A lack of formal cybersecurity requirements for outside counsel doesn't necessarily equate to higher cyberrisks.

In the aftermath of the ransomware attack on DLA Piper, many legal departments may be reviewing their outside counsel's security protections, not just in terms of the technology their firms have, but also the processes and policies they put in place. Such cybersecurity best practices, however, are often not codified in legal departments' outside counsel guidelines, according to a Gartner and Wolters Kluwer report.

Titled “Unlock Insights Into Outside Counsel Billing and Staffing Guidelines,” the report analyzed the results of a survey of 51 legal departments at various mid- to large-sized global corporations. The report found that of the 75 percent of respondents that had outside counsel guidelines in place, only 31 percent had guidelines that included formal data security requirements.

But some believe that this is not necessarily a bad omen. Such an oversight is unlikely to expose legal departments to higher cyberrisk, given the nature of their law firms' obligations, and the general lack of enforcement of such guidelines in the first place. William A. Sowinski, director of decision support services at Wolters Kluwer's ELM Solutions, noted that because “law firms are required to keep information confidential,” many of their clients already assume they have robust cybersecurity protections in place from the start.

It is not a farfetched assumption to make. Given law firms' ethical obligations, and the anxiety over recent cyberattacks, John Sweeney, president of LogicForce, told Legaltech News affiliate Corporate Counsel that most, if not all, major law firms are making cybersecurity a priority. “I don't think there's a law firm that doesn't have policies in place and isn't training their people.”

Sweeney added that for many firms, cybersecurity is also a business necessity in attracting and retaining clients with highly sensitive information. “If I'm the CEO of IBM and I entrust IP for Watson to a big or small IP firm, think about if it got stolen, what the impact would be. These are very serious issues.”

Yet some still see third-party guidelines as a vital tool in creating a culture of security in the legal industry. The Association of Corporate Counsel (ACC) recently released model cybersecurity guidelines for outside counsel. Meanwhile, the New York State Department of Financial Services' (NYS DFS) new data security regulation seeks to make law firms more cognizant of who accesses and handles sensitive client data.

Keith Lipman, CEO of Prosperoware, wrote in LTN, “The ACC guidelines and the NYS DFS cybersecurity regulations tell an impactful story for the legal services industry: 'need to know' access privilege is the new standard of care.”

Guideline requirements, of course, are not the only way legal departments can ensure cybersecurity protections from their outside counsel. Sowinski noted, for instance, that many departments “are also increasingly indicating that they will, or have the right to, audit [their law firms'] cybersecurity.”

Indeed, security audits may be more reliable than outside counsel guidelines for ensuring cybersecurity standards, given that such guidelines are rarely enforced or complied with. The Gartner and Wolters Kluwer's report found that only 31 percent of respondents were satisfied with their outside counsel's compliance with the guidelines, while none said they were “completely satisfied.”

In addition, only one-third said their legal department's employees knew their department's outside counsel guidelines well, while 36 percent of respondents did not know who was responsible for managing or enforcing their guidelines.

This lack of enforcement is due to multiple factors, Sowinski said. “Internal lawyers are not really good at managing process,” he explained. “They went to law school, they want to exercise strategy and add value to cases, and they are fair less interested in overseeing the process by which these cases or these matters are handled.”

Sowinski added that in-house attorneys may also be hesitant to confront their outside counsel given that they see them as “friends and colleagues with whom they go into battle with,” and that they are rarely rewarded by managers for reprimanding their outside counsel.