# NIST: Cybersecurity Standards in the Legal Field

Legal services rely significantly on knowledge and information. In addition, the attorney-client relationship cannot exist without confidentiality and privacy.

For these reasons, the protection of sensitive communications and information is paramount to the legal profession.

In fact, according to a recent [ABA Legal Technology Survey Report](http://www.abajournal.com/magazine/article/managing_cybersecurity_risk "Managing Cybersecurity Risk | ABAJournal.com"), 30.7% of all law firms and 62.8% of firms with 500 lawyers or more reported that current or potential clients made specific security requirements a part of their client agreements.

Other law firms reported that corporate clients wanted access to the cybersecurity plans and prevention procedures implemented by the firms.

To better protect sensitive information and maintain privacy in an increasingly digital world, lawyers should know about and law firms should implement cybersecurity standards that are appropriate for the needs of their practice.

This article will address one such set of cybersecurity standards established and maintained by the [National Institute of Standards and Technology (NIST)](https://www.nist.gov/topics/cybersecurity "NIST and Cybersecurity Standards | NIST.gov").

## Cybersecurity Threats

Many [recent articles](https://abovethelaw.com/2018/11/cybersecurity-and-the-realities-of-practicing-law-in-2018/?rf=1 "Cybersecurity and the Reality of Practicing Law | AboveTheLaw.com") have documented the significant extent to which law firms are a prime target for cyber attack because they [“house some of the world’s most valuable secrets.”](https://www.americanbar.org/content/dam/aba/events/science_technology/cybersecurity_assessments_and_standards_law_offices.pdf "Cybersecurity Assessments and Standards for Law Firms | AmericanBar.org") Everything from trade secrets, to sensitive “market moving” information about a company’s finances, to healthcare information, and other sensitive non-public information occupy a law firm’s servers and data centers.

[Due to the looming threat](https://www.mason-mcbride.com/growing-cyber-threat-to-law-firms/ "Cybercriminals Growing Threat to Law Firms | Mason-McBride.com") posed by cyber-crooks who would want to profit from that sensitive non-public information, [performing a risk assessment](https://www.americanbar.org/content/dam/aba/events/science_technology/cybersecurity_assessments_and_standards_law_offices.pdf "Cybersecurity Assessments and Standards | AmericanBar.org") is a law firm’s important first step towards improved cybersecurity. The risk assessment should follow the [frameworks and standards](https://effortlesslegal.com/blog/2019/01/03/law-firm-cybersecurity/ "Law Firm Cybersecurity - Standards and Policies | Insights") established by at least one of many cybersecurity authorities and institutions.

## Federal Regulations

The cybersecurity practices of law firms are not directly regulated by the federal government. However, the specific nature of legal work performed by lawyers in the law firm, and the varied needs of clients in specific industries that are subject to cybersecurity regulation by the federal government, makes the delineation murkier.

For example, healthcare organizations ( [1996 Health Insurance Portability and Accountability Act (HIPAA)](https://online.maryville.edu/blog/hipaa-compliance-and-the-protection-of-cyber-security/ "Cybersecurity and HIPAA Compliance | Maryville EDU Blog")), financial institutions ( [1999 Gramm-Leach-Bliley Act](https://www.ftc.gov/tips-advice/business-center/privacy-and-security/gramm-leach-bliley-act "Gramm-Leach-Bliley Act on Privacy and Security | FTC.gov")), and federal agencies ( [Federal Information Security Modernization Act of 2014 (FISMA 2014)](https://www.dhs.gov/cisa/federal-information-security-modernization-act "FISMA - Federal Information Security Modernization Act | DHS.gov")) are all required to establish and maintain strict processes and procedures to safeguard certain types of information.

Because the protected information may be transferred or made available to a lawyer as part of the lawyer’s representation, lawyers and law firms that regularly represent subject entities may in turn be required to comply with the same or similar cybersecurity standards.

## State Regulations

Even for lawyers who do not represent entities that are subject to federal cybersecurity regulations, all American lawyers are subject to state regulation and disciplinary authority. Many states, along with the American Bar Association, have issued rules or advisory opinions relating to the [cybersecurity obligations of lawyers and law firms](https://effortlesslegal.com/blog/2019/01/03/law-firm-cybersecurity/ "Law Firm Cybersecurity - Policies and Standards | Insights").

For example, [Formal Opinion 477R](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/aba_formal_opinion_477.authcheckdam.pdf "Formal Opinion 477R for Professional Responsibility | AmericanBar.org"), which was recently issued by the ABA Standing Committee on Ethics and Professional Responsibility, “explained a lawyer’s ethical responsibility to use reasonable efforts when communicating client confidential information using the Internet.” In addition, the same Standing Committee issued [Formal Opinion 483](https://www.americanbar.org/content/dam/aba/images/news/formal_op_483.pdf "Formal Opinion 483 - PDF | AmericanBar.org"), providing new guidance “on an attorney’s ethical obligations after a data breach.”

Under the ABA’s [Formal Opinion 477R](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/aba_formal_opinion_477.authcheckdam.pdf "Formal Opinion 477R for Professional Responsibility | AmericanBar.org"), “a lawyer should understand how their firm’s electronic communications are created, where client data resides, and what avenues exist to access that information.” In addition, Formal Opinion 477R notes, “lawyers must, on a case-by-case basis, constantly analyze how they communicate electronically about client matters.”

The ABA Formal Opinion has been implemented in most states.

For example, in [California](https://www.calbar.ca.gov/Portals/0/documents/ethics/Opinions/2010-179-Interim-No-08-0002-PAW.pdf "Standing Committee on Professional Responsibility and Conduct - Formal Opinion 2010-179 | California Bar"), attorneys will be deemed to have violated their duties of confidentiality and competence if they fail to take the proper precautions to protect client data.

Similarly, in [Florida](https://www.floridabar.org/etopinions/etopinion-12-3/ "Opinion 12-3 | Florida Bar Ethics Opinion"), “lawyers may use cloud computing if they take reasonable precautions to ensure that confidentiality of client information is maintained, that the service provider maintains adequate security, and that the lawyer has adequate access to the information stored remotely,” and “the lawyer should research the service provider to be used.”

In sum, under these Formal Opinions and similar guidance from various states, [attorneys must exercise](http://www.abajournal.com/magazine/article/lawyers_ethical_safeguard_confidential_information_cloud "Securing Confidential Info in the Cloud | ABAJournal.com") “reasonable efforts” to prevent “inadvertent or unauthorized” disclosure and access to client information, including by staying up to date on technological developments and threats.

For this reason alone, ignoring the realities of digital threats will expose your firm and clients to potentially significant liabilities.

## What is NIST?

One of the most prevalent cybersecurity regimes, at last in the United States, is that which is promulgated by the [National Institute of Standards and Technology (NIST)](https://www.nist.gov/topics/cybersecurity "NIST Topic - Cybersecurity | NIST.gov").

The NIST provides some of the most comprehensive standards and guidelines in the field. Essentially, the NIST standards are those that are used and endorsed by the United States federal government.

The comprehensiveness and reliability of the NIST cybersecurity frameworks and standards arise from the fact that they are less of a mere thought exercise, and more of a compilation of best practices compiled [from various security documents, organizations and publications](https://digitalguardian.com/blog/what-nist-compliance "What is NIST Compliance | DigitalGuardian.com").

Because cybersecurity is an ever-evolving concern, simply drafting a document of best practices is insufficient. Therefore, NIST’s Special Publication 800 series on cybersecurity is regularly updated to keep cybersecurity standards as current as possible.

[NIST SP 800](https://www.nist.gov/itl/nist-special-publication-800-series-general-information "NIST Special Publication 800 Series | NIST.gov") is a series of documents that not only detail cyberthreat prevention practices but also consider and showcase feasibility and cost-effectiveness of the suggested standards.

Although these standards are voluntary, maintenance and implementation of the standards would likely stave off or at least help prevent liability in the event of a data security breach.

Compliance with the NIST SP 800 series is not as intimidating as it may first appear. For instance, NIST 800-171 covers the secure sharing of information. [Federal Computer](https://web.archive.org/web/20211127061724/https://fcw.com/articles/2018/05/04/comment-800-171-compliance.aspx "7 Steps to Complying with NIST 800-171 | FCW.com") Week boils compliance with NIST 800-171 down to seven essential steps.

Adjusting the language of the guidelines away from government specific applications, and to suit the needs of law firms, gives you the following list:

1. Identify systems that contain sensitive information  
2. Separate sensitive information from more benign information  
3. Limit access of sensitive information only to authorized employees  
4. Encrypt all data, including sensitive information  
5. Monitor access to sensitive information  
6. Regularly train and retrain employees on cybersecurity best practices  
7. Regularly conduct security assessments of all systems

Although more detailed examination may be required by some law firms whose needs are greater, many law firms would be well-suited to at least implement and then regularly refresh the simplified list above.

## Conclusion

The [practical benefits of advancing technology](https://effortlesslegal.com/blog/2019/02/26/ai-machine-learning/ "How AI and Machine Learning Increases Law Firm Profits | Insights") are becoming increasingly clear.  [For example, automation](https://effortlesslegal.com/blog/2019/02/27/machine-learning-intro/ "An Intro to Machine Learning and its Benefits for Law Firms | Insights") is easing the burden of time-intensive and repetitive tasks like billing and research.

As helpful as automation and other applications can be, if the applications do not comply with cybersecurity best practices, they become security risks in and of themselves. Stated differently, non-compliant legal applications can be more trouble than they are worth.

Choosing [legal apps that themselves comply with NIST](https://effortlesslegal.com/security-and-data-protection/ "Security and Data Protection for Users | EffortlessLegal.com") or other well-established cybersecurity standards is a prudent step to maintaining digital protection.