While remote working certainly isn't a novel phenomenon, the COVID-19 pandemic caused the scale of workers conducting business from home to build sizably, a trend that may not even completely reverse itself once shutdowns have lifted. The implication for corporate legal departments likely won't be a complete cybersecurity overhaul, but instead a very deliberate reexamination of how they are protecting their networks and evaluating data privacy risks.

Ken Jenkins, principal and founder of the cybersecurity solutions provider EmberSec, had previously told Corporate Counsel that one of his clients had begun to focus more on securing the organization's endpoints than the corporate office. But such an undertaking is also not without its complications.

"The threat obviously is that your corporate enterprise still has solutions that need to be secure and while you are in transition and trying to figure that out, your attack surface remains, right?" Jenkins said.

Of course, just how far along a given company is in that transition will likely vary from organization to organization. But Christopher Ballod, vice chairman of the data privacy and cybersecurity practice at Lewis Brisbois Bisgaard & Smith, noted that while the gradual shift to remote working predates COVID-19, many corporate legal departments and businesses were likely not prepared for huge portions of the enterprise to swing in that direction all at once.

For many organizations, the overall urgency of the requisite cybersecurity adjustments can become a question of risk, balancing not only the health of the network but repercussions stemming from data privacy laws such as the General Data Protection Regulation or the California Consumer Privacy Act.

Ballod explained that corporate legal departments are emphasizing those risks even as some companies continue to prioritize business continuity. "So I'm seeing that people have sounded the alert or at least are aware that, 'Look, if our data goes out the door, we have legal obligations, potential liability and brand dilution and other risks,'" Ballod said.

Those considerations may continue to present themselves as companies mull new security measures to put into place around remote working. Dyann Heward-Mills, CEO of the data protection office HewardMills, indicated that it would be wise for organizations to perform data risk assessments around new security technologies or processes being implemented.

The object is to document the process in the event that it falls under regulatory scrutiny. "If there is a failure somewhere or an incident or a breach, at least there is the audit trail in evidence that the risks were properly assessed, they were documented, they were escalated and mitigated," Heward-Mills said.

But what systems specifically might corporate legal departments be looking at to help drive security in the age of remote working? Christopher Zegers, director of consulting services, legal at Ivionics, said that legal departments who have embraced document management systems are in a much better position than those where attaching files to email is still the practice in vogue.

He argued that having a central data location as opposed to employees saving a document to their personal drive or email accounts can prevent sensitive data from circulating and duplicating. But many legal departments may have some work yet to do in that area.

"There's still a lot out there that haven't gotten there yet," Zegers said.