Hand drawing check box.

Given the ever-growing prevalence of cyber incidents among law firms, clients are increasingly concerned with how their law firms are handling sensitive information for representation. According to a 2018 Verizon investigative report mentioned in a BBC News article, “almost 40 percent of all successful malware-based attacks involved ransomware.” Because third parties can be an attack vector, clients are asking for assurance from their legal professionals to manage these threats in particular. Many law firms are seeing an increase in information security and data governance audits coming from clients. These requests pile up quickly too.

While it may sometimes appear there's little-to-no effort or forethought on a client's part in sending a request for a cybersecurity audit or review, this may not always be the case. For clients in regulated and/or compliance driven industries, these organizations often have pressure to demonstrate the adherence of their vendors to specific standards, controls, and capabilities. Moreover, with more stringent cross-border regulations going into place, such as GDPR, clients with multi-national presences are required to have assurances from their partners and vendors. This effectively means a firm must support these requirements if they wish to retain these clients.

Law firms, by nature of being a third party to clients, may put those organizations in a risky spot if they have material deficiencies in their information systems. For the same reason a law firm must know the security posture of any third party they enlist, so too do clients have a need to know the disposition and sufficiency of controls of their legal representation for handling sensitive information. This is a key area of common vulnerability where regulators are looking.

As you know, there can be a lot of effort on the law firm's end in responding to these security inquiries. How do legal IT professionals identify scenarios where clients are overreaching reasonable bounds of information or action? In cases of overreaching, how should a firm respond to the client? These are all areas where law firms may struggle, as reputation among other clients, professional responsibility concerns, or even bar admittance could be on the line if managed poorly. Here are four tips to better enable your firm to handle these inquiries.

|

1. Review a Client's Compliance Standards Ahead of Time

Reviewing various frameworks of compliance that your clients fall under is a good way to anticipate the types of requests you'll inevitably receive from those clients. It gives your firm a head-start in shoring up gaps within your firm to meet these requests before they come in—because once the request arrives, there may be a tight deadline to meet.

Aspects of a request that fall outside of a particular framework may not mean those aspects aren't a part of other requirements, since it's possible a client could be under more than one expectation of compliance. In these cases, it may be helpful to clarify with the client before fully responding to the audit, such as asking what compliance framework they must adhere to, what their leaderships' expectations are and what they specifically need from the firm at a minimum. Keep in mind that just because the client is bound by a certain compliance framework doesn't necessarily mean that the firm is bound in the same way—oftentimes, the firm will be tasked to support that framework, which has a nuance of ownership. In other words, a law firm is most often handling the data under compliance, not owning it.

|

2. Delineate Framework Standards Vs. Expectations for Response

When a client sends a law firm a security audit, they are no doubt expecting a response, but the type of information and level of detail they are expecting in that response can differ. It's up to your firm to clarify any vagueness.

Just because a client has the expectation to receive certain information doesn't make it inherently reasonable to provide such information. There may also be a difference between what the compliance framework dictates and what a client would like to know for their own internal reasons. For instance, a firm has no obligation to disclose key information if it's requested in an RFP—if the client ends up not choosing the firm, they could inadvertently share sensitive information with a competitor. Similarly, the type of audit request implies limits of response.

Each scenario calls for an informed discussion on how best to enable a law firm's ongoing IT risk management stance and management assertions—and in cases where the firm doesn't want to share certain information, the firm should provide an explanation to the client when refusing access to this information to preserve the relationship.

|

3. Include Partners in Decisions of What to Share

It's important to include practice partners in key discussions surrounding what to respond to. Since some of the information requested could be proprietary or risky to expose, it's ultimately up to the firm's leadership to decide where to draw the line. Noting what information is off-limits is also a great way to respond to clients in scenarios where overreach has occurred, as long as the reasoning is also shared for context.

For example, you could determine that withholding information, proprietary or otherwise, is done so to avoid cybercriminals leveraging that information. When looking at the audit, is the client asking for a detailed understanding of your network and infrastructure configuration or a general overview? Indeed, confidentiality practices roll up into wider standards of breach protection. Your firm may also be under specific terms across multiple confidentiality agreements which could further influence how you respond to the audit. Having clear lines over what not to share from the partnership will help shape your understanding of the questions.

|

4. Position IT Systems for the Future

If you're having problems determining ahead of time what level of information you are willing to disclose, you may want to proactively choose a compliance framework to act as the baseline for your firm's internal IT systems, which will also set a baseline for answers.

The best way to establish your security stance is to approach the protection of your assets from a holistic perspective. Certainly, you will want preventative measures in place such as anti-malware, next-gen firewalls, employee awareness training and restricted access controls, but many firms focus too heavily on these aspects and neglect preparing restorative measures that serve as a Plan B to recover if a cybercriminal gets past the front or back gates. If a breach occurs, how will you contain, maintain, and restore your data and IT systems to a more vigilant baseline? Here, it's key to have an incident response plan and a robust IT disaster recovery (IT-DR) plan with secondary data sets in an offsite location for fast retrieval if needed.

These aspects might seem like a lot to do, but they can be crucial to ensuring the viability of your firm and in providing assurance to clients that their information is safe in your hands. If managing a robust IT strategy is difficult to accomplish in-house, consider engaging a technology partner who provides security and compliance services. Selection of an experienced provider can be challenging but can give your firm the best-fit security solution. Look for expertise and cultural alignment with your IT team, since the two groups will be working closely together on a regular basis.

Ultimately, the stronger your IT strategy is at the outset, the better you'll be able to respond to incoming client concerns surrounding the security of your IT systems. The threat landscape of modern law practice is constantly changing, which makes it key to establish a culture and process that challenges the status quo.

Derek Brost, Director of Security Services at InterVision, is a certified Information Systems Security Professional (CISSP) with a 22-year background in information technology operations, architecture and security. Rod Oancea, Director of Governance and Compliance Services at InterVision, is an experienced leader of comprehensive solutions for governance, risk, and compliance and operational success, as well as security applications and cross-functional excellence.