencrypted information of 500 or more consumers is taken.
- For tax professionals, the IRS rules: a written information security plan (the PTIN renewal asks preparers to confirm it), Publication 4557, Publication 5708, the disclosure limits of Internal Revenue Code sections 7216 and 6713, and next-business-day incident reporting for e-file providers under Publication 1345.
- For SEC-registered investment advisers and broker-dealers, the amended Regulation S-P (adopted May 16, 2024): an incident response program and customer notice within 30 days, with compliance required since December 3, 2025 for larger firms and June 3, 2026 for smaller ones.
- For everyone, Idaho's breach notice law (Idaho Code 28-51-104 to 28-51-107) and the breach laws of every state where clients live.
The five things to do first.
- Never send or change wire instructions by email alone. Confirm every new or changed payment instruction by calling a number you already had on file, and tell clients in writing, at the start of the engagement, that you will never change instructions by email (lessons 3 and 6).
- Turn on multi-factor authentication for email, remote access, the practice management or tax software and the bank, starting with email (lessons 1, 4 and 6).
- Write the plan the rules expect: a written information security plan or program, a list of where client data lives, and a short incident response plan that names who calls the bank, the insurer, the FBI and the clients (lessons 4 and 5).
- Review every vendor and cloud service that holds client files, including AI tools, for confidentiality terms, access controls and what happens to the data (lesson 2).
- Put security and breach terms in engagement letters, and keep backups that ransomware cannot reach (lesson 5).
- 1The Duty to Protect Client Information: Competence, Confidentiality and SupervisionThe Idaho Rules of Professional Conduct make data security a professional duty for lawyers through Rule 1.1 Comment [8], Rule 1.6(c) and the supervision rules, and the ABA formal opinions from 1995 to 2025 explain what reasonable efforts look like. This lesson compares the Idaho and ABA texts, explains who enforces the duty in Idaho, notes accountants' parallel duties, and shows what reasonable efforts look like for a small Idaho office.65 min
- 2Client Data, E-Discovery, Cloud and AI Tools: Where Client Files Live and How to Keep Them ConfidentialHow law, accounting and other professional firms map and classify client data, handle it in e-discovery under the federal and Idaho rules, and keep it confidential with legal holds, protective orders, cloud and e-discovery vendors and generative AI tools. Covers Idaho Rule 1.16A on client files, HIPAA qualified protective orders, ABA Formal Opinion 512, secure disposal and real law firm breaches, with a sample client data handling, legal hold and secure disposal policy.55 min
- 3Trust Accounts and Client Money: IOLTA, Wire Instructions and Who Bears the LossHow Idaho Rule of Professional Conduct 1.15 and Idaho Bar Commission Rules 1301 to 1309 govern client money, why the Client Assistance Fund does not appear to cover theft by outside criminals, and how changed wire instructions, counterfeit cashier's checks and payoff letter fraud drain trust and escrow accounts. Covers who bears the loss under Beau Townsend Ford, Idaho's enactment of UCC Article 4A and North Carolina 2015 FEO 6, the bank and reconciliation controls that stop most frauds, cyber insurance, the first hour after a misdirected wire, and a sample payment verification procedure.55 min
- 4Accounting, Tax and Financial Firms: The FTC Safeguards Rule, IRS Requirements and the Written Security PlanTax preparers and accountants are financial institutions under the FTC Safeguards Rule, which now requires a Qualified Individual, encryption, multi-factor authentication, vendor oversight and a 30-day FTC notice for breaches affecting 500 or more consumers. This lesson walks through every element of 16 CFR 314.4, the small-firm exemption, IRS publications and reporting rules, section 7216, AICPA and Idaho accountancy rules, amended SEC Regulation S-P, and the rules for other professional firms, with a sample written information security plan outline.60 min
- 5Engagement Letters, Incident Response and Telling Clients: When a Professional Firm Is BreachedWhat engagement letters, client security demands and cyber insurance applications should say before anything goes wrong, and who a law, accounting or tax firm must tell after a breach: clients under Idaho Rules 1.4 and 1.6 and ABA Formal Opinion 483, the FTC, the IRS, the SEC and affected people under Idaho Code 28-51-105. Includes an incident response plan for a 5 to 20 person firm, a timeline from the first hour to 30 days, a notice decision chart, the OFAC ransomware advisory and real cases.60 min
- 6Business Email Compromise and Wire Fraud at Professional Firms: How It Happens and How to Stop ItBusiness email compromise is where law, accounting, tax and other professional firms and their clients lose the most money: $3,046,598,558 in reported U.S. BEC losses in the FBI's 2025 report. This lesson explains how the frauds work so staff can recognize them, which firm moments criminals aim at, the layered defenses that stop them (with the callback on a known number at the center), what to do in the first hour after a fraudulent wire, and how courts have split the loss.70 min
Related courses (linked, not repeated)
- Privacy and Data Security Laws, lesson 4: Money, Credit and Financial Data: GLBA and financial privacy at overview level.
- Privacy and Data Security Laws, lesson 7: The FTC and Federal Security Rules: how the FTC enforces data security, including the Safeguards Rule, in overview.
- Privacy and Data Security Laws, lesson 9: Breach Notification Laws in All 50 States: the state breach laws that apply to every firm.
- Privacy and Data Security Laws, lesson 10: Idaho Privacy Law Up Close: Idaho's breach notice statute and other Idaho privacy law.
- Home Computer Security: the plain-language base: updates, passwords and two-step sign-in, scams, backups.
- Small Business Data Security: the plain-language base for a small office: accounts, backups, email, Wi-Fi, scams aimed at businesses and a 90-day plan.
- Privacy and Security for Small and Medium Businesses: the management program: risk assessment, frameworks, GLBA and other federal laws, vendors, people, incident response, insurance, legal holds and board reporting.
- Healthcare Cybersecurity and HIPAA: for firms that hold health records for clients: business associate duties, HIPAA safeguards and breach rules.
How this module was made
Every lesson was written from the Idaho Rules of Professional Conduct and Idaho court rules, ABA formal opinions, the FTC Safeguards Rule, IRS publications, SEC rules, FBI and CISA publications and court records, cited in numbered notes. Each lesson was then checked by an independent checker who did not write it, against the primary text, with the rule of professional conduct and other regulatory citations checked a second time. Points that could not be confirmed are listed at the end of each lesson under "Still being checked". Government documents used are public domain; photographs are public domain or freely licensed, with the license in each caption. Infographics are original drawings.