A 'Cloud Security Doctrine' for Law Firms

“Most cloud providers have perfectly adequate security for consumer use,” Newton says. “It's the policies and procedures to support the distinct security needs of the legal industry that they lack.”

In compiling the doctrine's guidelines, the LCCA incorporated legal specific requirement recommendations from courts and bar associations; guidance on data privacy from European and North American governments; and legal industry best practices.

“The initial draft of the LCCA security standards were drawn from member contribution and research into the most recent changes in privacy and security laws, as well as technological companies best practices,” Newton says. “From there, the first draft was circulated to an external advisory board for initial feedback.”

With this doctrine, Newton says, “the LCCA hopes to serve as an educational force for law firms, legal departments, and legal regulators, as well as for legal technology providers. Having a central resource that helps inform all sides of reasonable security and legal-specific needs can only improve conversations in a regionally-fractured market. The LCCA security standards can provide guidance for law firms that is up-to-date with legal and technological best-practices.”

The LCCA noted that its issuance of its guidelines is “timely,” given that legal departments are adopting cloud solutions “in ever-increasing numbers,” with 31% of respondents in the ABA's 2015 Legal Technology Survey reporting their use of cloud services for “law-related tasks.”

Still, when it comes to security, the cloud can be a precarious platform. Nonetheless, advocates like the LCCA note how cloud computing can allow for greater efficiency and speed. As to why firms continue to go to the cloud despite security concerns, Newton explains that “law firms are slowly coming to the realization that adopting cloud computing is no longer an option ' if they are to remain competitive, leveraging cloud computing has to be part of their strategy. Furthermore, law firms are also recognizing that hosting their own on-premise IT systems often poses a greater security risk than a cloud-based solution.”

The LCCA intends for the standards to be viewed as “a living, constantly evolving document.” Newton added that the current draft is “open for comment” from stakeholders, bar associations, and legal professionals, among others. The public is invited to comment on the standards at the LCCA's website at www.legalcloudcomputingassociation.org.

' Ian Lopez, Legaltech News