IT for law firms, built around the rules you answer to.
ABA Model Rule 5.3 makes you responsible for supervising the vendor that runs your IT. We run managed IT, security and compliance for law firms and write down what we do, so you can show it.
You supervise your IT vendor, whether or not you read the contract.
Rule 5.3 treats the people who handle your client data as nonlawyer assistants, and that includes your IT provider. Partners with managerial authority must make reasonable efforts to see that the vendor’s conduct fits the firm’s professional obligations. “We trust them” is not a record of supervision.
We give you the record. Every change is written down, you see regular reports on what we did, and a named engineer answers when you ask why a setting exists.
What the rules ask, and what we do about it.
Rule 1.1
CompetenceTechnology competence is part of competence. We keep the firm’s devices, Microsoft 365 and accounts patched and documented, so the answer to “who handles this?” is on paper.
Rule 1.6
ConfidentialityReasonable efforts to protect client information means access limited to people who need it, encrypted devices and an off-boarding that happens the day someone leaves.
Rule 5.3
SupervisionWritten changes, plain-English reports and a vendor you can question. Managed security adds 24x7 monitoring, with alerts reaching a person in under 7 minutes on average over the last 12 months.
Opinion 512
Generative AIABA Formal Opinion 512 (July 2024) covers lawyers’ use of generative AI, including confidentiality. AI consulting and governance sets which tools the firm allows and what may go into them.
Evidence for client security questionnaires.
Corporate clients and insurers now send questionnaires, and the honest answers live in your systems. We keep the evidence behind each answer, so you answer truthfully and the next one takes less time. Our vCISO and compliance service maps the work to CIS Controls v8 and NIST CSF 2.0 and gives you a named security lead for the signature line.
- Which controls are in place, and the date each was last checked.
- Who has access to client files, and who lost it when they left.
- What the incident plan says and who calls the client.
Who it fits.
Firms of ten to two hundred people with no IT department, or with one person carrying all of it. If you already have in-house IT, we back them up. We also test the firm’s defenses with penetration testing when a client or insurer asks for it.
“Ramon is keenly attuned to what legal professionals need to do in order to comply with professional responsibility guidance, while also being sensitive to small and medium sized business operational needs. … Sentinel Cyber makes it easy to do it right.”
Julia A. Clayton, Owner, Law Office of Julia A. Clayton
Questions from managing partners.
Does Rule 5.3 really apply to my IT provider?
ABA Model Rule 5.3 covers nonlawyer assistance, and the comments extend it to outside vendors who handle client information. Your state’s version of the rule governs, so check it with your ethics counsel.
Do you give legal advice on the rules?
No. We turn the rules into technical controls and evidence. Your ethics counsel or the bar decides what the rules require of you.
Can you answer our clients’ security questionnaires?
Yes. We answer the technical questions from what is actually in place, and tell you where a control is missing before it goes out.
Where do we start?
With a 15-minute call. You get your three biggest risks in writing by email afterward. If you hire us, week 1 is paid scoping that ends in a fixed monthly price.
Find out what to fix first, in 15 minutes.
You get your three biggest risks in writing, by email after the call.