A familiar username, an office network connection and a successful sign-in are not enough to establish that every subsequent action is safe. A compromised account can look like an ordinary user, and a firm-owned device can still have security problems. For law firms working across offices, cloud applications and remote locations, zero trust provides a practical starting point: evaluate access to the resource being requested instead of assuming that everything inside the network should be trusted. Calling it a baseline reflects a recommended operating approach. It does not mean every law firm faces a universal legal requirement to adopt a particular zero trust product or architecture.
What zero trust means in everyday work
NIST describes zero trust as moving protection away from reliance on a network perimeter and toward users, devices and resources. Network location or device ownership alone should not confer implicit trust. [1]
For your firm, the practical questions are straightforward. Who is requesting access? What device are they using? Which information do they need? Is the request consistent with their role and the circumstances?
The aim is to provide appropriate access for legitimate work while limiting unnecessary exposure. An attorney may need a matter workspace without needing every client repository. A vendor may need to maintain an application without having standing access to unrelated systems.
A VPN does not answer every access question
A VPN can protect a connection to private resources. It does not, by itself, establish that an account is uncompromised or that the user should access every reachable system.
Consider a fictional firm where an administrative assistant needs billing records, but a shared network also exposes unrelated litigation files. The issue is broader access than the role requires. Changing the connection technology alone will not correct the permissions.
Start by reviewing who can reach sensitive resources and why. Retain the network controls your firm needs, then add identity, device and resource-specific decisions around them.
Apply the approach across the environment
Microsoft's guidance on the CISA Zero Trust Maturity Model describes five areas: identity, devices, networks, applications and workloads, and data. It also identifies governance, visibility and automation as capabilities that connect them. [2]
The following table translates those areas into planning questions for a law firm. The examples are recommended practices to adapt to your systems and matters.
| Security area | Law firm example | Practical control to evaluate |
|---|---|---|
| Identity | An attorney signs in to email or a document system | Strong authentication, separate administrator accounts and prompt access removal |
| Devices | A laptop accesses client documents from outside the office | Managed updates, endpoint protection and device-health requirements |
| Networks | A support vendor connects to an application server | Limit reachable systems and avoid unnecessary network access |
| Applications | A new integration requests access to email or files | Review permissions, ownership and approval before connection |
| Data | Staff share documents with a client or expert | Matter-based permissions, controlled external sharing and periodic reviews |
A tool purchase may support one area. An operating program needs owners, documented policies and checks that the controls work together.
Strengthen authentication without treating MFA as the finish line
Use multifactor authentication for supported business services, and prioritize phishing-resistant methods where available. CISA recommends phishing-resistant MFA and describes number matching as an interim improvement for push-based authentication when stronger methods cannot yet be deployed. [3]
For example, FIDO passkeys use credentials tied to the service where they were registered, rather than a password a user can type into a lookalike website. [4]
Plan enrollment and recovery carefully. Protect the processes for adding authenticators, replacing lost devices and restoring accounts. A strong sign-in method is less useful if an attacker can persuade support staff to bypass it.
Authentication still needs to work alongside device protection, appropriate permissions and monitoring. Passing an authentication check should not confer unrestricted access.
Limit access to the work that requires it
Review privileges by role, matter and business function. Avoid shared credentials where named accounts can provide individual accountability. Keep routine work separate from administrative tasks and limit elevated permissions to authorized people and purposes.
Include contractors, application vendors and service accounts in the inventory. Record what each can access, who owns it and when the need should be reviewed. Remove access when an engagement ends or a role changes.
For matter restrictions, verify the actual permissions rather than relying on folder names or written expectations. Test whether a user outside the assigned group can open the material. Ethical walls and other matter-specific restrictions need controls in the systems where the information resides.
Use device and context checks proportionately
A firm can define different access requirements for a managed laptop and an unknown device. A suitable policy may require a compliant device for sensitive resources or allow a more restricted browser experience when supported by the application.
For Microsoft-based environments, Conditional Access offers a way to evaluate and apply access policies. Microsoft provides report-only functionality to assess policy effects before enforcement. [5]
Pilot changes with representative users and applications. Check courtroom, travel and remote-work scenarios, along with business-critical service accounts. Maintain protected emergency access and a documented recovery route. Policies should be tested carefully enough that they support work while enforcing the intended boundary.
Monitoring needs a response owner
Collect useful activity from identity services, endpoints, applications and data systems. Decide which events require investigation and who handles them.
Examples worth reviewing include unexpected authentication-method changes, unusual file downloads, new external sharing and unexplained privilege changes. Treat unusual activity as a signal to investigate, not automatic proof of a breach.
Define escalation responsibilities, coverage hours and containment authority. If monitoring is described as continuous, establish what is continuously collected and when a person will respond. An alert that waits without an owner does not deliver the same protection as an actively managed response process.
Zero trust supports compliance work but does not certify it
Access controls and monitoring can support a firm's security obligations. Compliance still depends on the applicable requirements, the information handled, contracts, configuration, documentation and how the controls operate.
For example, a law firm providing services involving PHI on behalf of a covered entity may be a HIPAA business associate, depending on the relationship. HHS describes business associate obligations and emphasizes risk analysis for regulated entities. [6, 7]
A zero trust label does not resolve those obligations. Assess the firm's actual role and workflows, document risks and safeguards, and evaluate relevant vendor agreements. Treat client-specific requirements and protective orders as part of the same planning exercise.
Build a workable starting plan
Begin with an inventory of sensitive resources, users, devices and connected applications. Identify where access is broader than necessary and where accounts lack suitable protection.
Prioritize high-impact improvements: stronger authentication, removal of unused accounts, restricted administrator access and better control of sensitive matter repositories. Pilot device and access policies before broader enforcement.
Then test the operating process. Can staff report suspicious activity quickly? Can the team revoke access when needed? Can essential systems be recovered? Track coverage, outstanding exceptions, access reviews and response performance rather than counting installed products alone.
Zero trust gives the firm a consistent way to make these decisions as its environment changes. Its value is in the boundaries and operating habits it establishes around client information.
Allnext Legal helps law firms assess identity, devices, applications and data access, then implement and manage security controls for the way the firm operates.
Sources
- NIST — Zero Trust Architecture, SP 800-207
- Microsoft — Align services with the CISA Zero Trust Maturity Model
- CISA — Phishing-resistant MFA and number matching guidance
- FIDO Alliance — How passkeys work
- Microsoft — Conditional Access report-only evaluation
- HHS — Business associates
- HHS — Guidance on risk analysis
Review Your Firm's Security Approach.
Contact us
