December 1, 2021

Volume XI, Number 335


November 30, 2021

Subscribe to Latest Legal News and Analysis

November 29, 2021

Subscribe to Latest Legal News and Analysis

ACC Launches Data Steward Program: An Approach to Assessing Law Firm Data Security

On December 8th, the Association of Corporate Counsel (ACC), which represents over 45,000 in-house counsel across 85 countries, announced the launch of its Data Steward Program (DSP) to help organizations and their law firms assess and share information about information security relating to client data. The DSP is two years in the making, collecting input from attorneys, cybersecurity and privacy experts and litigation support experts from corporations, law firms, vendors and government. The DSP, a voluntary-based program, creates a standardized framework for “assessing, scoring, benchmarking, validating and accrediting” a law firm’s stance regarding client data security leveraging existing data security frame works, such as the ISO or NIST, but also customizing “control selection, arrangement and compliance metrics” to meet a law firm’s specific needs.

The DSP was developed in response to the struggles corporations face in attempting to ensure that the law firms they utilize have adequate data security measures in place – a Fortune 500 company often has relationships with upwards of 500 law firms and vendors. Moreover, SMBs that utilize smaller sized law firms and vendors are often ill equipped to effectively perform data security related due diligence.

Of course, for all service providers, including law firms, it is critical to maintain reasonable administrative, physical, and technical safeguards when interacting with sensitive corporate and personal data of customers, as well as to ensure that adequate protections are in place to prevent and respond to data breaches. Law firms should not be surprised to see enhanced efforts, such as the DSP, to help assess those safeguards on a more consistent basis. Firms concerned about facing requests for assessments and/or maintaining their privacy and security protocols in an increasingly dynamic environment should review their cybersecurity risk management policies, procedures and practices sooner rather than later.

The ACC DSP has established a clear set of goals to help ensure the program’s success:

  • Exacting and Thorough Assessment

    • Requiring a “rigorous and thorough review” of a law firm’s data security status, detailed enough for both law firms and clients to make adequate business decisions. This is satisfied by “selecting and/or modeling controls” from established data security frameworks including ISO and NIST.

  • Value to All Participants

    • The DSP aims to ensure all relevant parties are involved in the standard setting process. “The balanced needs of all parties were represented (and will be maintained) by putting the DSP under the creative control of an ACC-sponsored working group of industry experts, including ACC Members, law firm partners, information security officers and CIOs, legal industry service providers and data security assessment firms who truly understand the issues and practices of the legal industry.”

  • Secure Platform

    • The DSP data-sharing program titled Data Steward Exchange or DSP-X operates on a third-party SaaS platform with “an established record of security and has recently passed its latest SOC-2 audit”.

  • Open Standard Benchmarking

    • The DSP algorithm for scoring is 100% transparent and available to all participants.

  • Accommodate Legal Practice Diversity

    • The practice standards established by the ACC Working Group were designed to be applicable to law firms across all sizes and specialties, and all law firms are invited to participate in the DSP.

  • Independent Assessor Neutrality

    • The DSP establishes that an ACC accredited assessor performing a review may not perform either data security prevention or remediation services for that participant six months prior to or following an accreditation validation, to ensure neutrality.

This is not the first time of late that the ACC has prioritized data security and privacy matters for in-house counsel and law firms. In 2017, the ACC released Model Information Protection and Security Controls for Outside Counsel Possessing Company Confidential Information (“the Model Controls”), data safety guidelines to help “in-house counsel as they set expectations with their outside vendors, including outside counsel.” The Model Controls addressed a broad range of data security related measures including: data breach reporting, data handling and encryption, physical security, employee background screening, information retention/return/destruction, and cyber liability insurance. The Model Controls were developed to serve as a “best practice” standardizing the protocols companies implement when interacting with third-party vendors who may have access to sensitive corporate data, and in many ways the DSP is a continuation of that initiative.

The DSP can be initiated in one of two ways: 1) a law firm can volunteer to participate and conduct a self-assessment, or 2) an ACC corporate member or prospective member can invite a law firm to participate. Even prior to launch, corporations were already inviting their law firms and legal vendors to undergo an assessment. 2020 has proven that data privacy and security risks must be prioritized across all industries.

Jackson Lewis P.C. © 2021National Law Review, Volume XI, Number 21

About this Author


Joseph J. Lazzarotti is a principal in the Berkeley Heights, New Jersey, office of Jackson Lewis P.C. He founded and currently co-leads the firm's Privacy, Data and Cybersecurity practice group, edits the firm’s Privacy Blog, and is a Certified Information Privacy Professional (CIPP) with the International Association of Privacy Professionals. Trained as an employee benefits lawyer, focused on compliance, Joe also is a member of the firm’s Employee Benefits practice group.

In short, his practice focuses on the matrix of laws governing the privacy, security, and...

973- 538-6890

Maya Atrakchi is the Knowledge Management (“KM”) Attorney for Jackson Lewis P.C.’s Privacy, e-Communication and Data Security and International Employment Issues Practice Groups, and is based in the New York City, New York, office of Jackson Lewis P.C.