Four Tips for Law Firms in Responding to Overreaching Client Audits
How do legal IT professionals identify scenarios where clients are overreaching reasonable bounds of information or action? The stronger your IT strategy is at the outset, the better you'll be able to respond.
December 07, 2018 at 07:00 AM
7 minute read
Given the ever-growing prevalence of cyber incidents among law firms, clients are increasingly concerned with how their law firms are handling sensitive information for representation. According to a 2018 Verizon investigative report mentioned in a BBC News article, “almost 40 percent of all successful malware-based attacks involved ransomware.” Because third parties can be an attack vector, clients are asking for assurance from their legal professionals to manage these threats in particular. Many law firms are seeing an increase in information security and data governance audits coming from clients. These requests pile up quickly too.
While it may sometimes appear there's little-to-no effort or forethought on a client's part in sending a request for a cybersecurity audit or review, this may not always be the case. For clients in regulated and/or compliance driven industries, these organizations often have pressure to demonstrate the adherence of their vendors to specific standards, controls, and capabilities. Moreover, with more stringent cross-border regulations going into place, such as GDPR, clients with multi-national presences are required to have assurances from their partners and vendors. This effectively means a firm must support these requirements if they wish to retain these clients.
Law firms, by nature of being a third party to clients, may put those organizations in a risky spot if they have material deficiencies in their information systems. For the same reason a law firm must know the security posture of any third party they enlist, so too do clients have a need to know the disposition and sufficiency of controls of their legal representation for handling sensitive information. This is a key area of common vulnerability where regulators are looking.
As you know, there can be a lot of effort on the law firm's end in responding to these security inquiries. How do legal IT professionals identify scenarios where clients are overreaching reasonable bounds of information or action? In cases of overreaching, how should a firm respond to the client? These are all areas where law firms may struggle, as reputation among other clients, professional responsibility concerns, or even bar admittance could be on the line if managed poorly. Here are four tips to better enable your firm to handle these inquiries.
1. Review a Client's Compliance Standards Ahead of Time
Reviewing various frameworks of compliance that your clients fall under is a good way to anticipate the types of requests you'll inevitably receive from those clients. It gives your firm a head-start in shoring up gaps within your firm to meet these requests before they come in—because once the request arrives, there may be a tight deadline to meet.
Aspects of a request that fall outside of a particular framework may not mean those aspects aren't a part of other requirements, since it's possible a client could be under more than one expectation of compliance. In these cases, it may be helpful to clarify with the client before fully responding to the audit, such as asking what compliance framework they must adhere to, what their leaderships' expectations are and what they specifically need from the firm at a minimum. Keep in mind that just because the client is bound by a certain compliance framework doesn't necessarily mean that the firm is bound in the same way—oftentimes, the firm will be tasked to support that framework, which has a nuance of ownership. In other words, a law firm is most often handling the data under compliance, not owning it.
2. Delineate Framework Standards Vs. Expectations for Response
When a client sends a law firm a security audit, they are no doubt expecting a response, but the type of information and level of detail they are expecting in that response can differ. It's up to your firm to clarify any vagueness.
Just because a client has the expectation to receive certain information doesn't make it inherently reasonable to provide such information. There may also be a difference between what the compliance framework dictates and what a client would like to know for their own internal reasons. For instance, a firm has no obligation to disclose key information if it's requested in an RFP—if the client ends up not choosing the firm, they could inadvertently share sensitive information with a competitor. Similarly, the type of audit request implies limits of response.
Each scenario calls for an informed discussion on how best to enable a law firm's ongoing IT risk management stance and management assertions—and in cases where the firm doesn't want to share certain information, the firm should provide an explanation to the client when refusing access to this information to preserve the relationship.
3. Include Partners in Decisions of What to Share
It's important to include practice partners in key discussions surrounding what to respond to. Since some of the information requested could be proprietary or risky to expose, it's ultimately up to the firm's leadership to decide where to draw the line. Noting what information is off-limits is also a great way to respond to clients in scenarios where overreach has occurred, as long as the reasoning is also shared for context.
For example, you could determine that withholding information, proprietary or otherwise, is done so to avoid cybercriminals leveraging that information. When looking at the audit, is the client asking for a detailed understanding of your network and infrastructure configuration or a general overview? Indeed, confidentiality practices roll up into wider standards of breach protection. Your firm may also be under specific terms across multiple confidentiality agreements which could further influence how you respond to the audit. Having clear lines over what not to share from the partnership will help shape your understanding of the questions.
4. Position IT Systems for the Future
If you're having problems determining ahead of time what level of information you are willing to disclose, you may want to proactively choose a compliance framework to act as the baseline for your firm's internal IT systems, which will also set a baseline for answers.
The best way to establish your security stance is to approach the protection of your assets from a holistic perspective. Certainly, you will want preventative measures in place such as anti-malware, next-gen firewalls, employee awareness training and restricted access controls, but many firms focus too heavily on these aspects and neglect preparing restorative measures that serve as a Plan B to recover if a cybercriminal gets past the front or back gates. If a breach occurs, how will you contain, maintain, and restore your data and IT systems to a more vigilant baseline? Here, it's key to have an incident response plan and a robust IT disaster recovery (IT-DR) plan with secondary data sets in an offsite location for fast retrieval if needed.
These aspects might seem like a lot to do, but they can be crucial to ensuring the viability of your firm and in providing assurance to clients that their information is safe in your hands. If managing a robust IT strategy is difficult to accomplish in-house, consider engaging a technology partner who provides security and compliance services. Selection of an experienced provider can be challenging but can give your firm the best-fit security solution. Look for expertise and cultural alignment with your IT team, since the two groups will be working closely together on a regular basis.
Ultimately, the stronger your IT strategy is at the outset, the better you'll be able to respond to incoming client concerns surrounding the security of your IT systems. The threat landscape of modern law practice is constantly changing, which makes it key to establish a culture and process that challenges the status quo.
Derek Brost, Director of Security Services at InterVision, is a certified Information Systems Security Professional (CISSP) with a 22-year background in information technology operations, architecture and security. Rod Oancea, Director of Governance and Compliance Services at InterVision, is an experienced leader of comprehensive solutions for governance, risk, and compliance and operational success, as well as security applications and cross-functional excellence.
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2025 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View AllTrending Stories
- 1Perkins Coie Lures Former Longtime Wilson Sonsini Tech Transactions Partner
- 2‘The Decision Will Help Others’: NJ Supreme Court Reverses Appellate Div. in OPRA Claim Over Body-Worn Camera Footage
- 3MoFo Associate Sees a Familiar Face During Her First Appellate Argument: Justice Breyer
- 4Antitrust in Trump 2.0: Expect Gap Filling from State Attorneys General
- 5People in the News—Jan. 22, 2025—Knox McLaughlin, Saxton & Stump
Who Got The Work
J. Brugh Lower of Gibbons has entered an appearance for industrial equipment supplier Devco Corporation in a pending trademark infringement lawsuit. The suit, accusing the defendant of selling knock-off Graco products, was filed Dec. 18 in New Jersey District Court by Rivkin Radler on behalf of Graco Inc. and Graco Minnesota. The case, assigned to U.S. District Judge Zahid N. Quraishi, is 3:24-cv-11294, Graco Inc. et al v. Devco Corporation.
Who Got The Work
Rebecca Maller-Stein and Kent A. Yalowitz of Arnold & Porter Kaye Scholer have entered their appearances for Hanaco Venture Capital and its executives, Lior Prosor and David Frankel, in a pending securities lawsuit. The action, filed on Dec. 24 in New York Southern District Court by Zell, Aron & Co. on behalf of Goldeneye Advisors, accuses the defendants of negligently and fraudulently managing the plaintiff's $1 million investment. The case, assigned to U.S. District Judge Vernon S. Broderick, is 1:24-cv-09918, Goldeneye Advisors, LLC v. Hanaco Venture Capital, Ltd. et al.
Who Got The Work
Attorneys from A&O Shearman has stepped in as defense counsel for Toronto-Dominion Bank and other defendants in a pending securities class action. The suit, filed Dec. 11 in New York Southern District Court by Bleichmar Fonti & Auld, accuses the defendants of concealing the bank's 'pervasive' deficiencies in regards to its compliance with the Bank Secrecy Act and the quality of its anti-money laundering controls. The case, assigned to U.S. District Judge Arun Subramanian, is 1:24-cv-09445, Gonzalez v. The Toronto-Dominion Bank et al.
Who Got The Work
Crown Castle International, a Pennsylvania company providing shared communications infrastructure, has turned to Luke D. Wolf of Gordon Rees Scully Mansukhani to fend off a pending breach-of-contract lawsuit. The court action, filed Nov. 25 in Michigan Eastern District Court by Hooper Hathaway PC on behalf of The Town Residences LLC, accuses Crown Castle of failing to transfer approximately $30,000 in utility payments from T-Mobile in breach of a roof-top lease and assignment agreement. The case, assigned to U.S. District Judge Susan K. Declercq, is 2:24-cv-13131, The Town Residences LLC v. T-Mobile US, Inc. et al.
Who Got The Work
Wilfred P. Coronato and Daniel M. Schwartz of McCarter & English have stepped in as defense counsel to Electrolux Home Products Inc. in a pending product liability lawsuit. The court action, filed Nov. 26 in New York Eastern District Court by Poulos Lopiccolo PC and Nagel Rice LLP on behalf of David Stern, alleges that the defendant's refrigerators’ drawers and shelving repeatedly break and fall apart within months after purchase. The case, assigned to U.S. District Judge Joan M. Azrack, is 2:24-cv-08204, Stern v. Electrolux Home Products, Inc.
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250