Cybersecurity for law firms and notaries in Morocco: professional secrecy and priority measures
Law firm or notary office in Morocco: professional secrecy, bank detail fraud, remote signing, archives, backups. The measures to take first.
The short answer: a law firm or notary office does not just have data to protect, it has a secret to keep. Its files contain litigation, planned disposals, inheritances and personal wealth, and a notary office also sees third-party funds pass through with every sale. The priorities, in order: multi-factor authentication on email and remote access, a written procedure against bank detail fraud, access rights per file, encrypted laptops protected by EDR, encrypted document exchanges, controlled service providers, and a tested offline backup with a fallback way of working.
At ALLSAFE SOLUTIONS, we support regulated professions from Casablanca with their IT and security (see our page on IT for accounting and law firms). This guide lists what we put in place first. It is not legal advice: points of law should be checked with your bar, your regional council or your usual adviser.
Why these professions are targets
The most detailed reference on the subject comes from France: the report by ANSSI (the French cybersecurity agency), “State of the IT threat against law firms”, dated 27 June 2023. To our knowledge there is no public Moroccan equivalent, but its findings on attackers’ methods do not stop at a border. The agency distinguishes three main threats:
| Threat | Attacker’s goal | What it means for a firm |
|---|---|---|
| Financially motivated attacks | Extort money, resell data, commit fraud | Ransomware, fake transfers, theft of deal files before they are announced |
| Espionage | Monitor a lawyer or, through them, their clients | Email read silently, spyware on a phone |
| Destabilisation | Damage a reputation, weigh on a case | Disclosure of documents by activist groups |
ANSSI notes that financially motivated attacks remain the main threat by number, and that the attack surface grows as the profession and court procedures go digital. This also holds in Morocco: lawyers increasingly exchange electronically with the courts, and notaries file online with the land registry agency (ANCFCC).
What the legal texts say
| Framework | What it implies |
|---|---|
| Law 66-23 (lawyers) | Published in the Official Bulletin on 20 August 2026 according to press reports, it is set to replace law 28-08 and reaffirms professional secrecy. Check the exact wording with your bar |
| Law 32-09 (notaries) | Article 24 imposes professional secrecy on notaries, their trainees and their employees; article 33 governs the deposit of third-party funds with the Caisse de Dépôt et de Gestion (CDG) |
| Penal Code, article 446 | Punishes breaches of professional secrecy |
| Law 09-08 (personal data) | Client files, ID documents, employee data: security to ensure, processing to frame, CNDP as supervisory authority |
For details, see our guide to law 09-08 and the CNDP. Law 66-23 is recent and contested by part of the profession, so we do not quote any of its articles here.
The priority measures
| Priority | Measure | What it prevents |
|---|---|---|
| 1 | Multi-factor authentication everywhere, partners included | A mailbox being read silently |
| 2 | SPF, DKIM and DMARC on the domain | Fake emails sent in the firm’s name |
| 3 | Procedure against bank detail fraud | A sale balance paid to a fraudster |
| 4 | Access rights per file, walls between teams | One compromised account exposing every client |
| 5 | Encrypted work laptops, without admin rights | A laptop left at court becoming a data leak |
| 6 | Monitored EDR and fast patching | Ransomware detected too late |
| 7 | Encrypted, time-limited document exchanges | A sensitive file forwarded as an attachment with no control |
| 8 | Controlled, traced service providers | Unmanaged third-party access to files |
| 9 | Immutable backup and offline copy | Lost deeds and archives |
| 10 | Fallback mode planned in advance | A hearing or signing missed during an outage |
1 and 2: email first
Email holds most of the life of a case file. Turn on multi-factor authentication for everyone: exemptions granted to partners cover exactly the most valuable accounts. Our MFA rollout guide explains the method, and our 10 settings to secure Microsoft 365 cover the rest. Also check automatic forwarding rules: they are a classic way to read a lawyer’s mail without ever logging in again. Then publish SPF, DKIM and DMARC to stop your domain being spoofed.
3: bank detail fraud, the risk specific to notary offices
Notaries receive third-party funds and deposit them with the CDG, then pay the seller, the authorities and creditors. The scenario to fear is simple: a fraudster reading a mailbox spots a sale about to close and sends fake bank details, at the right moment, in the right tone. France’s national bar council reports the same risk of fraudulent bank detail changes for lawyers. The defence comes down to three written rules:
- no bank details accepted or changed on the strength of an email or a PDF alone;
- a call back on a number already known, never the one in the message;
- a second approval for every payment, with no exception for urgency.
Say so when the file is opened: “this office will never ask you to change bank details by email”. On the day the message arrives, the client knows what to make of it. Online banking portals and remote payment channels also deserve multi-factor authentication and named user rights.
4: need to know
In many firms everyone can see everything, because file sharing grew without a plan. Yet two partners may act for clients with opposing interests. Set up one space per file or team, with rights granted on request and removed at closure, and a restricted group for the most sensitive matters. For credentials, use a business password manager for shared platforms and portals, and never a spreadsheet.
5 and 6: laptops, at the office and at court
A lawyer’s laptop travels: hearings, meetings, home. It must be encrypted with BitLocker, managed remotely so it can be wiped if stolen, and protected by EDR rather than plain antivirus. ANSSI also recommends removing admin rights, preventing users from installing software and limiting USB drives to the firm’s own, a point worth remembering for media handed over by a client or an opposing party.
It also recommends banning personal devices. If a personal phone is still tolerated, at least control access to firm data with Microsoft Intune, and treat the most exposed people separately, for whom the spyware risk is not theoretical: an up-to-date system and a separate phone for sensitive matters.
7: exchanging documents without scattering them
Email remains the usual channel, and it leaves copies everywhere. Three simple improvements:
- One exchange space per file, with links reserved for invited people and an expiry date.
- Encryption of sensitive messages. Microsoft 365 Business Premium includes Microsoft Purview Message Encryption and manual sensitivity labels, which can follow a document outside the firm.
- A rule on generative AI. Pasting a pleading or draft deed into a consumer AI service amounts to handing it to a third party. See our guide on shadow IT and generative AI, together with an IT acceptable use policy.
Also think about multifunction copiers, heavily used to scan deeds and exhibits: they can retain documents on their disk and send scans to mailboxes. Our guide to business printer security lists the useful settings.
8: your service providers, including us
This is ANSSI’s first recommendation: analyse the risks of each host, integrator, maintainer and software vendor, including their effects on professional secrecy. For a firm, that means concrete requirements:
- a confidentiality clause in the contract, suited to professional secrecy;
- named accounts with multi-factor authentication, never a shared “admin” account;
- traced interventions, on site and in your presence where possible;
- known data location, including for cloud services: see our guide to data transfers outside Morocco.
Ask any managed IT provider for these guarantees, us included.
9 and 10: backup and fallback mode
Apply the 3-2-1 rule with an immutable copy, and do not forget email (see Microsoft 365 backup). ANSSI adds a regular offline copy, kept in a secure physical location.
Finally, plan how to work without the usual system: a spare laptop, a fallback communication channel, a paper list of upcoming hearings or signings, numbers to call. An incident response plan also sets who decides to inform clients and the professional body, a topic to prepare with your adviser before any crisis. For remote access, use a VPN or ZTNA with multi-factor authentication, never an exposed remote desktop.
What changes for a notary office
The profession has already digitised much of its exchanges. Three points deserve particular attention:
- Professional and government platforms. Online filing with ANCFCC, remote payment of fees through CDG channels (CDGNET+, CDG Mobile) and the Tadbirnot portal of the national Order of Notaries, designed for remote electronic signature and archiving of deeds, all rely on the office’s user rights. These accesses must be named, never lent to a colleague “to save time”, and removed as soon as the person leaves.
- Certificates and signing devices. A key or certificate left permanently on an assistant’s computer cancels out much of the security. Store them away, and limit who can use them.
- Archives. A notary does not own their archives: they pass to the successor or replacement when there is a change. Digital copies and their backups must therefore remain readable and transferable over time, without depending on a personal account or unmaintained software.
The mistakes we come across
- Partners exempted from multi-factor authentication because they travel a lot.
- A file server open to everyone, with no separation of files or teams.
- Free email accounts used for client exchanges, or a shared generic mailbox.
- A USB backup drive permanently connected, encrypted along with the server.
- Former staff whose accounts and platform access remain active.
- A provider with permanent access to everything, with no contract or trace of its work.
- Bank details sent by email, with no call back or second approval.
Checklist to get started
- Turn on multi-factor authentication on all accounts, without exception.
- Check automatic forwarding rules on mailboxes.
- Publish SPF, DKIM and DMARC.
- Write the bank detail fraud procedure and inform clients.
- Inventory sensitive files and review access rights.
- Check laptop encryption, EDR and admin rights.
- List service providers and the access they hold.
- Test a restore, then write the disaster recovery plan and the fallback mode.
- Train the whole team, front desk included, using our guide to phishing in Moroccan SMBs.
On a related topic, see also our guide on cybersecurity for accounting firms and fiduciaries.
How we work
We start with an audit: email, laptops, file sharing, backups, remote access and third-party access. We deliver a list of actions ranked by priority, then carry them out without blocking your work, taking account of the hearing and signing calendar. After that, laptops, servers and backups are monitored 24/7, with critical incidents handled in under 15 minutes.
Discover our business cybersecurity in Morocco offer and our managed IT services in Morocco offer, then request your free initial audit: we reply within 24 business hours.
Sources: ANSSI, “État de la menace informatique contre les cabinets d’avocats” (27 June 2023); Conseil national des barreaux (August 2026); on law 66-23, Le360 and Le Matin; on law 32-09 and archives, La Vie éco; on notary digitisation, Finances News: Tadbirnot and CDG-ANCFCC payment; Microsoft Learn: information protection with Business Premium; CNDP for law 09-08.
Frequently asked questions
Why are lawyers and notaries targeted so often?
Because they concentrate sensitive information about their clients: litigation, acquisitions, inheritances, personal wealth. In its report of 27 June 2023 on French law firms, the French agency ANSSI identifies three types of threat: financially motivated attacks, espionage and destabilisation. Notary offices add a direct attraction: third-party funds that pass through with every sale.
Can a data leak amount to a breach of professional secrecy?
That is a question to settle case by case with your legal adviser or professional body. Professional secrecy binds lawyers and notaries alike, and notaries’ trainees and employees too. In practice, the firm must be able to show the measures taken to protect files: access rights, encryption, logs, control of service providers.
How can we avoid fake bank details when paying out the balance of a sale?
With a written rule: no bank details are accepted or changed on the strength of an email alone. The office calls the beneficiary back on a number it already knows, never the one in the message, and a second person approves the transfer. Tell clients this rule when the file is opened: they will know that any contrary message is suspect.
Can a firm store its files in the cloud?
Nothing about how the cloud works rules it out in principle, but the decision has to be examined: data location, transfers outside Morocco under law 09-08, trust in the provider, the rules of your professional body. ANSSI recommends analysing the risks of each service provider, including their effects on professional secrecy. Add multi-factor authentication, encryption and an independent backup.
Can a firm’s managed IT provider access client files?
Technically an administrator often can, so it has to be controlled. Include a confidentiality clause in the contract, named accounts, multi-factor authentication, access limited to what is needed and logs you can consult. ANSSI also recommends systematically tracing provider interventions and preferring those carried out on site, in the firm’s presence.
About the editorial team
ALLSAFE SOLUTIONS
Network, security and cloud engineers
Written by the engineering team at ALLSAFE SOLUTIONS, a managed IT provider founded in Casablanca by network, security and cloud engineers. Our articles draw on the projects we deliver for clients in Morocco and abroad.
LinkedIn
