Outside Counsel Guidelines Lack Cyber Requirements. Does It Matter?
A lack of formal cybersecurity requirements for outside counsel doesn't necessarily equate to higher cyberrisks.In the aftermath of the ransomware…
July 19, 2017 at 08:55 AM
4 minute read
The original version of this story was published on Law.com
A lack of formal cybersecurity requirements for outside counsel doesn't necessarily equate to higher cyberrisks.
In the aftermath of the ransomware attack on DLA Piper, many legal departments may be reviewing their outside counsel's security protections, not just in terms of the technology their firms have, but also the processes and policies they put in place. Such cybersecurity best practices, however, are often not codified in legal departments' outside counsel guidelines, according to a Gartner and Wolters Kluwer report.
Titled “Unlock Insights Into Outside Counsel Billing and Staffing Guidelines,” the report analyzed the results of a survey of 51 legal departments at various mid- to large-sized global corporations. The report found that of the 75 percent of respondents that had outside counsel guidelines in place, only 31 percent had guidelines that included formal data security requirements.
But some believe that this is not necessarily a bad omen. Such an oversight is unlikely to expose legal departments to higher cyberrisk, given the nature of their law firms' obligations, and the general lack of enforcement of such guidelines in the first place. William A. Sowinski, director of decision support services at Wolters Kluwer's ELM Solutions, noted that because “law firms are required to keep information confidential,” many of their clients already assume they have robust cybersecurity protections in place from the start.
It is not a farfetched assumption to make. Given law firms' ethical obligations, and the anxiety over recent cyberattacks, John Sweeney, president of LogicForce, told Legaltech News affiliate Corporate Counsel that most, if not all, major law firms are making cybersecurity a priority. “I don't think there's a law firm that doesn't have policies in place and isn't training their people.”
Sweeney added that for many firms, cybersecurity is also a business necessity in attracting and retaining clients with highly sensitive information. “If I'm the CEO of IBM and I entrust IP for Watson to a big or small IP firm, think about if it got stolen, what the impact would be. These are very serious issues.”
Yet some still see third-party guidelines as a vital tool in creating a culture of security in the legal industry. The Association of Corporate Counsel (ACC) recently released model cybersecurity guidelines for outside counsel. Meanwhile, the New York State Department of Financial Services' (NYS DFS) new data security regulation seeks to make law firms more cognizant of who accesses and handles sensitive client data.
Keith Lipman, CEO of Prosperoware, wrote in LTN, “The ACC guidelines and the NYS DFS cybersecurity regulations tell an impactful story for the legal services industry: 'need to know' access privilege is the new standard of care.”
Guideline requirements, of course, are not the only way legal departments can ensure cybersecurity protections from their outside counsel. Sowinski noted, for instance, that many departments “are also increasingly indicating that they will, or have the right to, audit [their law firms'] cybersecurity.”
Indeed, security audits may be more reliable than outside counsel guidelines for ensuring cybersecurity standards, given that such guidelines are rarely enforced or complied with. The Gartner and Wolters Kluwer's report found that only 31 percent of respondents were satisfied with their outside counsel's compliance with the guidelines, while none said they were “completely satisfied.”
In addition, only one-third said their legal department's employees knew their department's outside counsel guidelines well, while 36 percent of respondents did not know who was responsible for managing or enforcing their guidelines.
This lack of enforcement is due to multiple factors, Sowinski said. “Internal lawyers are not really good at managing process,” he explained. “They went to law school, they want to exercise strategy and add value to cases, and they are fair less interested in overseeing the process by which these cases or these matters are handled.”
Sowinski added that in-house attorneys may also be hesitant to confront their outside counsel given that they see them as “friends and colleagues with whom they go into battle with,” and that they are rarely rewarded by managers for reprimanding their outside counsel.
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View AllUS Reviewer of Foreign Transactions Sees More Political, Policy Influence, Say Observers
Pre-Internet High Court Ruling Hobbling Efforts to Keep Tech Giants from Using Below-Cost Pricing to Bury Rivals
6 minute readPreparing for 2025: Anticipated Policy Changes Affecting U.S. Businesses Under the Trump Administration
Senate Panel Postpones Vote on Reconfirmation of Democrat Crenshaw to SEC
Trending Stories
- 1Recent Decisions Regarding the Telephone Consumer Protection Act
- 2The Tech Built by Law Firms in 2024
- 3Distressed M&A: Mass Torts, Bankruptcy and Furthering the Search for Consensus: Another Purdue Decision
- 4For Safer Traffic Stops, Replace Paper Documents With ‘Contactless’ Tech
- 5As Second Trump Administration Approaches, Businesses Brace for Sweeping Changes to Immigration Policy
Who Got The Work
Michael G. Bongiorno, Andrew Scott Dulberg and Elizabeth E. Driscoll from Wilmer Cutler Pickering Hale and Dorr have stepped in to represent Symbotic Inc., an A.I.-enabled technology platform that focuses on increasing supply chain efficiency, and other defendants in a pending shareholder derivative lawsuit. The case, filed Oct. 2 in Massachusetts District Court by the Brown Law Firm on behalf of Stephen Austen, accuses certain officers and directors of misleading investors in regard to Symbotic's potential for margin growth by failing to disclose that the company was not equipped to timely deploy its systems or manage expenses through project delays. The case, assigned to U.S. District Judge Nathaniel M. Gorton, is 1:24-cv-12522, Austen v. Cohen et al.
Who Got The Work
Edmund Polubinski and Marie Killmond of Davis Polk & Wardwell have entered appearances for data platform software development company MongoDB and other defendants in a pending shareholder derivative lawsuit. The action, filed Oct. 7 in New York Southern District Court by the Brown Law Firm, accuses the company's directors and/or officers of falsely expressing confidence in the company’s restructuring of its sales incentive plan and downplaying the severity of decreases in its upfront commitments. The case is 1:24-cv-07594, Roy v. Ittycheria et al.
Who Got The Work
Amy O. Bruchs and Kurt F. Ellison of Michael Best & Friedrich have entered appearances for Epic Systems Corp. in a pending employment discrimination lawsuit. The suit was filed Sept. 7 in Wisconsin Western District Court by Levine Eisberner LLC and Siri & Glimstad on behalf of a project manager who claims that he was wrongfully terminated after applying for a religious exemption to the defendant's COVID-19 vaccine mandate. The case, assigned to U.S. Magistrate Judge Anita Marie Boor, is 3:24-cv-00630, Secker, Nathan v. Epic Systems Corporation.
Who Got The Work
David X. Sullivan, Thomas J. Finn and Gregory A. Hall from McCarter & English have entered appearances for Sunrun Installation Services in a pending civil rights lawsuit. The complaint was filed Sept. 4 in Connecticut District Court by attorney Robert M. Berke on behalf of former employee George Edward Steins, who was arrested and charged with employing an unregistered home improvement salesperson. The complaint alleges that had Sunrun informed the Connecticut Department of Consumer Protection that the plaintiff's employment had ended in 2017 and that he no longer held Sunrun's home improvement contractor license, he would not have been hit with charges, which were dismissed in May 2024. The case, assigned to U.S. District Judge Jeffrey A. Meyer, is 3:24-cv-01423, Steins v. Sunrun, Inc. et al.
Who Got The Work
Greenberg Traurig shareholder Joshua L. Raskin has entered an appearance for boohoo.com UK Ltd. in a pending patent infringement lawsuit. The suit, filed Sept. 3 in Texas Eastern District Court by Rozier Hardt McDonough on behalf of Alto Dynamics, asserts five patents related to an online shopping platform. The case, assigned to U.S. District Judge Rodney Gilstrap, is 2:24-cv-00719, Alto Dynamics, LLC v. boohoo.com UK Limited.
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250