With cyber-crime making the headlines more and more frequently, it is becoming increasingly important that law firms of all sizes understand how to handle such a situation professionally and keep their reputation intact.
Here are some steps any law firm can take to help ensure that a cyber-attack or data breach doesn’t cost them their client base.
The focus must be on fixing the problem and retaining your clients trust
The key to surviving a cyber-attack with your reputation intact is in what you do beforehand – in planning, thinking, training and rehearsal – as delivering a slow, haphazard, confused, overly legalistic or contradictory response will only exacerbate the situation.
Your plan needs to focus on 2 key areas:
1. Fixing the problem as quickly as possible
2. Retaining the trust of stakeholders and clients whose information may have been compromised
Discuss what “worst case scenario” means to your firm
When creating your plan, a good starting point is to sit down with your senior team and conduct a cyber reputational risk analysis, in essence decide what your “worst case scenario” looks like.
Every law firm will have a different view on what defines a “worst case scenario”. You need to understand what this scenario is to be able to recognise when it is happening – and (just as importantly) when it isn’t happening.
This will help everyone to understand the magnitude of a situation, should something arise, and respond accordingly.
Create a cyber incident response plan for these different situations
In a high pressured situation, you don’t want to be making snap judgements, as this could lead to mistakes which could be difficult to recover from.
Set aside time to work through some of your “worst case scenarios”, and discuss what decisions will need to be made and who will be responsible for making them.
You should also make a list of the different phone numbers you will need. This list should include nominated individuals who will “take the helm” of the situation, as well as the people whose advice, support and technical services you will require to get your operation back up and running.
Having all of this information readily available will help ensure you are contacting the right people as quickly as possible, removing any unnecessary stress and delay.
Decide how and when you are going to communicate with those affected
Don’t make the mistake of thinking you can hide your breach from your clients; they have a right to know that their data has been compromised. It is also far better your clients hear the news directly from your firm, then to find out through a third party, rumour or through the media.
When communicating the news to your clients, it is best to adopt a personal approach. For example, if only a small number of clients have been affected, it is in your firm’s interests for a senior individual to phone them.
However, if hundreds of clients have been affected, you will need to adopt a speedier and more realistic approach. For example, sending out an email explaining what has happened and what your clients need to do next.
As part of your planning process, it can help to put together an email template which can be quickly edited and sent out in the event of a cyber-attack. You should also write some guidelines on how quickly you will be prepared to talk to your clients, looking at possible triggers, and the pros and cons of sending out various communications.
Have a back-up communication plan for if your systems are still compromised
You also need to think about how you would communicate if your systems were still compromised.
For example, if you can’t send out an email or display a message on your website because your systems have been taken down.
In such a situation, could you relay the message via phone or Facebook?
Be prepared for the media to get in touch
Once you have communicated the news to your clients, you need to be prepared for the media to get in touch. Remember, emails can be forwarded!
It is wise to nominate 2-3 individuals in advance who are prepared to step forward; to avoid your one point of contact being on holiday if a situation occurs.
It is equally important that your nominees have media training, as they may have to answer questions when they only have access to limited information, but will still need to reassure everyone and communicate effectively.
With thanks to Jonathan Hemus from Insignia, Crisis management, training, planning & consultancy
This article was submitted to be published by tmgroup as part of their advertising agreement with Today’s Conveyancer. The views expressed in this article are those of the submitter and not those of Today’s Conveyancer.
