Maksim Kabakou – Fotolia

With hackers and other cyber pitfalls affecting more and more law firms, there is still no universally accepted standard that firms must meet to show that they are adequately protected.

In the legal industry, concerns about how to assess firms' cyber defenses will likely grow, as a growing number of corporate clients insist outside counsel undergo, and most often pay for, cybersecurity audits.

“We have seen an exponential increase in inquiries from law firms in 2017 versus years past,” said John DiMaria, a marketing executive in the London office of BSI Group, which provides certifications related to cybersecurity, including certification for ISO/IEC 27001, an international standard for information security management.

According to Patti Moran, a spokeswoman for the International Legal Technology Association, and its subsidiary ILTA LegalSEC, a community of law firms seeking to improve the security in the global legal community, more than 44 law firms had achieved that certification by the end of last year, and another 56 were working toward it.

That's a big increase from two years ago, when The American Lawyer reported that at least 10 Am Law 200 firms had attained the ISO certification to assure clients they were taking steps toward protecting their documents and communication systems.

To make audits' worth their expense, cybersecurity auditors must use accepted and published benchmarks, said Jeffrey Ritter, a visiting fellow at the University of Oxford and founding chairman of the American Bar Association's committee on cyberspace law. “You have to show what criteria you are using,” he said.

At the same time, Ritter argues that such standards “have a level of ambiguity” that makes them insufficient safeguards.

Meeting an ISO standard is simply not enough, according to John Sweeney, president of Nashville, Tennessee-based LogicForce, which conducts cybersecurity audits largely for law firms. (Other providers of cybersecurity audits include all the Big Four accounting firms, BSI Group and Resiliam.)

“ISO is only a single standard that doesn't necessarily cover practical implementation of best practices. Our experience with corporate audits from financial, health, insurance, and other industries have shown ISO 27001 compliance isn't enough to get law firms to pass their audits,” Sweeney wrote in an email responding to questions for this article.

Moreover, many firms fall far behind even the minimum requirements to meet the ISO standards, a set of legal, physical and technical policies for information risk management procedures, including rules about documentation, management responsibility, internal audits, continual improvement, and corrective and preventive action.

“There is currently a large gap in where plenty of law firms are today, and any formal certification process,” Sweeney wrote.

According to LogicForce's most recent survey of 200 law firms, ranging in size from one to more than 450 lawyers, 100 percent of the firms failed to meet their clients' standards for cybersecurity.

Despite the questions about which standards best apply, more corporate clients are asking their outside firms to undergo the cybersecurity audits.

Mark Smolik, general counsel of DHL Supply Chain Americas, said he will put his regular outside counsel on notice in January that he expects their firms to undergo cybersecurity audits by LogicForce or other vendors.

“We will be working with our IT and procurement departments to evaluate vendors who are best suited to assist us in performing these audits, Smolik said. Any decision as to who we ultimately retain will be based on our internally vetted objective evaluation criteria.”

Smolik sits on LogicForce's advisory board, as does Lisa Kobie, senior director for legal operations for Adobe Systems Inc., and retired U.S. District Judge Shira Scheindlin, who is of counsel to Stroock & Stroock & Lavan.

Typically, the law firms, not the clients, pay for the audits, even if the clients initiated them. “Most times law firms eat this cost as data management/cyber security audits are very rapidly becoming a prerequisite for doing business,” Sweeney said in an email.

What is the cost? “The price varies depending on the depth and breadth of the audit and who is taking the lead (corporation or law firm). Audits vary greatly by the type of business, regulatory factors and IT leadership,” Sweeney wrote.

The ISO certifications alone are about $30,000 for three years. And that, of course, doesn't include the cost of implementing cyber defenses and best practices to qualify for certification.

Law firms had been historically late to the cybersecurity party compared to other types of business concerns, according to Ritter.

Even as recently as two decades ago, “Law firms did not see cybersecurity as necessary for building trust in their relationships,” Ritter said. They have, however, “slowly begun to recognize” the need, he said.

One sign of that, said Ritter: More firms are taking their chief information officers along for client development meetings.

Note: This story was updated to clarify comments by DHL's Mark Smolik.

Maksim Kabakou – Fotolia

With hackers and other cyber pitfalls affecting more and more law firms, there is still no universally accepted standard that firms must meet to show that they are adequately protected.

In the legal industry, concerns about how to assess firms' cyber defenses will likely grow, as a growing number of corporate clients insist outside counsel undergo, and most often pay for, cybersecurity audits.

“We have seen an exponential increase in inquiries from law firms in 2017 versus years past,” said John DiMaria, a marketing executive in the London office of BSI Group, which provides certifications related to cybersecurity, including certification for ISO/IEC 27001, an international standard for information security management.

According to Patti Moran, a spokeswoman for the International Legal Technology Association, and its subsidiary ILTA LegalSEC, a community of law firms seeking to improve the security in the global legal community, more than 44 law firms had achieved that certification by the end of last year, and another 56 were working toward it.

That's a big increase from two years ago, when The American Lawyer reported that at least 10 Am Law 200 firms had attained the ISO certification to assure clients they were taking steps toward protecting their documents and communication systems.

To make audits' worth their expense, cybersecurity auditors must use accepted and published benchmarks, said Jeffrey Ritter, a visiting fellow at the University of Oxford and founding chairman of the American Bar Association's committee on cyberspace law. “You have to show what criteria you are using,” he said.

At the same time, Ritter argues that such standards “have a level of ambiguity” that makes them insufficient safeguards.

Meeting an ISO standard is simply not enough, according to John Sweeney, president of Nashville, Tennessee-based LogicForce, which conducts cybersecurity audits largely for law firms. (Other providers of cybersecurity audits include all the Big Four accounting firms, BSI Group and Resiliam.)

“ISO is only a single standard that doesn't necessarily cover practical implementation of best practices. Our experience with corporate audits from financial, health, insurance, and other industries have shown ISO 27001 compliance isn't enough to get law firms to pass their audits,” Sweeney wrote in an email responding to questions for this article.

Moreover, many firms fall far behind even the minimum requirements to meet the ISO standards, a set of legal, physical and technical policies for information risk management procedures, including rules about documentation, management responsibility, internal audits, continual improvement, and corrective and preventive action.

“There is currently a large gap in where plenty of law firms are today, and any formal certification process,” Sweeney wrote.

According to LogicForce's most recent survey of 200 law firms, ranging in size from one to more than 450 lawyers, 100 percent of the firms failed to meet their clients' standards for cybersecurity.

Despite the questions about which standards best apply, more corporate clients are asking their outside firms to undergo the cybersecurity audits.

Mark Smolik, general counsel of DHL Supply Chain Americas, said he will put his regular outside counsel on notice in January that he expects their firms to undergo cybersecurity audits by LogicForce or other vendors.

“We will be working with our IT and procurement departments to evaluate vendors who are best suited to assist us in performing these audits, Smolik said. Any decision as to who we ultimately retain will be based on our internally vetted objective evaluation criteria.”

Smolik sits on LogicForce's advisory board, as does Lisa Kobie, senior director for legal operations for Adobe Systems Inc., and retired U.S. District Judge Shira Scheindlin, who is of counsel to Stroock & Stroock & Lavan.

Typically, the law firms, not the clients, pay for the audits, even if the clients initiated them. “Most times law firms eat this cost as data management/cyber security audits are very rapidly becoming a prerequisite for doing business,” Sweeney said in an email.

What is the cost? “The price varies depending on the depth and breadth of the audit and who is taking the lead (corporation or law firm). Audits vary greatly by the type of business, regulatory factors and IT leadership,” Sweeney wrote.

The ISO certifications alone are about $30,000 for three years. And that, of course, doesn't include the cost of implementing cyber defenses and best practices to qualify for certification.

Law firms had been historically late to the cybersecurity party compared to other types of business concerns, according to Ritter.

Even as recently as two decades ago, “Law firms did not see cybersecurity as necessary for building trust in their relationships,” Ritter said. They have, however, “slowly begun to recognize” the need, he said.

One sign of that, said Ritter: More firms are taking their chief information officers along for client development meetings.

Note: This story was updated to clarify comments by DHL's Mark Smolik.