ABA Model Rule 1.6 aligned24/7 security operations monitoringAustin, TX ยท Serving TX, AR, LA, OK & KS
(737) 325-2520
(737) 325-2520Schedule a Review

Supervising a Remote Team: Home Office Security and Opinion 498

ABA Formal Opinion 498 addresses virtual practice. Here is a plain-English look at its themes and a practical remote-work security checklist for law firms.

3 min readBy Counsel Cyber Team

Remote and hybrid work did not leave the legal profession when the emergency conditions that spread it ended. Many firms still have lawyers working from home, from client sites or while traveling. ABA Formal Opinion 498, issued in 2021 and titled "Virtual Practice," addresses how the Model Rules apply when lawyers practice remotely.

This post summarizes some of the opinion's themes in plain English and turns them into steps for firm administrators. It is not legal advice, and the ABA's opinions are guidance rather than binding law, so confirm expectations with your state bar.

Themes from the opinion

In general terms, Opinion 498 discusses how several rules apply to virtual practice.

  • Competence (Rule 1.1) and technology: lawyers should understand the technology they use and its risks.
  • Confidentiality (Rule 1.6), including reasonable efforts to prevent unauthorized access when working outside the office.
  • Communication (Rule 1.4), including how to communicate with clients in a remote setting.
  • Supervision (Rules 5.1 and 5.3), including supervising lawyers and staff who are not physically present.

It also discusses practical points such as securing home networks and devices, using secure methods for communicating and sharing files, being careful about smart speakers and virtual assistants near confidential conversations and thinking about the security of videoconferencing tools.

Remote work security checklist

Devices

  1. Use firm-managed, encrypted laptops with endpoint protection and current patches.
  2. Enable automatic screen lock and require a strong sign-in.
  3. Set a policy on personal devices: either prohibit them for client work or require enrollment in mobile device management with remote wipe.
  4. Maintain an inventory of devices, and know where each one is.
  5. Have a clear process for lost or stolen devices, with immediate reporting.

Network

  1. Provide guidance on securing home Wi-Fi: strong passphrase, current router firmware, changed default admin password.
  2. Use a firm-provided VPN or a secure remote access method rather than ad hoc solutions.
  3. Warn against public Wi-Fi for client work without protection.
  4. Consider separating work devices from smart home gadgets and children's devices.

Accounts

  1. Require MFA on all remote access, email and practice systems.
  2. Use a firm-approved password manager.
  3. Limit administrator accounts.
  4. Review sign-in alerts for unusual locations.

Communication and file sharing

  1. Use approved tools for client communication and file exchange. Avoid personal email and consumer file-sharing.
  2. Use secure client portals or encrypted transfers for sensitive documents.
  3. Configure meeting tools with passcodes, waiting rooms and limits on recording and bots.
  4. Be mindful of conversations in shared spaces and the presence of voice assistants.

Physical privacy at home

  1. Position screens away from windows and visitors.
  2. Store papers and devices securely.
  3. Use a shredder or secure disposal method for printed confidential material, or avoid printing at home at all.
  4. Do not let family members use work devices.

Supervising people you cannot see

Partners should consider how they supervise junior lawyers and staff remotely.

  • Hold regular check-ins and maintain open channels for questions.
  • Make policies explicit, in writing, and acknowledged by staff.
  • Provide training on remote security practices, not just in the office.
  • Make it easy to report problems, such as a lost laptop or a suspicious message.
  • Monitor for risky behavior with tools, such as alerts for unusual file downloads.

Training and culture

Remote staff face more distractions and fewer chances to ask a colleague "does this look right?" Give them a quick reporting path and a verification habit for payment or credential requests. Share short, regular reminders rather than occasional long sessions.

Policies to put in writing

  • Remote work and acceptable use policy.
  • Personal device policy.
  • Secure communication and file sharing policy.
  • Incident reporting procedure.
  • Home office security guidelines.

Consider insurance and client terms

Insurers and clients may ask about remote work controls. Keep documentation that shows how your firm manages them, such as device inventories, MFA reports and training records.

Where we help

Counsel Cyber helps law firms secure remote and hybrid work, including device management, secure access and policy writing. If you would like a remote work security review, we can walk through this checklist with you.

More on Legal Ethics and Technology Compliance

Legal Ethics and Technology Compliance

Responding to a Bar Inquiry After a Data Incident: A Readiness Guide

If a data incident leads to a bar inquiry or client complaint, records matter. Prepare your policies, logs and timeline now, with counsel guiding the response.

Legal Ethics and Technology Compliance

Rule 1.6(c) and Cloud Storage: Reasonable Efforts for Client Data

Model Rule 1.6(c) asks for reasonable efforts to protect client information. See how that applies to cloud storage, file sharing and the vendors behind them.

Legal Ethics and Technology Compliance

Supervising Vendors and Staff on Tech: A Rule 5.1 and 5.3 Walkthrough

Model Rules 5.1 and 5.3 reach lawyers who oversee staff and outside vendors. See what supervision can look like for IT providers, paralegals and cloud services.