All posts by : Lawyers With Purpose

In light of the legal and ethical obligations that lawyers face to protect their clients’ data, defining the exact scope of what those protective measures are can often be challenging. In some cases, statutes and regulations define that standard in terms of positive results to be achieved, such as ensuring the confidentiality, integrity, and availability of systems and information. In other cases, that standard is defined in terms of the harms to be avoided – for example, to protect systems and information against unauthorized access, use, disclosure, etc. In some cases, the standard is not defined.

Regardless of the approach, meeting this standard and achieving these objectives involves implementing appropriate physical, technical, and administrative security measures. So, where do law firms begin? Although no definitive cybersecurity regulations or standards have yet to be established, the American Bar Association has begun to develop standards for “reasonable” security.

That standard rejects requirements for specific security measurements (such as firewalls, passwords, etc.) and instead adopts a fact-specific approach to business-specific security obligations. These requirements include a “process” to assess risks, identify and implement appropriate security measures responsive to those risks, verify effective implementation of the measures, and ensure that they are continually updated as the industry continues to develop.

Below are the top ten considerations that the American Bar Association recommends law offices, regardless of size, adopt and implement in order to improve their security posture:

Practical Considerations: A Top Ten List

1. Identify the data you have
   Identifying the data you have (including yours, your clients’, data obtained during due diligence or discovery) and understand where it is stored, how it can be accessed, and how it is used
2. Evaluate the risks to the data you have
   A risk assessment is the process of identifying vulnerabilities and threats to the information assets used by the business or firm and assessing the potential impact and harm that would result if the threat materializes. This forms the basis for determining what countermeasures (i.e., security controls) should be implemented to reduce risk to an acceptable level.
3. Develop a written information security program
   Based on the results of the risk assessment, businesses should design and implement a security program consisting of reasonable physical, technical, and administrative security measures to manage and control the risks identified during the risk assessment. The security program should be designed to provide reasonable safeguards to control the identified risks.
4. Oversee third party service provider agreements
   If you use third parties (e.g., providers of cloud services or outsourcing services) to store or process the data, take appropriate steps to make sure that they adequately protect the security of the data you entrust to them.
5. Review and adjust the security program
   On a regular basis, reevaluate the risks you face and the adequacy of your security program, and adjust the program as necessary.
6. Ensure you are in compliance with regulatory frameworks
   Determine which data (yours, your clients’, data obtained during due diligence or discovery) is subject to which laws and regulations (including special sector-specific regulations such as GLB or HIPAA) and be sure you handle it in accordance with any special requirements in those laws and regulations.
7. Provide Training and Education
   Recognize that other lawyers and staff within the firm can be a weak link and provide appropriate training and awareness-raising reminders for all lawyers and staff.
8. Develop an incident response plan that covers the data you have
   Plan for taking responsive steps if the business suspects or detects that a security breach has occurred; such steps include ensuring that appropriate persons within the organization are notified of the breach, that prompt action is taken in responding to the breach (e.g., stopping further information compromise and working with law enforcement), and that persons who may be injured by the breach are appropriately notified.
9. Implement appropriate data security measures
   Keep in mind that laws and regulations governing data security may apply to all of the data in your possession, independent of ethical obligations specifically applicable to lawyers.
10. Security is a process
    Remember, security is a process and is never complete, so you must always remain vigilant for new threats.

Through the implementation of the above practical considerations, lawyers can be assured that their cybersecurity posture will continue to improve, all while increasing compliance with cybersecurity regulatory guidelines.

Vivitec can assist you with interpreting these guidelines to ensure you’re meeting your ethical obligations to safeguard information while ensuring you’re implementing the practical steps necessary to protect you and your firm from cybersecurity threats.

Post provided by Vivitec.

Today’s Business Reliance on Electronic Data and the Expanding Threat

Most, if not all data that businesses utilize throughout day-to-day operations is created, processed, and stored in electronic form. Technology has completely transformed the way companies conduct business and has introduced numerous benefits, including cost savings and increased productivity. Despite the many benefits technology introduces, the use of this technology in day-to-day operations also present significant risks, both from a regulatory and an ethical perspective.

The creation, usage, communication, and storage of data in electronic form introduces the risk of unauthorized access, use, disclosure, alteration, loss, or destruction of the information being stored. We all hear stories in the news of corporations of various sizes and industries falling victim to cybercrime. Today, cybercriminals are looking for every opportunity to indiscriminately attack any business that is unprepared. Therefore, its essential that all businesses implement appropriate security measures to protect their data and their customers’ data.

Regardless of industry, every business must weigh the risks of cyber-incident against the cost of preventing a potential attack. We also know that the threat landscape increases dramatically every year as bad actors design and share more creative ways of attacking systems and the data these systems hold.

Protecting your systems and your data are sound business practices that impact your effectiveness, productivity, and reputation. Furthermore, many businesses are subject to statutory or regulatory requirements with which they must comply.

In the United States, a whole suite of new regulations and laws are being introduced. The Federal Trade Commission, Food and Drug Administration, Department of Transportation, Department of Energy, and Cybersecurity and Infrastructure Security Agency are all working on new rules and regulations related to the way businesses should leverage technology. In addition, in 2021 alone, 36 states enacted new cybersecurity legislation. Globally, there are many initiatives such as China and Russia’s data localization requirements, India’s CERT-In incident reporting requirements, and the EU’s GDPR and its incident reporting.

In the United States, for instance, the White House, Congress, the Securities and Exchange Commission (SEC), and many other agencies and local governments are considering, pursuing, or starting to enforce new rules and regulations. Companies need not site idle waiting for these rules to be finalized and then enforced. They should and can act now to understand the intent of these regulations and take action. Most of these laws and regulations share common elements and represent common sense best practices that should be followed to protect your business regardless of external regulations.

All these laws and regulations share a common focus on the reasonableness or appropriateness of security. Information security is not a “one size fits all approach” and varies depending on the sensitivity of the data companies utilize, the amount of data they utilize, and types of data they utilize. Companies should develop a process driven approach, meaning that information security is a process, not a product. Legal compliance with security obligations involves applying a process to achieve certain objectives, rather than implementing a check list of security measures in all cases.

Ethical Obligations to Safeguard Information

When it comes to an lawyer’s ethical obligations to protect clients’ data, ABA Formal Ethics Opinion 477R operates as the seminal guidance on a lawyer’s ethical obligation to maintain the security of client confidential information in today’s digital landscape.

This opinion reviews aspects that should be considered by, and guide lawyers in making a “reasonable efforts” analysis. In many ways, this opinion distills the ethics guidance of the last 20 years and updates it in light of the current technology environment.

Ethical guidance is also reflected in amendments to Rule 1.1 “Competence” and Rule 1.6 “Confidentiality of Information,” in the ABA Model Rules of Professional Conduct, which were updated to reflect a lawyer’s obligation to protect client confidences when transmitting information over the internet.

Many firms struggle with turning these high-level requirements into actions to address their ethical obligations while balancing the risk with the associated costs of avoiding these threats. Working with a trusted Managed Security Service Provider (MSSP), can help your firm stay abreast of the evolving guidance and expanding threat landscape.

Now that we’ve explored the issues facing today’s firms and understand the ABA’s high-level opinion regarding safeguarding information, our next blog post will outline the top 10 practical considerations to safeguard information. Look for part II in this series, “Lawyer’s Practical Considerations to Safeguard Information”.

Post provided by Vivitec.