Shutterstock

Waking up to the news of a cyberattack is becoming almost a daily occurrence, and cyber risk looms at the forefront of many in-house lawyers' minds. Companies may be creating better training, investing in security systems and bringing in consultants to avoid falling victim to a breach.

But that effort could be for naught if companies' outside law firms, which receive some of their clients' most valuable data, don't hold up their end of the cybersecurity bargain with strong defense systems.

That's one concern addressed by the Corporate Legal Operations Consortium's Law Firm Cybersecurity Initiative, led by ‎Gilead Sciences Inc. head of legal operations Gary Tully.

➤➤ Get in-house news and commentary straight to your in-box with Inside Track. Sign up here.

Tully, who'll be speaking on cybersecurity at CLOC's annual Corporate Legal Operations Institute in April, said it's not that firms aren't trying to be secure. Some are just struggling to address conflicting security mandates. At times the best practices and standards promulgated by clients differ from those coming from other clients or from consultants and tech experts who offer firms advice. And Tully said many of the questions in-house lawyers are asking firms about security aren't the right ones, furthering confusion on both sides.

‎”The goal is to set up a framework to help legal operations stand up a cybersecurity program, to get in the process of asking the questions of its law firms … We have to get clarity on what law firms are doing with our data,” Tully said. 

To do this, Tully is working with a number of firms, other in-house counsel and outside providers to develop clearer industry standards and questions on security in the upcoming months. The initiative's first step is to create a uniform set of guidelines and then apply it to firms, who will be scored on their security with the help of experts.

“The score lasts for six months,” Tully said. “You update your questionnaire, your score gets re-evaluated.”

Firm scores likely won't be publicly posted, as Tully said that could attract hackers, but could be made available to prospective clients. Eventually, in-house counsel could leverage the information when choosing firms, the same way rates and diversity metrics are used.

Tully and Sheryl Falk, a partner at Winston & Strawn and co-leader of the firm's global privacy and data security task force, said that clients shouldn't have to pay extra for high-grade security at their partner law firms—it should be expected.

“I think cybersecurity is just going to be a cost of doing business,” Falk said. 

CLOC's initiative aims to make cybersecurity a more common, comprehensible cost of doing business for in-house counsel, some of whom, Falk said, still aren't asking about it when picking a firm.

She added that it could be hard to standardize security needs into a single questionnaire, as different companies in different industries face varying levels of scrutiny and regulation depending on the data they handle. These regulations and needs are also subject to regular change.

“It is a little nuanced. Information security challenges continue to evolve as we see the technology change,” Falk said. “So whatever guidelines and questionnaire [CLOC] comes up with will have to be revisited on a pretty regular basis.” 

Ideally, Tully's questionnaire would be adaptable to meet these needs, he said, with his initial standards serving as a baseline that can change over time. Right now, the goal is to have a clear starting point for those in the legal industry.

Tully said that he and other in-house professionals are seeing breaches become more prevalent and dramatic to the point that some law firms are shutting down for days at a time due to hacks or stolen data.

“This is terribly concerning, especially since we rely on our law firms to handle some of the most critical information that we have at our companies,” he said. “We certainly trust our firms to do what they believe is necessary, we believe they have our best interest in mind. But there is a need to ask the question: How do you protect our data?”