Cloud Legal Document Management Solution Security

Legal Document Management Software Security

Legal technology solution to manage case files provisions folders based on client or practice area hierarchy. Matter files and artifacts must be accessed only by authorized users. Security profile and content access can be managed by matter team. External and internal users must be provided rights to the matter documents without the involvement of IT team.

Legal DMS Security Requirements

• Audit Trail: All activities on documents must be recorded. View, Edits, Email and Printing must be tracked by user and time stamp.
• Version History: Software must create major and minor versions automatically when documents are edited.
• Right Management: Documents synced locally must be encrypted with user account. Contents must be secured in cloud and when downloaded to desktop or mobile device.
• Business Continuity Process: Files must be backed continuously in multiple locations. In case of system failure or breach, last known valid data set can be restored and lawyers can continue with their tasks.
• Management Reports: Platform must generate user access details, document download history, files not viewed over 3 years.
• Deletion Role: DMS must provide configurable security role for document delete privileges. Only matter team members with assigned role can delete documents.
• Deletion only by Admin: System must configurable so only Administrators can delete the documents.
• Recycle Bin: Documents deleted must be saved in recycle bin with metadata, which can be accessed and restored only by system administrators.

Ethical and Regulatory Obligations

Law firms are professionally required to protect the client data and inform the clients when data breach occurs. Bar associations have made recommendations on secure communications with clients and guidelines to be followed when client data is exposed or compromised

To comply with the obligations the law firms must implement cyber security plan and governance team. Protecting client data must become culture of the law firms and training must be provided to achieve secure client communications and external collaboration.

Law offices must protect from following to safeguard from legal and trust issues

• Phished emails leading to compromised law firm communications
• Leaked client and confidential client data leading to loss of public trust
• Case files are locked and cannot be accessed because of ransomware
• Inability to comply with government regulations in handling personal data

Technology solutions like legal document management solution can help protect client data by implementing SOP, data encryption and enhanced security infrastructure.

GDPR and PDPA Laws

Local laws determine how data breach must be communicated in accordance with the internal governance.

GDPR: Law firms operating in EU must handle client personal data in secure way, with option provided to clients to purge their data. When request is received, law firms must provide validation that data is deleted from all the line of business applications.

PDPA: Singapore has mandated business to implement reasonable safeguards for protecting client personal data like IC number, biometric details, financial standings, and employment history.

Best practices for protecting Law Firm data

Everyone in law firms from attorneys, secretaries and partners are responsible for protecting the client data which extends from files, emails, legal discovery contents, evidence and other case documents shared by opposing counsels. Legal software security framework must be flexible to support law firm business requirements.

• Implement data governance team

Data security policy must define information lifecycle management of contents.

1. Data creation steps using office apps or legal automation solution
2. Metadata driven data purging to be triggered when cases are closed for certain years or client sensitive data to be redacted

• Continuous training on data security

Share and train employees on the policies and guidelines on handling client data. Tools must be available to warn users on risk exposure like marking suspicious emails and warning when sensitive data is sent in emails to external users.

• Secure communications

Technology solutions like Client Portal must be implemented to share documents with external users like client or opposing counsels. Emails must be avoided to send sensitive contents.

• Security framework for Legal DMS

Legal Document Management Software must be configured with security templates to manage access permission for contents. Team members must have access to case folder and documents automatically. Other lawyers or external users can be invited and provided access for limited time. Privilege can be extended and must be go through vetting workflow.

• Internal validation of process

Security and GRC (Governance, Risk and Compliance) policies must be evaluated quarterly to ensure people are following the process. Data audit must be conducted to confirm personal identification information is not stored in unsecure device or external communication platforms like client portal.

• Disaster recovery plans

Cloud solution must backup data, and settings in geographically distributed locations. Solution must have failover setup so application will always be available to users. Backup can be used to retrieve data accidentally deleted by users. SLA must be established for these requests, so practice is educated on these features and limitations.

• Mobile security

Legal work is done remotely and securing mobile devices are important. Standard policies for BYOD may include master data management, encryption for communication and data, screen lock requirement when business app is installed. If attorney loses a business mobile device governance must wipe out the data remotely. Laptops must also be secured with local encryption.

• Secure passwords

Strong password policies must be enforced. Apps must use standard directory like Azure AD or Google for authentication than maintaining user credentials internally.

PageLightPrime – Secure Legal Solution

Practice Management Solution integrated with Legal document solution implements framework to secure clients, data, and process.

• Azure AD authentication: PageLightPrime app is secured by Azure AD. Microsoft directory offers extensibility on password policies and app management to suit law firm needs. Azure AD prevents password guessing, and DoS attacks.
• Security templates: Role based security combined with matter teams will confirm only assigned users can view matter documents.
• Audit tracking: PageLightPrime logs all user activities, and any unauthorized access can be identified, and preventive action taken.
• SharePoint integration: Data is stored in SharePoint online and data availability is guaranteed by Microsoft.
• OneDrive for offline access: Lawyers can access case files offline and are automatically encrypted when synced.

Cloud solution providers are inherently secure by adopting proactively to active threats. PageLighPrime security team continuously reviews application to improve the usability and security by rolling out automatic updates when new risk is discovered. PageLightPrime partners with law firm to secure the client data, so law firms can spend their time working on legal matters and leave the security tasks for PageLightPrime to handle.