ACC issues guidelines for law firm cyber security measures

The corporate counsel organisation has issued guidelines which it hopes will serve as a benchmark for law firm cyber security practices. Entitled 'Model Information Protection and Security Controls for Outside Counsel Possessing Company Confidential Information, it covers  information retention/return/destruction, data handling and encryption, data breach reporting, physical security, employee background screening, and cyber liability insurance. The model requirements are based on ACC members' experience, past data security audits, and learned best practices in ensuring that sensitive client data remains confidential.

Chief concern

‘We are increasingly hearing from ACC members, at companies of all sizes, that cyber security is one of their chief concerns, and there is heightened risk involved when sharing sensitive data with your outside counsel,’ said Amar Sarwal, ACC vice president and chief legal strategist. ‘With these Model Information Protection and Security Controls, the in-house bar, with the help of outside counsel, is taking the lead on sharing established best practices to promote data security.’

Collaborative effort

A number of ACC members worked together to draft the guidelines, receiving input from several law firms on the standards. ‘The trust between a law firm and a client is fundamental to a productive attorney-client relationship.  A vital way for law firms to gain client trust is to protect the confidential information provided to them by their clients from cyber threats,’ said Brennan Torregrossa, vice president, associate general counsel, and head of the global external legal relations team at GSK, whose law department assisted in developing the guidelines. ‘These model controls should be extremely valuable to ACC legal departments and law firms alike to ensure that adequate tools and processes are in place to provide cyber protection and to take agreed upon steps in the event of a breach. In a time of rapid developing risks and threats, clients and law firms need to respond in unison with speed and clarity.’