IT that speaks Clio and NetDocuments, and runs the security your confidentiality duty now expects.
You know Rule 1.6 cold. What changed is that your duty to protect client confidences now expressly reaches the technology that stores and transmits them, and most small firms have never had that layer independently checked. We run the technical security an attorney's confidentiality duty implies, document it, and hand you what you'd need to show your safeguards were reasonable. Local, responsive, and we know your matter-management software.
20-minute call. No obligation, and we never ask for privileged or client information.
No fine schedule. Just a standard you have to be able to defend.
- You can't say, in writing, that client files are encrypted on every laptop and that your backups would actually restore.
- People have left the firm and you're not certain their access to Clio, email and the file server is fully gone.
- Your malpractice or cyber renewal is asking for MFA and a written security plan you don't have.
- If a client file got out, you'd be explaining to the State Bar and your carrier why your safeguards were reasonable, after the fact.
Matter-management fluent, not generic IT.
We support the systems your firm runs on and coordinate with your software vendors, so you're not the one on hold while a hearing date moves.
Your Rule 1.6 duty reaches your technology now. Here's the technical layer we own.
- Encryption on devices, backups, and email in transit
- Unique logins and MFA, no shared firm password
- Least-privilege access, and access removed the day someone leaves
- Audit logging: a record of who reached what, when
- Backup and ransomware-resilient recovery, tested and dated
- A breach-response plan built before you need one
This is an ongoing review, not a one-time setup. Technology and threats change, and so does what "reasonable" looks like.
We run the technical security your confidentiality duty implies. We are not your ethics counsel, and this page is general information, not legal or ethics advice. The Rule 1.6 judgment stays with you or your ethics counsel.
Down the road, and reachable when a deadline is moving.
Based in Menifee, serving:
- Menifee
- Sun City
- Murrieta
- Temecula
- Wildomar
- Lake Elsinore
Straight answers.
Isn't this my IT guy's job, or Clio's?
Two different jobs. IT keeps the computers running; Clio, MyCase or NetDocuments secure their own platform, not your network, devices, backups, email, or who still has access after someone leaves. The Rule 1.6 duty is yours. We run and document that technical layer so you can answer, in writing, that client data is encrypted on every device and that your backups would actually restore.
We're a small firm. Who'd come after us?
A data incident starts with your own client asking what happened, and a bar inquiry or malpractice claim asking whether your safeguards were reasonable. Firm size doesn't change the duty. It just means most small firms have never had the technology side checked. We're a small local shop ourselves, built for firms your size, not the 200-lawyer downtown crowd.
Do you support Clio, MyCase, PracticePanther and NetDocuments?
Yes, plus iManage and the email, backup and endpoint layer around them. We coordinate directly with your software vendors when needed so the buck stops with us.
Do you handle the legal-ethics side of this?
No, and we'll say so up front. We own the technical safeguards and the evidence behind them. The interpretation of Rule 1.6, your technology-competence duty, and any breach-notification judgment stay with you or your ethics counsel. We give you the plain-English facts they need.
Will you sign confidentiality terms?
Yes. We sign confidentiality terms consistent with your duties, the same way we sign a BAA for our healthcare clients. Vendor diligence is part of your Rule 1.6 obligation, so it's a fair question to ask any provider who touches your systems.
The Small-Firm Lawyer’s Client-Confidentiality Cheat Sheet.
What California's confidentiality and technology-competence rules now expect of the systems holding your client files, for a 1 to 10 attorney firm, on one page. Rule 1.6 and §6068(e), the technology-competence duty, what "reasonable" actually looks like, and the questions to ask your current IT guy. Plain English, no binder.
One short form, instant download. We never ask for privileged or client information.
- Which rules and opinions reach your technology (Rule 1.6, 1.1, Ops. 2010-179 & 2020-203)
- What "reasonable, documented, ongoing" looks like in practice
- The "my IT guy handles this" myth, and the one question that tests it
- The 2026 breach-notice clock (SB 446: 30 days) and why there’s no safe-harbor dollar figure
New name, not a new face in IT.
Simon Says Systems is new under this name. The person behind it isn’t: 35 years in IT and cybersecurity since 2003. Want to talk to someone who has worked with Craig over that time? Ask on your free check and he’ll connect you.
Protect the file. Keep the firm running.
Book a free, 20-minute call. No obligation, no sales pressure, and no jargon.