It is almost cliché to say that data security has become the most common concern keeping in-house counsel awake at night. Indeed, many qualified law firms, including ours, have developed the needed expertise to advise clients on the best practices for cybersecurity. And while a law firm’s traditional strengths lie in advising clients on avoiding lawsuits and investigations, not being a party to them, more and more find themselves targets of hackers seeking not only the law firm’s proprietary information but also the confidential information the firm holds for its clients.
It is in this environment that the Association of Corporate Counsel (ACC) recently issued Model Information Protection and Security Controls for Outside Counsel Possessing Company Confidential Information (the model controls). The aim is to create guidelines for in-house counsel and their outside law firms. While the model controls are a great leaping-off point, in-house counsel should ask one key question before adopting them as a uniform rule: Am I creating potential liability to my corporation by treating these guidelines as a minimum for my outside counsel to follow?
