What is an appropriate auditing standard for a law firm?

Question

I'm an IT Admin at a law firm. We handle sensitive customer data and some health records. I'd really like to have an outside consultant assess our data security practices, but I'm not sure what to ask for.

I realize that the real answer is "It depends based on which regulatory framework you fall under, HIPAA, SOX, PCI-DSS etc."

But my question is to the community, does there exist a general security standard that would be appropriate for a general office setting?

We don't specifically fall under any of the previously mentioned regulatory frameworks, but doing nothing isn't a good option either.

Answer 1

You'll want to look at the Data Protection Act (or its equivalent in your jurisdiction) as it lays out guidelines for the protection of sensitive personal data, which includes medical data. The wording in it, and in similar documents, is quite woolly - using phrases like "appropriate protection" - which isn't helpful, but basically it aims to push organisations into having to assess what they should do about this data.

Also the ISO27000 family are now a pretty useful set of industry standards. ISO27002 is appropriate to almost every organisation, so while you may not be in a position to have your organisation certified as 27002 compliant, you can use it as a key building block.

Check out the ISF, and specifically their Standard of Good Practice. To quote the ISF:

The Standard represents part of the ISF's information risk management suite of products and is based on a wealth of material, in-depth research, and the extensive knowledge and practical experience of ISF Members worldwide.

The Standard is updated at least every two years in order to:

respond to the needs of leading international organisations refine areas of best practice for information security reflect the most up-to-date thinking in information security remain aligned with other information security-related standards, such as ISO 27002 (17799), COBIT v4.1 and PCI/DSS • include information on the latest ‘hot topics’.

The other way to go about it is to get the partners in the law firm to assess their risk/liability/reputational damage if client records were damaged, lost or published. This can make it easier to get buy in to define your security requirements.

Answer 2

Both answers above are bang on the money, but I'd just like to add the following caveat. I run a regulatory services company and I got us certified to ISO 27001. The one thing I would communicate to anybody thinking of becoming certified is to remember that being certified to a standard is not like acquiring a magic talisman that wards off all evil (and lawsuits). Because these standards are not compulsory and the certification is voluntary, your protection in court against legal redress always boils down to due diligence.

In other words, if a magistrate thinks that you've given confidential information undue exposure then you are going to be screwed, regardless of whether you have ISO 27001 or not. However the point of certification, and this is really important to remember, is that to get it you must be totally methodological and careful and list all of your liabilities, and assess them, and address these with remedial actions. This means that at the end of the certification process your company is going to be a lot more vigilant and 'hardened' to borrow a sysadmin term.

I'm biased towards ISO 27001 as opposed to SOX etc. because it's generally accepted that the ISO covers the requirements for practically all the other standards. PCI has a few quirks, such as separation of processing facilities and other standards may be prescriptive about particular things, but you can still impliment these within an ISO framework, and you'll probably do a better job of it at the same time.

One final point that has also been mentioned tangentally already, is that a good risk-assessment based system will save you money. Before I started doing it, I wanted the most expensive firewall, the smartest card reader, the perfect multi-site failover and would sweat over specifications. But when you've done a proper risk assessment, you start to realise that actually you are never going to totally remove risk, so by the law of diminishing returns you are better off spending your money wisely than aiming for the ultimate protection. At the end of the day, one you're biggest vulnerabilities is your employees. So save your company money and organise some staff training sessions.

Answer 3

Expanding on the last little phrase from @Rory's answer, you might want to reconsider your approach - instead of searching for an appropriate regulation you can use, have your expert consultant do a business-risk-based, asset-focused security analysis.

That is to say, dont worry about generic standards, focus instead on what is important to your business - this could include stealing of sensitive client information, unavailability of records (which might prevent continuing billable hours), damage to reputation, and such. The review could then focus on these issues, and persuant to their value estimation, examine ways these are vulnerable to damage.

(Of course the security review should also identify any applicable regulations or laws, if there are any - this of course can be the biggest risk to the business.)

This would provide biggest bang (or lack thereof) for your security buck/quid.

Answer 4

We find that some of our Legal clients are moving towards ISO 27001. Because of this, we created a roadmap (or guide). Feel free to download it and use it for reference if you're considering the move in that direction.

ISO 27002 (formerly ISO 17799) is a "collection" of security controls (often referred to as best practices) that are often used as a "security standard".

ISO 27001 is an Information Security Management System (ISMS) - a logical and structured process by which a company can determine which security controls (largely from the ISO 27002 collection) it should put in place in order to keep information security risk to an acceptable level. This approach evolves ISO 27002 by defining a formal and audit-able process to determine which controls are relevant and the necessary extent/rigor for those controls.