Law firms depend on outside technology providers for far more than email and file storage. Cloud practice-management platforms, e-discovery vendors, managed IT providers, payroll companies, document-processing services, contract-review software, artificial intelligence platforms, and cybersecurity companies may all interact with a firm’s systems or sensitive information.
That dependence creates an important cybersecurity problem. A law firm can maintain strong internal security controls and still suffer a serious data incident if a third-party provider is compromised. A vendor account with excessive permissions, a vulnerable cloud application, a stolen administrator credential, or an insecure integration can potentially provide attackers with an indirect route to confidential information.
Third-party risk has therefore become an important part of law firm cybersecurity. The American Bar Association has identified supply-chain and third-party compromises among the significant cybersecurity threats facing attorneys and law firms. Its guidance also emphasizes that lawyers have professional obligations to safeguard confidential information even when technology services are provided by outside companies.
This concern fits within the broader cybersecurity issues discussed in Cybersecurity & Privacy Law: Protecting Your Digital Rights in California. For law firms, however, vendor security adds another layer: protecting information that may leave the firm’s direct technological control.
Why Third-Party Vendors Create Cybersecurity Risk
Outside providers frequently require access to systems or information in order to perform their services. A cloud document platform may store client files. An e-discovery provider may process litigation materials. A managed IT company may have administrative access to computers and servers. An AI application may process documents or prompts containing information related to a representation.
Each connection creates another potential point of exposure.
The American Bar Association has specifically addressed vendor data-breach risks for law firms, noting that compromised vendors, cloud services, and managed IT providers can become indirect entry points into a firm’s systems.
The problem does not necessarily mean cloud technology is inherently unsafe. Reputable providers may offer sophisticated security capabilities that would be difficult for a smaller firm to implement independently. The challenge is determining whether a particular provider has appropriate controls and whether the law firm has configured and managed the service securely.
Client Confidentiality Does Not End at the Vendor
A lawyer’s responsibility for client confidentiality does not disappear when information is entrusted to a technology provider. ABA Model Rule 1.6 addresses confidentiality of information and requires lawyers to make reasonable efforts to prevent unauthorized access to or disclosure of information relating to a representation.
Vendor relationships can therefore involve professional responsibility as well as technical cybersecurity.
The ABA’s guidance on ethical issues involving attorney use of vendors discusses reasonable safeguards, confidentiality agreements, supervision, vendor misconduct, and the protection of client information.
The appropriate safeguards may depend on the circumstances. A vendor processing highly sensitive litigation documents may require greater scrutiny than a provider that never receives confidential client information.
Law firms should therefore understand what information each vendor can access rather than treating every technology provider identically.
What Information Could a Vendor Access?
Vendor risk assessments should begin with data. Before approving a service, the firm should determine what information the provider will receive, process, transmit, or store.
Depending on the service, this could include:
- Attorney-client communications
- Litigation strategies
- Discovery materials
- Medical records
- Financial information
- Trade secrets
- Personally identifiable information
- Employee records
- Passwords or authentication information
- Draft contracts and legal documents
- Client contact information
- Billing and payment information
A provider that receives little sensitive information may present relatively limited risk. A vendor that stores an entire client database or has administrator-level network access deserves substantially more scrutiny.
Access Can Matter as Much as Storage
A common mistake is evaluating only whether a vendor stores client data. A provider may create cybersecurity risk even if it does not permanently store files.
Managed service providers, cybersecurity companies, remote-support services, and software integrations may have access to law firm systems. If an attacker compromises a privileged vendor account, that access could potentially be used against the firm.
Law firms should therefore evaluate both data access and system access.
What Law Firms Should Review Before Hiring a Vendor
Vendor selection should involve more than comparing price and features. The firm’s review should consider how the provider protects information throughout the relationship.
The ABA’s cloud-computing guidance notes that confidentiality and security continue to be major concerns for lawyers using cloud services. It also highlights the importance attorneys place on vendor reputation. Law firms can review the ABA Cloud Computing TechReport for additional information about legal-industry cloud adoption and security practices.
A vendor review may include questions such as:
- What information will the vendor collect?
- Where will the information be stored?
- Who can access it?
- Does the vendor use subcontractors?
- How is information encrypted?
- Does the service support multifactor authentication?
- How are administrator privileges controlled?
- How long is customer information retained?
- Can information be permanently deleted?
- How does the provider respond to security incidents?
- When will customers be notified of a breach?
- Does the vendor maintain security audit reports or certifications?
- How are backups protected?
- What happens to the firm’s information when the contract ends?
No single answer automatically establishes that a provider is safe. The goal is to understand the service well enough to evaluate whether its protections are reasonable for the information involved.
Vendor Contracts Deserve Cybersecurity Review
Technical safeguards are only one part of vendor management. The contract governing the relationship can determine what happens when something goes wrong.
Law firms should understand provisions involving confidentiality, security requirements, incident notification, data ownership, subcontractors, termination, deletion, audit rights, insurance, indemnification, and limitations of liability.
Cloud agreements can contain provisions that materially affect how customer data is handled. The ABA has discussed risks hidden within cloud-service agreements, including issues involving hosting providers, access to customer information, artificial intelligence, and contractual limitations.
A firm’s review should also determine whether the provider can change security or data-use terms through an online policy without negotiating a new agreement.
Pay Attention to AI Clauses
Artificial intelligence has added another question to vendor contracting: can customer information be used to develop, train, test, or improve AI systems?
A law firm may purchase what appears to be an ordinary cloud service without realizing that AI features have been integrated into the platform. The firm’s documents or usage information may be processed differently after a product update.
This is particularly important when the system handles information relating to legal representation. Lawyers using generative AI should also consider the issues discussed in How Advanced AI Risk Controls Are Becoming Mandatory in Law Firms.
ABA Formal Opinion 512 discusses similar considerations for generative AI providers, including vendor credentials, security policies, confidentiality protections, retention, and the handling of information relating to representation. Lawyers can review ABA Formal Opinion 512 for the full discussion.
Do Not Forget About the Vendor’s Vendors
Technology supply chains can extend beyond the company named in the contract. A software provider may depend on separate hosting companies, analytics services, payment processors, support providers, or artificial intelligence infrastructure.
These subcontractors can create fourth-party risk.
Law firms do not necessarily need to independently investigate every company in a global technology supply chain. They should, however, understand whether important subcontractors may access sensitive information and what contractual protections govern that access.
Questions about subcontractors become especially important when information is stored in different jurisdictions or when a vendor uses another provider to host highly confidential data.
Control How Much Access Vendors Receive
A provider should generally receive only the access necessary to perform its function. Giving every vendor broad network permissions can increase the damage that may occur if one account is compromised.
This concept is closely related to least-privilege and zero-trust security principles. Rather than automatically trusting a connection because it belongs to an approved provider, access can be authenticated, restricted, and monitored according to the task being performed.
The National Institute of Standards and Technology’s Zero Trust Architecture guidance provides a technical framework for organizations evaluating this approach.
Law firms may consider controls such as multifactor authentication, role-based access, restricted administrator accounts, network segmentation, logging, and periodic access reviews.
Remove Access When It Is No Longer Needed
Vendor accounts can remain active long after a project ends unless the firm has a formal offboarding process. Old accounts may be forgotten even though they retain access to systems or information.
When a vendor relationship ends, the firm should consider whether accounts, integrations, API keys, remote-access tools, shared credentials, and permissions need to be revoked.
The firm should also confirm how its information will be returned or deleted.
Vendor Security Is an Ongoing Process
A provider that passed a cybersecurity review three years ago is not necessarily presenting the same risk today. Companies change ownership, infrastructure, subcontractors, privacy policies, AI features, and security practices.
Law firms should therefore consider periodic vendor reviews based on risk. Providers with extensive access to confidential information may warrant more frequent monitoring than low-risk services.
Review events can also be triggered by major changes, such as:
- A significant data breach
- A merger or acquisition
- A new AI feature
- A change in hosting providers
- A major contract revision
- Expanded access to law firm systems
- New categories of client information being processed
Monitoring does not require treating every vendor as a potential attacker. It means recognizing that cybersecurity conditions evolve throughout the life of a technology relationship.
What Happens When a Vendor Is Breached?
A third-party breach can create difficult questions because the affected information may be outside the firm’s infrastructure. The law firm still needs enough information to understand what occurred and what client data may have been affected.
The firm’s incident-response plan should therefore address vendor incidents rather than focusing exclusively on attacks against its own servers and devices.
Important questions may include:
- When did the vendor discover the incident?
- When did unauthorized access begin?
- Which systems were affected?
- What law firm information was involved?
- Was information accessed, copied, altered, or deleted?
- Which clients may be affected?
- Has unauthorized access been contained?
- What forensic investigation is underway?
- What notification obligations may apply?
Different laws, contracts, professional rules, and client requirements may impose different obligations after an incident. Firms should evaluate the particular circumstances rather than assuming every vendor breach requires the same response.
Create a Vendor Inventory
A law firm cannot effectively manage third-party risk if it does not know which vendors have access to its information and systems.
A basic vendor inventory can identify the provider, service, internal owner, type of information involved, access level, contract renewal date, security review status, and whether the provider uses critical subcontractors.
Firms can then classify vendors according to risk. A scheduling application with no confidential information may receive a different level of review from an e-discovery platform containing millions of client documents.
This approach helps firms concentrate cybersecurity resources where a breach would have the greatest impact.
Train Attorneys and Staff About Shadow IT
Formal vendor review processes can be undermined when employees independently sign up for online tools. An attorney might upload a document to a new AI service, file-conversion website, transcription platform, or cloud collaboration application without realizing that client information is leaving approved systems.
This practice is sometimes called shadow IT.
Law firms should make it easy for employees to determine which services are approved and how new tools can be evaluated. Policies that simply prohibit everything may encourage employees to work around them when approved alternatives do not meet practical needs.
Training should explain why vendor review matters, particularly when a service is free or can be activated with a few clicks.
A Practical Vendor Cybersecurity Checklist
Before giving a third party access to sensitive information or systems, law firms may consider the following steps:
- Identify the information and systems the vendor can access.
- Classify the provider according to cybersecurity risk.
- Review the vendor’s security practices.
- Evaluate confidentiality and privacy terms.
- Understand data-retention and deletion policies.
- Determine whether subcontractors will process information.
- Require appropriate authentication and access controls.
- Review incident-notification provisions.
- Limit vendor privileges to what is necessary.
- Document the firm’s due-diligence process.
- Periodically reassess high-risk providers.
- Remove access promptly when the relationship ends.
The ABA also maintains cybersecurity resources addressing vendor contracting and the importance of understanding suppliers that interact with sensitive law firm information. Its Cybersecurity Legal Task Force resources provide another starting point for firms developing vendor-management procedures.
Final Thoughts
Third-party technology has become essential to modern legal practice, but outsourcing a service does not outsource the associated cybersecurity risk. Cloud providers, AI platforms, e-discovery vendors, managed IT companies, and other technology partners may all become part of the environment in which confidential client information must be protected.
The goal is not to eliminate outside vendors. For most firms, that would be impractical and could even reduce security by replacing sophisticated professional platforms with poorly maintained internal alternatives. Instead, firms should understand who has access to their information, select providers carefully, negotiate appropriate protections, restrict unnecessary privileges, and monitor higher-risk relationships over time.
Law firms should also avoid treating vendor cybersecurity as a one-time purchasing exercise. Technology, contracts, threats, and data practices change. A documented vendor-management process can help a firm identify those changes before an outside provider becomes an unexpected weak point in the protection of client information.
