A lack of formal cybersecurity requirements for outside counsel doesn't necessarily equate to higher cyberrisks.

Titled Unlock Insights Into Outside Counsel Billing and Staffing Guidelines, the report analyzed the results of a survey of 51 legal departments at various mid- to large-sized global corporations. The report found that of the 75 percent of respondents that had outside counsel guidelines in place, only 31 percent had guidelines that included formal data security requirements.

But some believe that this is not necessarily a bad omen. Such an oversight is unlikely to expose legal departments to higher cyberrisk, given the nature of their law firms' obligations, and the general lack of enforcement of such guidelines in the first place. William A. Sowinski, director of decision support services at Wolters Kluwer's ELM Solutions, noted that because law firms are required to keep information confidential, many of their clients already assume they have robust cybersecurity protections in place from the start.

It is not a farfetched assumption to make. Given law firms' ethical obligations, and the anxiety over recent cyberattacks, John Sweeney, president of LogicForce, told Legaltech News affiliate Corporate Counsel that most, if not all, major law firms are making cybersecurity a priority. I don't think there's a law firm that doesn't have policies in place and isn't training their people.

Sweeney added that for many firms, cybersecurity is also a business necessity in attracting and retaining clients with highly sensitive information. If I'm the CEO of IBM and I entrust IP for Watson to a big or small IP firm, think about if it got stolen, what the impact would be. These are very serious issues.

Yet some still see third-party guidelines as a vital tool in creating a culture of security in the legal industry. The Association of Corporate Counsel (ACC) recently released model cybersecurity guidelines for outside counsel. Meanwhile, the New York State Department of Financial Services' (NYS DFS) new data security regulation seeks to make law firms more cognizant of who accesses and handles sensitive client data.

Keith Lipman, CEO of Prosperoware, wrote in LTN, The ACC guidelines and the NYS DFS cybersecurity regulations tell an impactful story for the legal services industry: 'need to know' access privilege is the new standard of care.

Guideline requirements, of course, are not the only way legal departments can ensure cybersecurity protections from their outside counsel. Sowinski noted, for instance, that many departments are also increasingly indicating that they will, or have the right to, audit [their law firms'] cybersecurity.