AegisAI Perspectives · 044
Reasonable efforts under ABA Rule 1.6(c) are a fact-specific process: weigh the five Comment [18] factors per matter, then fit and check email safeguards.
Reasonable efforts under ABA Model Rule 1.6(c) are a fact-specific process: assess the risk to client email and apply safeguards that fit it, then verify those safeguards and keep them updated2. A breach despite those efforts is not a violation of paragraph (c)4. On the inbound side, AegisAI investigates every inbound email for what it is trying to do and removes the ones that fail from every mailbox they reached22.
Rule 1.6(c) names unauthorized access as well as disclosure1, so attacks that arrive in the firm's inbox fall inside the duty. The wider control list for a firm is in what email security for law firms needs to cover, and the encryption question has its own page: does ABA Formal Opinion 477R require law firms to encrypt client email. State versions of the rule differ, so check your own state's text. This page explains what the rule and the opinions say; it is not legal advice.
Eight steps cover the email part of Rule 1.6(c), from scoring the matter at intake to a dated review.
Score each new matter on the Comment [18] factors: sensitivity, likelihood of disclosure without added safeguards, cost, difficulty, and the effect on the lawyer's ability to represent the client3. Write the scores in the matter file.
Ask the client at intake which channel they require. A client may require special measures, such as email encrypted with two-factor sign-in7. Under N.H. Rule 1.5(a), that cost may pass to the client.
Keep basic measures on every mailbox. Routine email needs no message encryption, but it does need a firewall and password protection of devices and accounts15.
Turn on multi-factor authentication for every firm mailbox. Anyone holding a lawyer's username and password reads the inbox whatever the encryption.
Publish SPF, DKIM and DMARC for the firm's domain. NIST SP 800-177 Rev. 1 recommends them for sender authentication, with TLS in transit and S/MIME for message content21.
Encrypt the higher risk tier. Mergers and acquisitions, trade secrets, health care, banking, defense and education matters may present a higher risk of data theft, and encryption is warranted in some of them6.
Verify payment and account changes out of band. The FBI advises a secondary channel or two-factor authentication for any request to change account information19.
Review the setup on a set date. Texas Opinion 648 says the evaluation of email technology and practices should be ongoing11.
AegisAI covers the inbound side of the duty: its inbound email security reads mail through the Microsoft 365 or Google Workspace API after delivery, with no change to MX records. Its AI agents investigate every inbound email for what it is trying to do. A message that fails is removed from every mailbox it reached. Every verdict comes with its reason in plain language, so the firm's team can check it and share it.
The answer depends on the matter and the channel, so the table pairs each situation with the effort the sources describe.
| Situation | Reasonable effort | Source |
|---|---|---|
| Routine scheduling and status email | Unencrypted email with basic measures in place5 | ABA Journal on Opinion 477R |
| Mergers, trade secrets, health care, banking, defense or education matters | Encryption, warranted in some circumstances | ABA Journal on Opinion 477R |
| Client asked for special measures | The measure the client set, with the cost passed through | New Hampshire Bar Ethics Corner |
| Shared account, a spouse who may know the password, a work account in an employment dispute | Consider encrypted email or another channel10 | Texas Opinion 648 |
| Every firm mailbox | Multi-factor authentication, SPF, DKIM and DMARC | US Court of International Trade guide, NIST SP 800-177 |
| Inbound request to change payment or account details | Verification through a secondary channel | FBI IC3 |
Illustrative example, figures are fictional. Harlow and Pike, a fictional 22 lawyer firm, opens a trade secrets matter for a medical device client. Intake scores the five factors: sensitivity high, likelihood of disclosure medium, cost low, difficulty low, effect on the representation low. The client asks for encrypted email with two-factor sign-in, and the engagement letter passes that cost through. In week three, an associate receives an email that appears to come from the court clerk, asking her to sign in to view a sealed order. The sender address does not match the court's domain, and the link opens a copy of a sign-in page. The firm's inbound check removes it from the 4 mailboxes it reached. The matter file now holds five records: factor scores, client instruction, safeguards in place, the removed message with its reason, and the next review date.
It means a process with four parts: assess the risks and implement measures that answer them, then verify the measures and keep them updated. The ABA rejected a fixed list of required measures such as firewalls and passwords. The duty covers unauthorized access as well as disclosure. ABA Formal Opinion 483, issued on October 17, 2018, covers what follows a breach14.
Score each factor per matter and write the score down. Comment [18] names five factors and calls them nonexclusive. Turn each one into a question at intake:
High sensitivity in a higher risk industry points toward encryption for that matter. Low scores on the first two questions support routine email with basic measures.
Each requirement in the chain maps to one email control the firm can show.
Evaluate it against the ABA process: did the firm assess the risk and implement a measure, and did it then verify and update that measure? Then test it against the factors. Ask whether it lowers the likelihood of disclosure. Ask what it costs and how hard it is to run. Ask whether it covers a stolen login, since encryption does not. Ask whether each decision leaves a record the firm can file in the matter.
Five gaps recur in the sources. Legal services were the most reported industry, at 18%, in more than 1,400 ransomware complaints to IC3 from organizations outside critical sectors in 202517.
Keep one record per matter and one for the firm. Comment 18 judges a breach by the efforts made before it, so the record shows what those efforts were.
Track three numbers from day one.
No. Routine client email may go unencrypted when basic, reasonably available security measures are in place. A firewall and password protection of devices and accounts are among those measures. Encryption is warranted for some higher risk matters.
A process: assess the risks, implement measures that fit them, verify the measures work and keep them updated. The five Comment [18] factors decide how far each matter needs to go.
No. Unauthorized access or disclosure is not a violation of paragraph (c) if the lawyer made reasonable efforts to prevent it. After a breach, Colorado Opinion 141 requires the firm to halt and investigate it and to notify current clients in time.
Yes. A client may require special security measures, such as two-factor encrypted email. In New Hampshire the cost may pass to the client under Rule 1.5(a), and a lawyer may consider withdrawing if the demands are too onerous.
On routine email, yes. Texas Opinion 648 says a lawyer may generally send confidential information by email. Colorado Opinion 141 requires breach monitoring, investigation and notice to current clients. Check your own state's rule and opinions; this page is general information, not legal advice.
