Any law firm that has filled out an RFP in recent years knows clients are increasingly asking about the firms' information technology security and how client data is being protected. But firms and clients alike say outside counsel aren't doing nearly enough to meet basic cybersecurity expectations.

Law firm technology services group LogicForce recently released their quarterly report card on law firm cybersecurity, giving the legal industry a score of only 42 percent on their cybersecurity health.

The most recent scorecard aggregated data from client surveys at more than 300 law firms of various sizes. Scores were generated based on the number of firms who reported implementing 12 different factors set forth by LogicForce: information security executives, cybersecurity policies, multifactor authentication, cyber training, cyber insurance, penetration, vulnerability testing, third-party risk assessments, records management policies, cyber investment, full disk encryption, data loss prevention services, and third-party penetration testing. Each factor was weighted differently.

The scorecard's most heavily weighted factor was the presence of an information security executive, a position filled at only 38 percent of surveyed law firms.

John Sweeney, president of LogicForce, came down hard on law firms, advising them to step up their investment in many of the areas identified by the report.

“One of the things I hope more than anything is that law firms realize that this 42 percent score we have simply means that law firms are doing terribly. That number should be 100 percent. Every law firm should be able to check off the box and say 'we are doing 100 percent of those standards,'” Sweeney said.

Sweeney said he has yet to see even one law firm who could meet all the standards set forth in the company's scorecard.

The report also noted that corporate law firm clients are beginning to crack down harder on their outside counsel for their failure to meet cybersecurity standards. The report found that 48 percent of law firms surveyed had their data security practices subjected to an audit by a corporate client in the last year.

“It became very apparent to us that law firms recognize the importance of it, but are not attacking it with the vigilance that their corporate clients expect them to,” Sweeney said, adding that while cybersecurity has historically been a concern for heavily regulated industries, corporations across industries are now beginning to push for outside counsel to implement cybersecurity standards.

Sweeney said that corporate audits of law firm technology are on the upswing. “We're seeing this dramatic increase over the last six months. We are actually being called by corporations to audit law firms for them,” Sweeney said.

To be fair, law firms have shown a fair amount of growth in just this year alone. LogicForce's scorecard for the first quarter of the year gave law firms only a 30 percent score on their industry compliance with cybersecurity best practices. According to the two reports, penetration and vulnerability testing spiked from 18 to 42 percent, full disk encryption bumped from 25 to 38 percent, and training went up from 22 to 32 percent over the course of the year.

Ultimately, Sweeney said that firms will have to consider the financial risks of failing to invest more heavily in their cybersecurity infrastructure. “This is a business decision that they have to realize. Law firms are in the data management business,” he said.

“What we found online in the standards for law firms, if they did those things in the long run, that would make the best financial sense for them, and quite frankly for their clients as well,” Sweeney added.

Any law firm that has filled out an RFP in recent years knows clients are increasingly asking about the firms' information technology security and how client data is being protected. But firms and clients alike say outside counsel aren't doing nearly enough to meet basic cybersecurity expectations.

Law firm technology services group LogicForce recently released their quarterly report card on law firm cybersecurity, giving the legal industry a score of only 42 percent on their cybersecurity health.

The most recent scorecard aggregated data from client surveys at more than 300 law firms of various sizes. Scores were generated based on the number of firms who reported implementing 12 different factors set forth by LogicForce: information security executives, cybersecurity policies, multifactor authentication, cyber training, cyber insurance, penetration, vulnerability testing, third-party risk assessments, records management policies, cyber investment, full disk encryption, data loss prevention services, and third-party penetration testing. Each factor was weighted differently.

The scorecard's most heavily weighted factor was the presence of an information security executive, a position filled at only 38 percent of surveyed law firms.

John Sweeney, president of LogicForce, came down hard on law firms, advising them to step up their investment in many of the areas identified by the report.

“One of the things I hope more than anything is that law firms realize that this 42 percent score we have simply means that law firms are doing terribly. That number should be 100 percent. Every law firm should be able to check off the box and say 'we are doing 100 percent of those standards,'” Sweeney said.

Sweeney said he has yet to see even one law firm who could meet all the standards set forth in the company's scorecard.

The report also noted that corporate law firm clients are beginning to crack down harder on their outside counsel for their failure to meet cybersecurity standards. The report found that 48 percent of law firms surveyed had their data security practices subjected to an audit by a corporate client in the last year.

“It became very apparent to us that law firms recognize the importance of it, but are not attacking it with the vigilance that their corporate clients expect them to,” Sweeney said, adding that while cybersecurity has historically been a concern for heavily regulated industries, corporations across industries are now beginning to push for outside counsel to implement cybersecurity standards.

Sweeney said that corporate audits of law firm technology are on the upswing. “We're seeing this dramatic increase over the last six months. We are actually being called by corporations to audit law firms for them,” Sweeney said.

To be fair, law firms have shown a fair amount of growth in just this year alone. LogicForce's scorecard for the first quarter of the year gave law firms only a 30 percent score on their industry compliance with cybersecurity best practices. According to the two reports, penetration and vulnerability testing spiked from 18 to 42 percent, full disk encryption bumped from 25 to 38 percent, and training went up from 22 to 32 percent over the course of the year.

Ultimately, Sweeney said that firms will have to consider the financial risks of failing to invest more heavily in their cybersecurity infrastructure. “This is a business decision that they have to realize. Law firms are in the data management business,” he said.

“What we found online in the standards for law firms, if they did those things in the long run, that would make the best financial sense for them, and quite frankly for their clients as well,” Sweeney added.