By Carolyn Beal, Legal Compliance Consultant, Beal Cooper Compliance Ltd
Why it is a compliance issue, not just an IT issue.
“Cyber criminals won’t bother with us” remains a dangerous assumption for any law firm.
SME firms might not have the same number of clients, volume of data, or client money balances as larger firms, but they still possess confidential information, manage financial transactions and rely heavily on email and electronic systems. They remain a worthwhile target for criminals. In some cases, criminals may regard a smaller firm as an easier target because its resources and controls are expected to be less sophisticated.
For law firm managers, the issue is wider than whether the firm has appropriate antivirus software. A successful cyberattack can raise questions about the protection of client money, preservation of confidentiality, supervision of employees, management of suppliers, continuity of client service and regulatory reporting.
Therefore, cybersecurity must remain on the compliance agenda, not only on the IT provider’s task list.
What is the compliance exposure?
Attacks commonly begin with phishing emails, compromised email accounts, ransomware, or vulnerabilities within an outsourced service provider. The technical method may vary, but the compliance consequences are similar.
A payment-redirection fraud may place client money at risk and expose weaknesses in the firm’s procedures for verifying bank details, authorising payments and supervising transactions. The SRA Standards and Regulations require firms and solicitors to safeguard money and assets entrusted to them by clients and others.
Unauthorised access to emails or files may compromise the duty to keep the affairs of current and former clients confidential. This is not simply a data protection concern. Confidentiality is a regulatory and professional obligation applying across the firm. Data breaches must be considered for reporting to the SRA as well as the Information Commissioner’s Office (ICO).
An attack may also leave employees unable to access matter information, communicate with clients or complete urgent work. This can affect the firm’s ability to provide an effective and timely service and highlights why business continuity arrangements must work in practice, not merely exist as a written document.
Reporting and responding
A firm’s incident plan should identify who must be informed and who is responsible for making decisions. Decision making may rest with all managers, the COLP, the COFA, or the person responsible for data protection. Understanding the responsibilities is key.
The response to an attack is critical. The SRA expects prompt reporting where an attack has affected, or has the potential to affect, clients.
For any type of data breach (caused by a cyberattack or otherwise), where notification is required to the ICO, it must be made without undue delay and, where feasible, within 72 hours of awareness.
Management responsibility cannot be outsourced
An IT supplier can advise on system security, access controls, backups and technical recovery. These are necessary but those suppliers cannot take responsibility for the firm’s regulatory decisions.
Managers should ensure that cyber risks appear in the firm’s risk register, responsibilities are clearly allocated and incident procedures are regularly tested. On an operational level, access to systems should be controlled, authorisation processes for payment instructions should be robust, supplier due diligence should always address information security, and employees’ learning and development plans should include practical training on recognising and reporting concerns.
Firms can mitigate cyber risks but cannot eliminate every one, and compliance officers are not expected to become technical experts. However, managers must be able to demonstrate that risks to clients, client money and confidential information have been identified and managed.
Technical support may be outsourced. Regulatory accountability cannot be.
I’m happy to talk to firms about ensuring compliance procedures are in place and are effective, so managers have the confidence they need.
www.bealcoopercompliance.co.uk