Cyber-Security Lock

The legal industry is no longer getting away with outdated collaboration tools and processes. Clients are moving toward modern cloud-based solutions like Microsoft Office 365 suite and Microsoft Teams, and they expect their legal support to follow suit.

To be fair, the industry has good reason to drag its feet. Sensitive information is their product and safeguarding it in the right way directly links to a firm's ability to generate revenue. Law firms must be able to keep a secret, and with attorney-client privilege always a major consideration, law firms are justifiably extremely concerned with security. With cloud software breaches regularly in the news, it's reasonable to worry that introducing modern collaboration tools could put client information—and firms' reputations—at risk. Even more, privacy regulations like GDPR and the forthcoming CCPA subject some client information to additional legal protections beyond attorney-client privilege.

As a result, few firms have moved to the cloud, and most continue to use antiquated, on-premise solutions to collaborate and create documents. However, modernizing collaboration processes is critical if firms wish to survive. Clients expect automation and efficiency—endless back-and-forth email correspondence and an unlimited number of billable hours will get late adopters killed by the competition.

Protecting client information is just as critical as keeping up with the competition, but firms must find a balance. The key is knowing what security features to look for in a collaboration tool so that your firm can modernize safely.

|

What to Look for When Choosing a Collaboration Tool

A security-first mindset requires understanding exactly what makes secure collaboration tools secure. Luckily, from a conceptual standpoint, cloud-based solutions are not too different from their on-premise predecessors: You want to make sure the software "container" that holds your data is secure, the transfer of data is protected and only users who have permission to make changes to your documents are doing so. The cost of having the right security measures can be high, but the cost in loss of reputation may be even higher.

In addition to a secure container, let's not forget the end user is in many cases the source of a breach. A workflow-based collaboration tool with strong processes for governing authenticated collaboration will make it easier to ensure security for end users. But as always when it comes to security, awareness and training are just as important as the tool.

Let's take a deeper dive into what all that means:

First, firms need to be clear about where and how a vendor stores sensitive information in the collaboration tool. Before moving forward, ask your vendor the following questions: Is information bouncing between servers? Where is it saved? Which employees of the vendor have access to the information and for how long? Are we keeping track of the content's access history?

To answer some of these questions, firms can check the vendor's compliance with various standards and certifications. The vendor should be able to provide thorough details on how they live up to International Organization for Standardization (ISO) 27001, focusing especially on the hosting environment and the software development lifecycle. If a firm meets these requirements, then you know that their security controls are strong, and the way in which they protect and authenticate access to your documents is up to modern standards.

It's also smart to evaluate the tool's version control settings. When users collaborate and make edits on a document, it's not only important that formatting remains consistent, but that everyone can track who made which changes. As a standard, cloud-based offerings have strict version control. But before moving forward, confirm what privileges the tool grants users and if the versioning controls are ISO certified.

Once a solution is deployed, it's not enough to assess once whether the tool is delivering on its features — and perhaps more importantly, if its security promises check out. It's imperative to continuously monitor vendors with a risk-based approach upon selection, onboarding and throughout the lifetime of the vendor until offboarding. This ensures that security requirements are met from the outset and are constantly updated to comply with the evolving security landscape, while continually monitoring for security risks to avoid data leaks or breaches.

Implementing state-of-the-art collaboration tools that deliver a seamless client experience is just one aspect of modernizing the legal industry's workflows. Other essential technologies, like document automation software and digital compliance tools, must also be robust enough and thoroughly vetted to make sure they uphold the industry's privacy and security requirements.

With this advice in mind, firms can confidently modernize their workflows and deliver better client experiences—without putting sensitive information at risk. The key aspects to consider are compliance to certifications and standards with a continuing risk-based vendor management approach to exceed clients' security and privacy expectations. Law firm clients are embracing collaboration and document automation tools and getting more efficient—and they expect the same from the law firms that represent them.

Jean-Marc Chanoine is a strategic account manager and legal consultant at Templafy. He previously worked for the Navy and Accenture Strategy.

Ellen Benaim is the information security officer at Templafy. Prior to that, she worked at Apple and Hudson Advisors.