Ride the Lightning

ACC Launches Data Steward Program to Assess Law Firm Data Security

February 1, 2021

On January 21, The National Law Review reported that the Association of Corporate Counsel (ACC), which represents over 45,000 in-house counsel across 85 countries, announced the launch of its Data Steward Program (DSP) to help organizations and their law firms assess and share information about cybersecurity relating to client data.

The program took two years to design with input from attorneys, cybersecurity and privacy experts and litigation support experts from corporations, law firms, vendors and government. The DSP, a voluntary-based program, consists of a standardized framework for "assessing, scoring, benchmarking, validating and accrediting" a law firm's client data security posture leveraging existing data security frameworks, such as the ISO or NIST, but also customizing "control selection, arrangement and compliance metrics" to meet a law firm's specific needs.

Why create this program? Corporations have long struggled to ensure that the law firms they use have adequate cybersecurity. A Fortune 500 company might easily have relationships with more than 500 law firms and vendors. Small corporations are not in a position to effectively perform data security related due diligence.

The ACC DSP has established goals to help ensure the program's success:

Exacting and Thorough Assessment

It requires a "rigorous and thorough review" of a law firm's data security status, detailed enough for both law firms and clients to make sound business decisions. This is met by "selecting and/or modeling controls" from established data security frameworks like ISO and NIST.

Value to All Participants

The DSP wants to ensure all relevant parties are involved in the standard setting process. "The balanced needs of all parties were represented (and will be maintained) by putting the DSP under the creative control of an ACC-sponsored working group of industry experts, including ACC Members, law firm partners, information security officers and CIOs, legal industry service providers and data security assessment firms who truly understand the issues and practices of the legal industry."

Secure Platform

The DSP data-sharing program titled Data Steward Exchange or DSP-X operates on a third-party SaaS platform with "an established record of security and has recently passed its latest SOC-2 audit".

Open Standard Benchmarking

The DSP algorithm for scoring is completely transparent and available to all participants.

Accommodate Legal Practice Diversity

The practice standards established by the ACC Working Group were designed to be applicable to law firms across all sizes and specialties with all law firms invited to participate in the DSP.

Independent Assessor Neutrality

The DSP establishes that an ACC accredited assessor performing a review may not perform either data security prevention or remediation services for that participant six months prior to or following an accreditation validation, to ensure neutrality.

The ACC has worked on law firm data security before. In 2017, the ACC released Model Information Protection and Security Controls for Outside Counsel Possessing Company Confidential Information ("the Model Controls"), data safety guidelines to help "in-house counsel as they put forth expectations with their outside vendors, including outside counsel." The Model Controls addressed a broad range of data security related measures including data breach reporting, data handling and encryption, physical security, employee background screening, information retention/return/destruction, and cyber liability insurance. In many ways, the DSP is a continuation of that initiative.

The DSP can be initiated in one of two ways: 1) a law firm can volunteer to participate and conduct a self-assessment, or 2) an ACC corporate member or prospective member can invite a law firm to participate. Even prior to launch, corporations were already asking their law firms and legal vendors to undergo an assessment.

And with all the cybersecurity nightmares of 2020, it is clear that cybersecurity and data privacy must be a high priority for everyone – including law firms.

Sharon D. Nelson, Esq., President, Sensei Enterprises, Inc.
3975 University Drive, Suite 225|Fairfax, VA 22030
Email: Phone: 703-359-070
Digital Forensics/Cybersecurity/Information Technology
https://senseient.com
https://twitter.com/sharonnelsonesq
https://www.linkedin.com/in/sharondnelson
https://amazon.com/author/sharonnelson