A useful law firm incident-response rehearsal ends with names beside decisions. Who takes the first call? Who can authorize containment? Who protects the filing calendar while technical responders investigate? This Monday, turn security awareness into one owned rehearsal instead of another reminder to be careful.
The Florida guidance is a starting point, not a new mandate
The Florida Bar Committee on Cybersecurity and Privacy Law's Recommendation 25-1 recommends preparing and annually maintaining an incident response plan (IRP).[35] The Board of Governors Technology Committee approved it on March 27, 2025.[35] This is not a new 2026 requirement. The Florida Bar News's May 15, 2025 explanation describes the guidelines as entirely voluntary and not intended to establish a minimum standard of care.[1]
That explanation also encourages firms to map their data, assess cybersecurity maturity, and tailor a plan to their needs.[1] Our practical next step is a tabletop: a discussion of a fictional incident without touching production systems. The format, timing, and questions below are our implementation recommendations, not a Bar-prescribed exercise. Connect the results to your broader law firm cybersecurity program.
Set up a discussion-only rehearsal
Reserve 45 minutes with the managing attorney, office manager, a staff member who handles filings, and your technical contact. One person facilitates; another records decisions. A small firm may combine roles, but name a lead and backup for each responsibility. Agree that the exercise is for finding gaps, not grading employees.
Bring the response plan, a contact list, a simple map of email and matter-file systems, and a blank decision log. CISA recommends maintaining and regularly exercising an incident-response and communications plan, with a hard copy and an offline copy available.[36] Our suggestion is to ask the backup lead to locate that copy without using office email.
Use invented client names and blank sample documents. Do not send phishing messages, create mailbox rules, disable accounts, disconnect equipment, restore files, or contact real clients during this discussion-only exercise. If someone discovers a real concern, stop the rehearsal and use the firm's actual response process.
Scenario: an unexpected rule before a filing
Imagine a fictional Sarasota firm preparing an afternoon filing. A paralegal notices an unexpected mailbox rule moving messages out of the inbox. A shared matter folder also shows an unfamiliar sharing change, and the latest filing draft is unavailable. The managing attorney is away from the office. These are invented observations, not a reported local incident or proof of ransomware.
Read those facts aloud, then pause. Ask participants to separate what they know from what they suspect. Record the discovery time and time zone, affected accounts, and outstanding questions. Nobody needs to diagnose the cause to demonstrate a clear reporting handoff.
First discussion: who takes charge, and how?
Spend roughly ten minutes walking through the first report. Have the paralegal name the response lead, the backup, and the known-good way to reach them. If the suspected mailbox is also the firm's normal coordination channel, what replaces it? CISA recommends out-of-band communication, such as phone calls, and coordinated isolation during response.[36]
Our rehearsal questions: Where is the independently verified number? Who checks that the technical responder is the expected person? Who can authorize account containment if the partner is unavailable? Write the approval path rather than saying “IT will handle it.” Separately identify who can authorize restoration; permission to contain is not blanket permission to return systems to use.
Name the person who contacts incident counsel and the insurer using saved contacts and the applicable policy process. Ask who checks any approval conditions for outside responders. Use our cyber-insurance evidence checklist to organize that preparation, not to infer coverage from having a plan.
Second discussion: preserve facts while protecting work
Give the technical contact ten minutes to describe the evidence handoff. Our suggested questions cover mailbox-rule details, sign-in records, sharing changes, original messages, and relevant device alerts. Who collects them, where are they stored, and who can read them? Keep the decision log separate from unnecessary copies of client files.
CISA emphasizes preserving evidence, including volatile logs and memory.[36] Its ransomware response guidance calls for isolating affected systems; powering down is a fallback when they cannot be disconnected, because shutdown can destroy volatile evidence.[36] This is not an instruction for staff to experiment on a suspicious computer. In the rehearsal, have qualified responders explain how they would coordinate containment and preservation without indiscriminate deletion, rebooting, or cleanup.
Ask counsel how privileged communications and other confidential client information should be handled, who needs access, and which approved channel should carry sensitive material. Do not assume copying an attorney makes every record privileged. Do not paste evidence into a public contact form, personal email, or an unapproved AI tool.
Now introduce a second fictional fact: the filing deadline remains, but the shared folder is still unavailable. Have the filing owner identify the authoritative calendar, an approved alternative way to obtain the correct draft, and the attorney responsible for procedural decisions. What pauses if the document's integrity cannot be confirmed? Staff should not improvise deadline relief or use a personal account to bypass restrictions.
Third discussion: recovery is not the notification decision
Spend ten minutes deciding what evidence would support a return to work. CISA recommends offline, encrypted backups and regular testing.[36] Our drill asks for the latest documented restore result, the systems it covered, and who can validate a recovered filing workflow. Do not run a restore during this tabletop. Our backup and disaster recovery services address the separate technical planning and testing.
Ask the restoration approver what remains unresolved before accounts or files return to normal use. A readable document does not establish that unauthorized access has ended. Record dependencies, restrictions, and the next technical review rather than declaring recovery complete because one file opens.
Keep a separate decision track for potential notification. Ask counsel to evaluate the facts, applicable law, client obligations, contracts, and deadlines; assign someone to collect the information counsel needs. Our Florida data-breach response guide provides companion context, not an automatic legal conclusion for this scenario. Restoring operations does not answer whether information was accessed or whether notice is required.
Close with written lessons and owners
Use the final five minutes to record each gap, its owner, a target date, and how completion will be checked. “Backup lead could not locate the offline contact sheet” is useful; “improve preparedness” is not. Keep unknown answers visible. Schedule a short follow-up discussion after corrections, and update the response plan through the firm's approval process.
Three things you can do this week
- Book the rehearsal. Invite the decision owners and backups; send only the fictional scenario and the discussion-only ground rules.
- Check the handoff. Locate the offline plan and known-good contacts. Write separate authority for containment, restoration, filing continuity, and legal notification decisions.
- Assign the fixes. Keep a restricted lessons log with owners, dates, and evidence of completion. Arrange separately authorized technical tests where discussion reveals a gap.
Make preparation practical
Our Free Systems Audit is on-site at your Sarasota or Manatee County business. Visits usually take 45–60 minutes within a 60-minute calendar slot. Every completed audit includes a full, customized Client Threat & Architecture Report with prioritized practical findings. Use the request form to arrange an audit for preparation; it is not an emergency incident-response channel.
Gregory Mathews, Systems Architect, Suncoast MIS LLC
Source Notes and Scope
The sources establish the voluntary planning recommendation and technical response principles. Our fictional scenario, agenda, role assignments, and follow-up format are implementation recommendations. This article is technical education, not legal advice, a privilege determination, an insurance coverage opinion, or a guarantee against incidents. Firm leadership and qualified advisors retain those decisions.
Sources
- [1] Florida Bar News — New Florida Bar guidelines offer framework for law firm cyber resilience (May 15, 2025)
- [35] LegalFuel — Recommendation 25-1: Voluntary Implementation of Incident Response Plans
- [36] CISA — #StopRansomware Guide
Author & technical scope review
Gregory Mathews
Gregory is the Systems Architect and founder of Suncoast MIS, with 15+ years of practical IT and systems architecture experience. He authored this article and reviewed its technical scope. Compliance, legal, and insurance conclusions remain with each organization and its qualified advisors.