# Free security training for law firm staff: official guides from NIST and the PLF > A sourced list of free, official cybersecurity training and guides for Oregon law firm staff, from NIST's Small Business Cybersecurity Corner to the PLF's cybersecurity CLE and data breach checklist. Law + AI Daily by TacticalMS · Learn · Published 2026-11-05 Canonical: https://tacticalms.dev/blog/free-security-training-law-firm-staff ## The short version - NIST's Small Business Cybersecurity Corner gathers free guides, training, videos and quick start guides, with topic pages on phishing, ransomware and employee awareness [1, 2, 3]. - NIST also keeps a list of free and low-cost online learning content, including an employee awareness training section [4]. - The PLF's on-demand CLE on firm cybersecurity is approved for 0.5 Ethics and 0.5 Practical Skills credits, extended to November 30, 2027 [6]. - The PLF's data breach checklist says staff training is "your first line of defense" and suggests training once or twice a year [7]. Law firm staff can learn cybersecurity basics from free, official sources: the National Institute of Standards and Technology (NIST) Small Business Cybersecurity Corner and its list of free learning content, and the Oregon State Bar Professional Liability Fund (PLF), which offers a cybersecurity CLE and a data breach checklist [1, 4, 6, 7]. This list describes what each resource is and who it suits, using only what each source states. It follows this week's posts on [the CrowdStrike report on attacks against law firms](/blog/crowdstrike-2026-legal-threat-landscape-report) and [Oregon's data breach notice law](/blog/oregon-data-breach-notice-law-ors-646a) [7]. ## NIST Small Business Cybersecurity Corner: the starting point The Small Business Cybersecurity Corner is a NIST website that collects cybersecurity resources for small businesses [1]. Its menu includes Cybersecurity Basics, Quick Start Guides, Events, Guidance by Topic, Training, Videos and a Cybersecurity Support Programs Finder [1]. Topic pages cover subjects such as phishing, ransomware, multi-factor authentication, securing data and devices, cyber insurance, responding to a cyber incident and solopreneurs [1]. NIST says a resource can be listed in the Corner if it is publicly available, accurate and "freely available for others to use" [1]. NIST also says that naming a commercial entity on these pages is not a recommendation or endorsement [1]. The page lists a NIST Small Business Cybersecurity Community of Interest call on November 10, 2026 [1]. **Who it suits:** office managers and firm owners who want one place to start, and solo lawyers who want the solopreneur guidance [1]. ## NIST Training and Employee Awareness pages NIST's Training page "includes training resources such as educational courses, webinars, and videos" [2]. It lists NIST's own guide on building a cybersecurity and privacy learning program, several outside training programs for small businesses (one of which notes that an account login is required), and NIST's list of free and low-cost online learning content [2]. It also links five short case studies, including one on social engineering and phishing and one on a data breach [2]. The page was updated August 26, 2026 [2]. The Employee Awareness page collects "materials that can help raise employee awareness about the importance of cybersecurity" [3]. It lists a Department of Homeland Security guide for small business leaders called Cyber Essentials, a list of common cybersecurity misconceptions from the National Cybersecurity Alliance, and a NICE Working Group guidebook titled "Cybersecurity is Everyone's Job," which NIST describes as written for a general audience [3]. **Who it suits:** paralegals, legal assistants and front-desk staff who handle email and client files every day, and the person who has to organize training for them [2, 3]. ## NIST's list of free and low-cost learning content NIST's NICE program keeps a page of "free and low-cost online educational content" on information technology and cybersecurity [4]. It is split into sections for career and professional development, employee awareness training, educator training and K-12 education [4]. The page says some, not all, of the listed items may count toward professional learning goals or certifications, and that the page is updated as new information is gathered [4]. Like the Corner, it says listing a commercial product is not an endorsement by NIST [4]. **Who it suits:** staff who want short awareness courses, and anyone at the firm considering a deeper IT or security course [4]. Because the list mixes free and low-cost items, each provider's own page states the cost [4]. ## NIST quick start guides The Quick Start Guides page offers short introductory guides to NIST frameworks, including "NIST Cybersecurity Framework 2.0: Small Business" and a small business guide to the NIST Privacy Framework [5]. NIST says the guides are "not intended to replace the larger publications" and are meant to help small organizations get started [5]. **Who it suits:** the partner or manager responsible for the firm's overall security plan, more than day-to-day staff [5]. ## PLF CLE: Understanding Your Firm's Cybersecurity Obligations and Exposures The PLF lists an on-demand CLE, "Understanding Your Firm's Cybersecurity Obligations and Exposures," dated May 31, 2023, in streaming video format [6]. The presenters are Hong Dao, Director of the PLF's Practice Management Assistance Program, and Sarah Dufendach, a cyber claims manager at Beazley Group [6]. The page says it covers a lawyer's ethical obligations to understand technology and protect client data, common cyber threats, how insurers typically handle data breach claims, and what to do after a security incident [6]. The PLF says the program is approved for 0.5 Ethics and 0.5 Practical Skills MCLE credits, with credit extended to November 30, 2027 [6]. The page says the video "is available upon request" by contacting the PLF, and it links downloadable program materials [6]. The page does not state a price. **Who it suits:** Oregon lawyers who want Oregon-specific ethics context with MCLE credit; staff can also use the program materials [6]. For a related walk-through of payment verification drawn partly from these materials, see [how firms verify payment requests when voices can be cloned](/blog/verify-payment-requests-ai-voice-cloning-law-firm) [6]. ## PLF checklist: an outline for a staff session The PLF's "Checklist to Prevent and Prepare for a Data Breach" (revised August 2023) is a five-page practice aid [7]. Item 15, "Train Staff and Create Policies," says training staff is "your first line of defense against a data breach" [7]. It suggests biannual or annual training on computer security, social engineering, identity verification, phishing and scams, and password management [7]. Other items in the checklist cover topics that work as agenda items for a staff meeting [7]: - **Phishing:** contact the sender by phone, using a number verified separately from the email, before opening an unexpected attachment [7]. - **Passwords:** passphrases of at least 14 characters, unique passwords, and multifactor authentication [7]. - **Backups:** the 3-2-1 rule, meaning at least three copies of data on two storage types with one copy offsite, and regular recovery tests [7]. - **Updates and devices:** install operating system and program updates, encrypt devices, and use firm-owned devices for remote work [7]. The checklist names some commercial training companies; this list does not, and the PLF's own notice says the material does not establish the standard of care for Oregon lawyers [7]. **Who it suits:** small Oregon firms that want a short, Oregon-specific outline written for law offices [7]. ## Checking credit and cost before relying on it Each resource states its own terms. The PLF page states the MCLE credit and its extension date, and NIST's lists say whether an item is free or low-cost only at the level of the whole list [4, 6]. For questions about how a security practice fits a lawyer's ethical duties, the PLF's practice management advisors and a licensed Oregon attorney are the sources to consult [6, 7]. ## Common questions ### Where can a small law firm find free cybersecurity training for staff? NIST's Small Business Cybersecurity Corner has a Training section with courses, webinars and videos, and an Employee Awareness section with materials for staff [2, 3]. NIST says resources listed in the Corner must be freely available for others to use [1]. ### Is there an Oregon CLE on law firm cybersecurity? The Oregon State Bar Professional Liability Fund lists "Understanding Your Firm's Cybersecurity Obligations and Exposures," recorded May 31, 2023, approved for 0.5 Ethics and 0.5 Practical Skills MCLE credits, with credit extended to November 30, 2027 [6]. ### How often does the PLF suggest training law firm staff on security? The PLF's "Checklist to Prevent and Prepare for a Data Breach" suggests offering biannual or annual training on topics such as social engineering, identity verification, phishing and password management [7]. ## Sources 1. [Small Business Cybersecurity Corner](https://www.nist.gov/itl/smallbusinesscyber), National Institute of Standards and Technology, accessed November 5, 2026 2. [Training](https://www.nist.gov/itl/smallbusinesscyber/training), National Institute of Standards and Technology, updated August 26, 2026 3. [Employee Awareness](https://www.nist.gov/itl/smallbusinesscyber/guidance-topic/employee-awareness), National Institute of Standards and Technology, updated August 26, 2026 4. [Free and Low Cost Online Cybersecurity Learning Content](https://www.nist.gov/itl/applied-cybersecurity/nice/resources/online-learning-content), NIST NICE, accessed November 5, 2026 5. [NIST Small Business Quick-Start Guides](https://www.nist.gov/itl/smallbusinesscyber/quick-start-guides), National Institute of Standards and Technology, updated September 16, 2026 6. [Understanding Your Firm's Cybersecurity Obligations and Exposures (MCLE credit extended to November 30, 2027)](https://www.osbplf.org/cle-classes/understanding-your-firms-cybersecurity-obligations-and-/), Oregon State Bar Professional Liability Fund, May 31, 2023 7. [Checklist to Prevent and Prepare for a Data Breach](https://assets.osbplf.org/forms/practice_forms/Checklist%20to%20Prevent%20and%20Prepare%20for%20a%20Data%20Breach.pdf), Oregon State Bar Professional Liability Fund, rev. August 2023 --- Not legal advice. This post is general information about law and technology, not legal advice. It does not create an attorney-client relationship, and TacticalMS is not a law firm. Laws, rules and ethics opinions change; check the cited sources and talk with a licensed Oregon attorney about any specific situation.