October 2, 2026
A small or mid-sized law firm needs more than antivirus software to protect its systems and confidential information. For a law firm with 10–50 employees, a practical cybersecurity strategy should include at least five layers: identity protection, endpoint security, email and Microsoft 365 security, data backup, and continuous monitoring and response.
These layers work together. If one security measure fails (for example, an employee enters a password into a phishing site) other layers can help detect the attack, limit access, and prevent further damage.
For Alberta lawyers, cybersecurity also intersects with professional responsibilities. The Law Society of Alberta’s Code of Conduct addresses technological competence and lawyers’ duty to protect confidential client information.
Here are five areas law firms should evaluate when reviewing their cybersecurity.
1. Protect User Accounts and Identities
A stolen username and password can give an attacker a foothold inside a firm’s systems.
Multi-factor authentication (MFA) should be configured for 100% of users wherever supported, particularly for Microsoft 365 and other systems containing sensitive business or client information.
Identity protection should also include:
- Appropriate user permissions
- Separate administrative accounts where appropriate
- Prompt employee onboarding and offboarding
- Regular reviews of who has access to systems and data
When an employee leaves a firm, access should be removed as part of a defined offboarding process rather than waiting for someone to remember later.
2. Protect Every Computer and Endpoint
Every laptop and desktop that accesses firm information is another potential entry point.
A managed endpoint-security strategy can include:
- Business-grade endpoint protection
- Security monitoring
- Operating system and application patching
- Device encryption
- Managed security policies
- Secure remote access
This becomes especially important when lawyers and staff work from home, court, client locations, or other environments outside the office.
3. Secure Microsoft 365 and Email
Email is particularly important because phishing attacks are designed to convince legitimate users to give attackers access.
For firms using Microsoft 365, we recommend a layered approach that includes:
- MFA configuration
- Managed user onboarding and offboarding
- Advanced email security and phishing filtering
- Microsoft 365 data backups
- Security monitoring and alerts
Simply subscribing to Microsoft 365 does not mean every appropriate security setting has been configured or that someone is actively monitoring the environment.
4. Back Up Important Data and Prepare for Recovery
Cybersecurity isn’t only about preventing an incident. Firms should also plan for what happens when something goes wrong.
Microsoft 365 data backups can provide an additional recovery option for important cloud data.
Law firms should be able to answer questions such as:
- What information is being backed up?
- How frequently are backups performed?
- Where is the data backing up to? (Techwel only uses Canadian data centers for all our cloud backup services)
- How long are backups retained?
- Who receives an alert when something fails?
- How would information be restored after an incident?
A backup strategy is much more useful when the recovery process has been planned before an emergency.
5. Monitor and Respond When the Office Is Closed
Cybersecurity incidents don’t follow business hours.
One Techwel client experienced this firsthand when a shared mailbox was compromised through a password-phishing attack on a Sunday afternoon.
Our monitoring tools and automated security responses detected the incident. The account was locked down, active logins were expired, and the attacker was logged out before any damage was done.
The incident illustrates an important distinction between having security software and having an actively managed cybersecurity strategy.
A law firm shouldn’t have to wait until Monday morning for someone to discover that an account was compromised on Sunday.
What Does the Law Society of Alberta Say About Cybersecurity?
Cybersecurity is particularly important for law firms because lawyers have professional obligations surrounding competence and confidential information.
The Law Society of Alberta Code of Conduct addresses technological competence as part of a lawyer’s broader duty of competence. Its commentary states that lawyers should understand the benefits and risks associated with relevant technology. Lawyers also have obligations concerning the confidentiality of client information.
The appropriate technology and security measures will depend on the individual practice. This does not mean the Law Society requires every firm to purchase a particular cybersecurity product or managed IT service.
It does mean Alberta lawyers should take technology risks seriously and make informed decisions about protecting their practices and client information.
A Simple 5-Layer Cybersecurity Checklist for Law Firms
For a quick assessment, ask whether your firm has:
- Identity: MFA and controlled user access
2. Devices: Managed endpoint protection and patching
3. Email: Advanced phishing and email security
4. Data: Appropriate backups and recovery procedures
5. Response: Security monitoring and a defined incident-response process
If you can’t confidently answer what happens in all five areas, that’s a useful place to start a cybersecurity review.
Cybersecurity Support for Edmonton Law Firms
Techwel Computers is a family-owned Edmonton IT company providing local businesses with managed IT, cybersecurity, and Microsoft 365 support.
Our approach is relationship-focused. When clients call Techwel, a person answers the phone, not a phone tree. We provide both remote and on-site support and help clients manage Microsoft 365 security, MFA, employee onboarding and offboarding, advanced email security, phishing filtering, Microsoft 365 backups, and security monitoring and alerts.
For an Edmonton law firm with 10–50 employees, the objective isn’t to add technology for technology’s sake. It’s to build practical layers of protection around the people, systems, and information the firm depends on every day.
Book a Discovery Call with us: https://www.techwelcomputers.com/discoverycall/
