Law Firms
A Security Leader for Your Law Firm, Without the Full-Time Salary.
Someone has to own security decisions, answer the questionnaire from your biggest client and tell the partners where the risk is. A virtual CISO does that part time, with our team behind them.
For law firms that need security leadership and documentation but not a full-time executive.
Virtual CISO (vCISO) for Law Firms
What Does a vCISO Do for a Law Firm?
An experienced security professional learns how the firm works and builds a technology roadmap. They write the security policy and the incident response plan, oversee the program and report to the partners in plain language, so security is something the firm manages rather than worries about.
How Does a vCISO Help With Our Confidentiality Duties?
ABA Model Rule 1.6(c) asks for reasonable efforts to prevent unauthorized disclosure of, or access to, client information, and Virginia's Rule 1.6 has a matching paragraph. Comment 18 to the model rule names the factors that bear on reasonableness. A vCISO turns those factors into a written program, a list of what is in place and a plan for what is not yet.
We are not a law firm. Whether the program meets the firm's duties is for the firm and its bar to confirm.
Can You Answer Our Clients' Security Questionnaires?
Corporate and institutional clients send outside counsel guidelines and security questionnaires. Some want multi-factor authentication, encryption, a retention schedule or notice if there is an incident. The vCISO reads each against your environment, tells you what is true today, closes the gaps and prepares the supporting documents.
Picture a new client asking for a completed security questionnaire before sending the first matter. The firm needs an answer that is accurate, not hopeful.
Who Owns the Incident Response Plan?
The plan names who decides, who calls the insurer, who talks to clients and who talks to counsel. ABA Formal Opinion 483 addresses what lawyers owe clients after a breach, and contemplates response protocols as part of an incident response plan. We write the technical side with you and test it, and the firm and its counsel decide what the firm owes clients.
How Is This Different From Managed IT?
Managed IT runs the systems. A vCISO decides what the security program should be, sets priorities and checks that it is working. With us, both are the same company, so the plan and the people carrying it out do not drift apart.
What Is Included
6 PARTSTechnology Roadmap
Your firm's goals lined up with the right technology, in order.
Governance and Policy
A cybersecurity policy and the procedures under it.
Incident Response Planning
A written plan, tested so people know their part.
Program Oversight
Security program management and regulatory oversight.
Questionnaires and Reviews
Help with client, supplier and insurer security questionnaires.
Leadership Reporting
Risk explained in plain language to the partners.
Frequently Asked Questions
4 QUESTIONSDoes a vCISO make us compliant with our ethics rules?
No. Compliance with your bar's rules is for the firm and its bar to confirm. A vCISO builds and documents the security program the firm can point to.
Can a vCISO help with a client's outside counsel guidelines?
Yes. The vCISO reads the guidelines against your environment, tells you what is in place and what is not, and prepares the documents you return.
How much time does a vCISO spend with a small firm?
It is scoped to what you need, from a regular cadence of meetings to deeper involvement during a client audit or an incident. We set it on the call.
Is a vCISO the same as a vCSO?
Yes, for our purposes. Our earlier pages called the role a virtual Chief Security Officer; the work is the same security leadership.
More for Law Firms
Managed IT and Help Desk
Unlimited remote support, monitoring and maintenance at a fixed monthly cost.
Microsoft 365 and Email Security
Microsoft 365 set up, secured and run, with email protection against phishing and spoofing.
Managed Security Monitoring (MDR and SOC)
Round the clock monitoring, detection and response from a security operations center.
Backup and Ransomware Recovery
Encrypted, off-site backups that are tested, and a plan to restore the business after an attack.
Law Firms
Managed IT and security for small and mid-sized law firms and solo practitioners who hold client confidences and trust funds.
Talk Through Security Leadership.
Pick a time. Tell us which clients and insurers ask you security questions today.
Looking for CMMC? Our Compliance Division, Capital Cyber Compliance, delivers it.
Under 25 people? Apply for an in-kind cybersecurity grant from Cyber Grants Alliance, a nonprofit. No cost to you.