Posted by Tim Smith, chief technical director at Insight Legal Software [1].
Smith: Data security is of extreme importance
Law firms, like other businesses, are facing an unprecedented situation. Covid-19 has meant we are having to make dramatic changes to the way that we work, communicate and go about our daily lives.
This is one area in which technology can really help. Having a cloud-based practice management, legal accounts and even case management system can provide workers at law firms with incredible flexibility of where, when and how they work. However, there are many things that a firm should be aware of before making the transition to the cloud.
Firstly, this is going to be a partnership that may last many years. Is the cloud supplier you are considering to partner with trustworthy? Where will the data be held? Is it really secure? Are they tying you into a long-term contract? Can you easily get access to ALL of your data? Make sure you are making a wise decision rather than a quick one.
With any system you implement, data security is of extreme importance. There is an old saying when it comes to data security that the three most important things are backup, backup and backup. This is as true with a cloud-based system as it is with traditional on-premise data.
It is absolutely essential that you can get a backup of your data and any documents either on demand or on a regular basis. Without this, you are entirely at the mercy of your cloud supplier.
A cloud-based implementation also has some other factors which must be considered. Where is the data held? Who has access to it? Is it encrypted both at rest and whilst it is being transmitted? These are questions that you must ensure you have really good, and not just adequate, answers to.
Even with a cloud-based solution, there are lots of reasons why you might not be able to access your own data. For instance, the data centre might go off-line or the supplier fails to pay their bills to the data centre and they get turned off, your internet connection might fail and Open Reach might be unable to fix it in a timely manner.
Add to these the possibility that you might get into a contractual dispute with your supplier because they have doubled their prices, knowing that you have no choice but to pay.
Without access to your data, whether it be accounts, case data, documents, emails etc, your practice will struggle to operate effectively or at all. If that happens, no matter whether you are regulated by the Solicitors Regulation Authority or another body, they are not going to care that it was the fault of the data centre or your software supplier or even BT. All they will care about is any failure of your service.
Here is a check-list of what you should be asking of your cloud system supplier;
- How long is the contract and what are the cancellation terms? Any good supplier will be happy to give you either a rolling monthly contract or have a short cancellation term. If they don’t, ask yourself what valid reason they would have for locking you in for many years.
- Do they have a cap on price increases in their contract or can they up the price whenever they like?
- Where is the data stored? Is it all in the UK? Is it in a really secure and obscure data centre like the ones Microsoft and Amazon use or is it in a technology park somewhere where security of the physical servers is not really all that stringent?
- Who has access to your data? Can the supplier see it all? Can anyone in the data centre get access to it if they try? Is it encrypted both whilst it is on the way to and from the data centre but also when it is at rest (when it is simply stored on the server awaiting access)?
- How long has the supplier been around? Do they have reliable reference sites and genuine accreditations?
- What is your internet access like in all of the places from where you will need to have access?
- Can you get a backup of your complete data and documents at any time you like? If this is done weekly, that might be acceptable if you can afford to lose a couple of days work. If they tell you that you can download your data by running some reports or you don’t need to backup because they or the data centre do it, then walk away – this is not someone to whom you want to entrust all of your vital client, matter and case information.
- Finally, if there is a major outage with the data centre or with your internet connection, can everything be moved quickly back to on-premises to keep you working? If not, your firm might be effectively paralysed until access is restored – if that is even possible.
By using this checklist and posing these questions to anyone you are considering helping you on your journey to the cloud, you should be in a much safer and secure position to make a good decision on their suitability. There are specialist legal software suppliers that can offer you all of these things.
Even if you are already partially or fully cloud-based, checking you have answers to these questions will put you in a more safe and secure place. If there are shortfalls in your current configuration, this will be a good time to address those.
So even if you need to move to the cloud quickly, make sure you do it smartly and safely.