# ABA Formal Opinion 477R for Small Firms, in Plain English URL: https://limehawk.io/reports/aba-formal-opinion-477r Published: 2026-10-01 Author: Corey Watson, Managing Member Topic: Guides Read time: 6 min ABA Formal Opinion 477R says you may email clients if you've made reasonable efforts to secure it. Here is what that means in actual IT controls. > **TL;DR** ABA Formal Opinion 477R says a lawyer can send client information over the internet as long as the lawyer made reasonable efforts to keep it from the wrong people. It does not name a product or a checklist. It names factors and a process. In practice that means MFA, patched and encrypted devices, a way to wipe a lost laptop, encryption when the matter calls for it, and vendors you have actually checked. Opinion 483 adds the other half: watch your systems, and tell clients when their information is hit. - 477R security considerations: 7 I'm not a lawyer, and this isn't legal advice. Talk to your ethics counsel about your own obligations. What I can do is tell you what the opinion actually says and what it looks like when we set up a firm's IT to meet it. ## What does 477R require? [ABA Formal Opinion 477R](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-477.pdf) says a lawyer may send client information over the internet without breaking the Model Rules, as long as the lawyer has made reasonable efforts to prevent inadvertent or unauthorized access. It was issued May 11, 2017, and revised May 22, 2017. The catch is the second half: some information, some client agreements, and some laws require more than the baseline. It rests on two rules the ABA changed in 2012. [Model Rule 1.1, Comment [8]](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_1_competence/comment_on_rule_1_1/) says competence includes keeping up with "the benefits and risks associated with relevant technology." [Model Rule 1.6(c)](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_6_confidentiality_of_information/) says a lawyer "shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client." Tennessee adopted the same language, with one numbering difference that trips people up. In [Tennessee Supreme Court Rule 8](https://www.tncourts.gov/rules/supreme-court/8), the reasonable-efforts duty is **RPC 1.6(d)**, not 1.6(c). Tennessee's RPC 1.1 Comment [8] carries the same technology language as the ABA's. The opinion itself notes that each jurisdiction's own rules control, so for a Tennessee firm, Rule 8 is the text that counts. If you want the short version of how this applies to a firm like yours, our [IT for law firms](/industries/law-firms) page covers it. ## What counts as reasonable efforts? There's no checklist. The opinion says reasonable efforts are "not susceptible to a hard and fast rule." It borrows a process from the ABA Cybersecurity Handbook instead: assess the risks, put security measures in place that answer those risks, verify they work, and keep them updated as things change. Comment [18] to Rule 1.6 (Tennessee has the same comment) lists the factors: - how sensitive the information is - how likely disclosure is without more safeguards - what more safeguards would cost - how hard they are to put in place - how much they get in the way of representing clients 477R then gives seven considerations. Here is each one next to what it turns into on a real network: 1. **Understand the threat.** The opinion names M&A, trade secrets, and industries like healthcare and banking as higher-risk matters. Higher risk means more effort. 2. **Know where client data lives and how it moves.** "Every access point is a potential entry point." That's an asset inventory: every laptop, phone, mailbox, and cloud share. 3. **Use reasonable security measures.** The opinion lists secure Wi-Fi or VPN, strong unique passwords, firewalls, anti-malware, and patching on every device that touches client data. It names encryption of stored data and multi-factor authentication as other tools, and says remote disable and wipe of lost devices may be reasonable, "especially if encryption is not also being used." 4. **Decide how each kind of communication should be protected.** More on that below. 5. **Label confidential communications.** A "privileged and confidential" marking or an accurate email disclaimer. 6. **Train lawyers and staff.** Policies, periodic training, and follow-up, under Rules 5.1 and 5.3. 7. **Do due diligence on technology vendors.** Reference checks, the vendor's security policies, confidentiality agreements, and so on. None of that is exotic. Most of it is what a properly run small office should have anyway. The opinion even says the basic measures in item 3 are "routinely accessible and reasonably affordable or free." ## When do you need to encrypt client email? When the information is sensitive enough to need it. 477R says unencrypted routine email "generally remains an acceptable method of lawyer-client communication," but only if you've put basic security measures in place first. If the client information is of sufficient sensitivity, the opinion says the lawyer "should encrypt the transmission," and consider password-protecting attachments or using a vetted, secure file-sharing service instead. It goes further for the most sensitive matters: reasonable efforts "might require avoiding the use of electronic methods or any technology" at all. And it flags a common one that small firms miss: a client using a work computer or an email account someone else can get into. The opinion says you should warn that client, because privilege can be waived. The opinion also says lawyer and client should talk about the level of security each communication needs at the start of the relationship. That's a conversation, not a setting. Our job is to make sure the secure option actually exists and is easy, so nobody falls back to a personal Gmail account to get a document out the door. ## What about 483 (breach duties)? [ABA Formal Opinion 483](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-op-483.pdf), issued October 17, 2018, picks up where 477R left off. It says that when a breach involves, or has a substantial likelihood of involving, material client information, lawyers have a duty to notify clients. The parts that land on IT: - **Monitoring.** Lawyers "must employ reasonable efforts to monitor" their internet-connected technology, external data sources, and vendors. Otherwise, the opinion says, noticing a breach is left to happenstance. - **Stop it and fix it.** When a breach is suspected or detected, the lawyer has to act reasonably and promptly to stop it and limit the damage. The opinion recommends an incident response plan written before you need it. - **Find out what happened.** Enough investigation to confirm the intruder is out and, as far as reasonably possible, what was accessed or lost. - **Tell the client.** At minimum, that there was unauthorized access or it's reasonably suspected, and the known extent of it. 483 also counts ransomware as a breach when it locks you out of client information for a material amount of time, even if nothing was stolen. And it's clear that complying with state breach-notification laws doesn't automatically satisfy the ethics duty, or the reverse. The most common way we see a firm's information get exposed is a mailbox takeover. We wrote up [a business email compromise at a title company](/reports/bec-wire-fraud-incident-response), where an attacker sent fake wire instructions from a real closer's inbox and hid the replies with mail rules. Law firms that touch settlement funds or real estate closings face the same attack. ## Key takeaways - 477R does not require a specific product. It requires a process: assess the risk, put controls in place, verify they work, keep them current. - Routine unencrypted email is generally still acceptable under 477R, but only on top of basic security measures. Highly sensitive matters can require encryption or no email at all. - In Tennessee the duty lives in RPC 1.6(d), not 1.6(c). The reasonableness factors in Comment [18] match the ABA's. - Opinion 483 expects you to monitor your systems and vendors, and to tell affected clients when material client information is accessed or reasonably suspected to be. - If you can't evaluate the safeguards yourself, 477R says you can get there by working with an expert. That is the job we do. ## How we set this up for a firm This is the part a generic guide can't write. Here's what our baseline looks like when we take on a firm. It lines up with 477R's considerations, and it's the same work described on our [law firm IT](/industries/law-firms) page: - **MFA enforced at the tenant**, not just offered. The BEC report above is what "enrolled but not enforced" costs you. - **Microsoft 365 or Google Workspace locked down**, not left on defaults, with an encrypted send option staff can actually find. See [Microsoft 365 administration](/services/cloud-solutions). - **Full-disk encryption on every machine**, with recovery keys escrowed. We've [rolled that out across a fleet in 72 hours](/reports/bitlocker-encryption-automation). - **Remote wipe that works on short notice.** We [wiped a stolen laptop 16 minutes after the theft](/reports/mdm-remote-wipe) because the tool was ready before it was needed. - **Patching, endpoint protection, and a managed firewall**, with no Remote Desktop open to the internet. - **An asset inventory** so you know every device client data sits on. - **Monitoring and tested backups**, which is what 483 expects and what gets you through ransomware. - **Written documentation** of all of it, so when a client, a carrier, or the bar asks what you did, the answer is on paper. What we don't do is pretend to be your ethics counsel. We build and document the controls. You and your counsel decide what the rules require for your matters. 477R itself says a lawyer who can't evaluate safeguards alone can get there "through association with another lawyer or expert." That's us on the technical side. If you want to walk through where your firm stands against 477R, [get in touch](/contact). Critical issues get a response in under 15 minutes, and managed IT is month-to-month.