US legal systems · jurisdiction-specific requirements
Planning a penetration test
for US legal systems.
Connect your confidentiality requirements to the systems you need assessed. Identify the policies, jurisdictions, information and evidence that matter to your organisation.
Start with your context
Identify what applies
to your organisation.
| Your situation | Why it matters | What to establish |
|---|---|---|
| A law firm or legal function | You commission testing of systems used in legal work. | Identify the governing professional rules, internal policies and relevant agreements. ABA Opinion 512 interprets existing duties in an AI context; the applicable state rules govern your lawyers’ obligations. |
| A legal software supplier | You need evidence about your product and its handling of information. | Record your own security requirements and any contractual commitments separately. A lawyer’s professional duties do not automatically apply to every software vendor. |
| Work across jurisdictions | Your systems support lawyers or matters in several locations. | Use California section 6068(e) and New York Rule 1.6(c) as examples of confidentiality duties, not a complete US checklist. Have the appropriate owner establish what applies. |
A jurisdiction is a starting point, not a complete assessment specification. Your workflows, processing arrangements and applicable contracts help determine the scope.
Make the scope concrete
Prepare the information
your assessment needs.
| Area | What to prepare | What this helps define |
|---|---|---|
| Requirement and owner | Record the rule, internal policy or contract clause, and who can confirm its applicability. Label an unresolved point “to confirm”. | A requirements list that separates technical questions from legal interpretations and commercial preferences. |
| Information and workflow | Describe matter/document handling, roles, sharing, exports and the applications or APIs involved. | An agreed scope connected to the information and actions your organisation needs to protect. |
| Restrictions and integrations | Record permitted processing and access locations, retention requirements and relevant third-party components. | Clear boundaries for assessment access, evidence handling and any additional provider permission. |
| AI-enabled work, if present | Identify model providers, connected data, permitted actions and applicable use or training restrictions. | Technical checks for the connected workflow, alongside a separate review of the tool’s terms and organisational safeguards. |
| Evidence and follow-up | Identify who needs the report, what they must decide, the required coverage and who owns fixes. | A report and remediation process that support your decision, including agreed retest evidence. |
Useful outputs
Ask for evidence
you can act on.
Connect each technical question to planned coverage and evidence during scoping. Include application input handling, business logic, integrations and relevant deployment configuration where they fall within scope. A permissions-only test may leave important parts of your application unassessed.
Common questions
Resolve the decisions
before testing starts.
Does using self-hosted models settle our confidentiality requirements?
No. Provider access is one part of the arrangement. You still need to consider access permissions, locations, retention, logging, training settings and applicable agreements. Confirm those requirements before material is accessed.
What should we do with a client’s security questionnaire?
If one applies, identify the exact technical evidence requested, the systems covered and any provider conditions. Keep those contractual questions alongside your own priorities; a questionnaire is not a substitute for an agreed test scope.
Do the California and New York examples cover the whole US?
No. They illustrate jurisdiction-specific duties. Establish the rules relevant to your lawyers and work, and have your legal or governance owner confirm applicability before treating a requirement as binding.
Sources & related guidance
Check the source
for your requirement.
Reviewed 25 September 2026. ABA guidance and the selected state sources are contextual references. California and New York are examples, not exhaustive US coverage or a legal applicability opinion.
Let’s plan
your assessment.
Tell us about the system you need assessed, the questions you want answered and any specific requirements. We can help you shape a practical scope.