What Companies Need to Know about Protecting Confidential Information under the New ACC Guidelines

By: Stephen E. Reynolds and Nicole R. Woods ICE MILLER LLP

In response to the increased concern surrounding cybersecurity, the Association of Corporate Counsel (ACC) has released the Model Information Protection and Security Controls for Outside Counsel Possessing Company Confidential Information. The authors of this article discuss the guidelines, which can serve as a benchmark for law firm cybersecurity practices.

MORE AND MORE FREQUENTLY, HEADLINES ARE FILLED with news of crippling cyberattacks designed to cause the most chaos in the shortest amount of time. Recent examples include the WannaCry and Petya ransomware attacks that affected businesses worldwide, including many law firms. The WannaCry attack affected more than 230,000 computers in more than 150 countries within a single day, causing massive disruptions

According to the 2016 ABA TECHREPORT, 20%-25% of law firms have already experienced a data breach. In fact, one large law firm, which recently touted its cybersecurity expertise, was hit by the Petya attack and suffered several days of total system shutdown. It is no surprise, therefore, that two-thirds of chief legal officers and general counsels rank information privacy and protection of corporate data as "very" or "extremely" important.

In response to the increased concern surrounding cybersecurity, the ACC released the Model Information Protection and Security Controls for Outside Counsel Possessing Company Confidential Information.¹ The ACC hopes these guidelines will serve as a benchmark for law firm cybersecurity practices.

To read the full practice note in Lexis Practice Advisor, follow this link.

Stephen E. Reynolds, a former computer programmer and IT analyst, is a partner in Ice Miller LLP’s Litigation Group and co-chair of the Data Security and Privacy Practice, focusing his practice on commercial litigation and data security and privacy law. Nicole R. Woods is an associate in the firm’s Data Security and Privacy Practice, focusing on complex commercial litigation, including contract disputes, business torts, and financial services litigation. The authors may be reached at stephen.reynolds@icemiller.com and nicole.woods@icemiller.com, respectively. This article was published in the October 2017 issue of Pratt’s Privacy & Cybersecurity Law Report. All rights reserved. Visit the website to subscribe.

Related Content

1. ACC Model Information Protection and Security Controls for Outside Counsel Possessing Company Confidential Information.