The role of an IT leader in a small law firm will very likely be a part time position. Your familiarity with technology may be important to get the job and differentiate you from other candidates. The principal job you were hired for may be as a paralegal, marketing/social media director or administrative assistant. Quite often, in many small firms, the job falls on anyone who knows how to hook up a computer, install a printer driver or reboot the router when the Internet goes down!

I propose that if you are assigned that job you define a proactive rather than reactive role. In a future module I'll conclude that the most important step the owners of any business can do is put someone in charge of data safety and security. You don't necessarily need to be an expert - but you need to know who the experts (likely to be vendors) are, set expectations and hold them accountable. Otherwise that job very rarely gets done!

Your role as the 'go to' when something goes wrong - from mysterious messages that pop-up on web pages to major loss of services or disaster recovery - is part of the job too. You may be the one that consolidates tech issues into FAQs so that individuals don't each call for vendor tech support for help with the same problem.

Probably the next most significant and underappreciated role an IT leaders performs is to maintain a constant focus on productivity. This includes continued training/professional development, monitoring trends in new software & hardware, budgeting for upgrades and lifecycle management of equipment.

Downtime of systems and services in a law firm may be more than an inconvenience - missing a deadline, losing information or inadvertantly sharing confidential information can have consequences that lead to disbarment or fines based on lawyers' Rules of Professional Conduct. You may be charges to assist with compliance with various ethics rules around all manner of communications, presentations in courtrooms or mobile access to data just to name a few. Even eCycling for a law firm can be a major concern.

No less important is the development of policies and procedures and participating in professional committees and standard setting bodies. You should document the process for on-boarding and off-boarding staff and vendors.

Recently I've been asked to complete forms requesting information from insurance companies related to malpractice insurance with enhanced coverage for data breach and other cyber-attack related claims. Now these include phishing and ransomware attacks. (See this questionnaire for example.) Standards for data safety and security - and the losses which may be suffered - are adding additional costs and responsibilities to law firms in the area of IT related risk management. Regular audits, upgrades and monitoring are becoming a part of every firms' IT SOPs.

The modern law firm is becomeing more like an IT company with a legal side-hustle! The lawyers should stay focused on delivering legal services that generate income that sustains the firm. The IT Leader can play a similarly critical role in supporting the firm's mission, productivity and reputation, which includes protecting the privacy of information entrusted to the firm's care.

Resources (which follow this section)

Acceptable Use Policy - this sample policy defines what members of the firm can/can't do with their computers.
Data Security Policy - this sample policy defines how the firm protects data entrusted to its care
Cyber Security Document Request List - this information may be required if the risk of a cyber attack was high
Disaster Recovery Plan - this sample policy identifies the steps which will be taken in the event of a disaster
IT Infrastructure Audit Outline - this outline of IT equipment and services information is necessary to have available in the event of a failure. In my experience it is seldom readily available :(

Once adapted for a particular firm, all of these policies should be reviewed at least annually for relevance and currency with the latest laws & regulations affecting the firm. Insurance companies will generally require them and some business partners may expect them.

Credit Cards.png

Credit Cards

It is my experience that most law firms outsource processing of credit cards. The regulations which cover them are complex and laden with technical requirements and carry large liabilities. Some insurance companies require certification that consideration has been given to the collection and storage of credit card info. You can find more about that on the Payment Card Industry (PCI) Compliance Guide website.

Other 'Radioactive Data'

Lawyers engage in matters that are by there very nature confidential. Storing confidential data is a part of the business. You should be aware of how/where such information is stored & processed, who has access to it and how/when it should be deleted.

This article from the Federal Department of Labor outlines Guidance on the Protection of Personal Identifiable Information (PII).

Due to the high cost of making a mistake in this areas you should be guided by specialists in this area - I AM NOT THAT GUY!