CLOC Cybersecurity Initiative Gives Legal Departments System to Judge Outside Counsel Data Defenses
The Corporate Legal Operations Consortium is in the midst of designing a framework that will help corporate legal departments better evaluate how well firms can protect valuable client data, and give firms real standards to shoot for on cybersecurity.
March 26, 2018 at 03:52 PM
4 minute read
Waking up to the news of a cyberattack is becoming almost a daily occurrence, and cyber risk looms at the forefront of many in-house lawyers' minds. Companies may be creating better training, investing in security systems and bringing in consultants to avoid falling victim to a breach.
But that effort could be for naught if companies' outside law firms, which receive some of their clients' most valuable data, don't hold up their end of the cybersecurity bargain with strong defense systems.
That's one concern addressed by the Corporate Legal Operations Consortium's Law Firm Cybersecurity Initiative, led by Gilead Sciences Inc. head of legal operations Gary Tully.
➤➤ Get in-house news and commentary straight to your in-box with Inside Track. Sign up here.
Tully, who'll be speaking on cybersecurity at CLOC's annual Corporate Legal Operations Institute in April, said it's not that firms aren't trying to be secure. Some are just struggling to address conflicting security mandates. At times the best practices and standards promulgated by clients differ from those coming from other clients or from consultants and tech experts who offer firms advice. And Tully said many of the questions in-house lawyers are asking firms about security aren't the right ones, furthering confusion on both sides.
”The goal is to set up a framework to help legal operations stand up a cybersecurity program, to get in the process of asking the questions of its law firms … We have to get clarity on what law firms are doing with our data,” Tully said.
To do this, Tully is working with a number of firms, other in-house counsel and outside providers to develop clearer industry standards and questions on security in the upcoming months. The initiative's first step is to create a uniform set of guidelines and then apply it to firms, who will be scored on their security with the help of experts.
“The score lasts for six months,” Tully said. “You update your questionnaire, your score gets re-evaluated.”
Firm scores likely won't be publicly posted, as Tully said that could attract hackers, but could be made available to prospective clients. Eventually, in-house counsel could leverage the information when choosing firms, the same way rates and diversity metrics are used.
Tully and Sheryl Falk, a partner at Winston & Strawn and co-leader of the firm's global privacy and data security task force, said that clients shouldn't have to pay extra for high-grade security at their partner law firms—it should be expected.
“I think cybersecurity is just going to be a cost of doing business,” Falk said.
CLOC's initiative aims to make cybersecurity a more common, comprehensible cost of doing business for in-house counsel, some of whom, Falk said, still aren't asking about it when picking a firm.
She added that it could be hard to standardize security needs into a single questionnaire, as different companies in different industries face varying levels of scrutiny and regulation depending on the data they handle. These regulations and needs are also subject to regular change.
“It is a little nuanced. Information security challenges continue to evolve as we see the technology change,” Falk said. “So whatever guidelines and questionnaire [CLOC] comes up with will have to be revisited on a pretty regular basis.”
Ideally, Tully's questionnaire would be adaptable to meet these needs, he said, with his initial standards serving as a baseline that can change over time. Right now, the goal is to have a clear starting point for those in the legal industry.
Tully said that he and other in-house professionals are seeing breaches become more prevalent and dramatic to the point that some law firms are shutting down for days at a time due to hacks or stolen data.
“This is terribly concerning, especially since we rely on our law firms to handle some of the most critical information that we have at our companies,” he said. “We certainly trust our firms to do what they believe is necessary, we believe they have our best interest in mind. But there is a need to ask the question: How do you protect our data?”
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View AllElection Outcome Could Spur Policy U-Turns Across Employment Landscape
6 minute readPolicy Wonks' Obsession: What Will Tuesday's Election Mean for FTC Firebrand Khan?
6 minute readAI Gives Legal Departments New Leverage to Demand Speed, Efficiency From Law Firms
3 minute readTrending Stories
- 1Infant Formula Judge Sanctions Kirkland's Jim Hurst: 'Overtly Crossed the Lines'
- 2Abbott, Mead Johnson Win Defense Verdict Over Preemie Infant Formula
- 3Guarantees Are Back, Whether Law Firms Want to Talk About Them or Not
- 4Trump Files $10B Suit Against CBS in Amarillo Federal Court
- 5Preparing Your Law Firm for 2025: Smart Ways to Embrace AI & Other Technologies
Who Got The Work
Michael G. Bongiorno, Andrew Scott Dulberg and Elizabeth E. Driscoll from Wilmer Cutler Pickering Hale and Dorr have stepped in to represent Symbotic Inc., an A.I.-enabled technology platform that focuses on increasing supply chain efficiency, and other defendants in a pending shareholder derivative lawsuit. The case, filed Oct. 2 in Massachusetts District Court by the Brown Law Firm on behalf of Stephen Austen, accuses certain officers and directors of misleading investors in regard to Symbotic's potential for margin growth by failing to disclose that the company was not equipped to timely deploy its systems or manage expenses through project delays. The case, assigned to U.S. District Judge Nathaniel M. Gorton, is 1:24-cv-12522, Austen v. Cohen et al.
Who Got The Work
Edmund Polubinski and Marie Killmond of Davis Polk & Wardwell have entered appearances for data platform software development company MongoDB and other defendants in a pending shareholder derivative lawsuit. The action, filed Oct. 7 in New York Southern District Court by the Brown Law Firm, accuses the company's directors and/or officers of falsely expressing confidence in the company’s restructuring of its sales incentive plan and downplaying the severity of decreases in its upfront commitments. The case is 1:24-cv-07594, Roy v. Ittycheria et al.
Who Got The Work
Amy O. Bruchs and Kurt F. Ellison of Michael Best & Friedrich have entered appearances for Epic Systems Corp. in a pending employment discrimination lawsuit. The suit was filed Sept. 7 in Wisconsin Western District Court by Levine Eisberner LLC and Siri & Glimstad on behalf of a project manager who claims that he was wrongfully terminated after applying for a religious exemption to the defendant's COVID-19 vaccine mandate. The case, assigned to U.S. Magistrate Judge Anita Marie Boor, is 3:24-cv-00630, Secker, Nathan v. Epic Systems Corporation.
Who Got The Work
David X. Sullivan, Thomas J. Finn and Gregory A. Hall from McCarter & English have entered appearances for Sunrun Installation Services in a pending civil rights lawsuit. The complaint was filed Sept. 4 in Connecticut District Court by attorney Robert M. Berke on behalf of former employee George Edward Steins, who was arrested and charged with employing an unregistered home improvement salesperson. The complaint alleges that had Sunrun informed the Connecticut Department of Consumer Protection that the plaintiff's employment had ended in 2017 and that he no longer held Sunrun's home improvement contractor license, he would not have been hit with charges, which were dismissed in May 2024. The case, assigned to U.S. District Judge Jeffrey A. Meyer, is 3:24-cv-01423, Steins v. Sunrun, Inc. et al.
Who Got The Work
Greenberg Traurig shareholder Joshua L. Raskin has entered an appearance for boohoo.com UK Ltd. in a pending patent infringement lawsuit. The suit, filed Sept. 3 in Texas Eastern District Court by Rozier Hardt McDonough on behalf of Alto Dynamics, asserts five patents related to an online shopping platform. The case, assigned to U.S. District Judge Rodney Gilstrap, is 2:24-cv-00719, Alto Dynamics, LLC v. boohoo.com UK Limited.
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250