Law firms are feeling the affects of an unprecedented rise in cyber attack and data breach related incidents. In fact, due to the sensitive nature of information possessed by the Law firms, the industry has garnered unwanted attention of cyber-attackers. The industry is crippled by several vicious attacks on law firms of all sizes conducted by individual entities, hacker groups and even some suspected state-sponsored units.
As data-breach continues to wreck havoc in the business world, industry and governing bodies are rushing to introduce compliance regulation and ethic obligations. These measures are undertaken to standardize cybersecurity best practices across the board, limit the security risk and formalize steps to take in the event of a breach.
To combat the rapidly rising cybersecurity threat, the American Bar Association Standing Committee on Ethics and Professional Responsibility issued the Formal Opinion 483 (The Opinion) in October, 2018. The Opinion outlines cybersecurity best practices for Law Firms along with responsibilities to prevent security incidents. It also lays-out the need to have incident reporting process in place in the event of a breach. In order to oblige by The Opinion, law firms must:
- have a process in place to assess security risks and vulnerabilities. They should identify the loophole in their network that can potentially jeopardize data privacy.
- Upon identifying risks and vulnerabilities, law firms should take appropriate action to mitigate security risks and plug any weaknesses in the network
- Once any step is taken to safeguard data, law firms need to verify if the measures are appropriately implemented and they are working
- Cyber-attacks are getting sophisticated by the day, thus, the security measures in place must be regularly evaluated and updated to ensure utmost protection
Following these obligations will not only make the law firm better equipped to protect their client’s data but also enhance confidence amongst their stakeholders. It is not a matter of if a Law Firm will be subject to a breach attempt but a matter of when that’ll happen. Being proactive with cybersecurity measures is the ideal way of portraying utmost sincerity in client data protection.
