Cloud practice-management and document platforms such as Clio, NetDocuments and iManage Cloud have changed how firms operate, and many firms are weighing a move from on-premise servers. Done well, a migration can reduce the infrastructure a small firm must maintain and make remote work easier. Done carelessly, it can simply relocate risk.
This checklist covers questions worth answering before you sign and configure anything. Vendor names are examples of categories, and nothing here is an endorsement of a particular product.
Before you choose a platform
Ask about the vendor's security posture
- Do they publish a security overview or whitepaper?
- Do they provide an independent attestation report, such as a SOC 2 report, under a nondisclosure agreement?
- How is data encrypted in transit and at rest?
- Where is data stored geographically, and do you have any say?
- What are their backup and disaster recovery practices and uptime commitments?
- How do they notify customers of a security incident?
Ask about your data
- Who owns the data? The answer should be you.
- Can you export all of it, including documents, metadata, time entries and notes, in a usable format?
- What happens to your data if you cancel? How long is it retained, and how is deletion confirmed?
Rule 1.6(c) asks lawyers to make reasonable efforts to prevent unauthorized disclosure of client information, and the ABA has discussed cloud services in several opinions, generally emphasizing reasonable diligence. Confirm expectations with your state bar.
Configuration: where most problems arise
Cloud platforms are usually secure by design but are configured by the customer. Many incidents involve settings, not the vendor's infrastructure.
- Single sign-on and MFA. Require MFA for every user, and preferably connect the platform to your identity provider so you disable one account in one place when someone leaves.
- Role-based permissions. Assign access by role and matter. Avoid giving everyone administrator rights for convenience.
- Ethical walls. Test that screening restrictions actually prevent access.
- Sharing controls. Limit external sharing links, require passwords or expiration, and review who has shared what.
- Audit logging. Turn it on and decide who reviews it.
- Mobile access. Require device lock and the ability to remove data from lost phones.
- Integrations. Review each connected app. Third-party integrations can access client data, so approve them deliberately.
Migration planning
- Clean up first. Archive or delete data according to your retention policy rather than moving years of clutter.
- Map the folder structure and permissions in advance.
- Run a pilot with one practice group.
- Keep the old system, read-only, until you verify the migrated data is complete.
- Protect data in transit during migration and handle any temporary copies carefully.
- Schedule cutover away from major deadlines.
Do not forget backups
Cloud vendors protect against infrastructure failure, but they may not protect against accidental deletion by your own users, a compromised account or malicious activity. Ask whether the platform's retention features are sufficient, and consider an independent backup of critical data.
Train the users
A well-configured system still depends on people. Teach attorneys and staff how to share documents securely, how to recognize phishing aimed at the platform's sign-in page, and what to do when they receive an unexpected notification.
Costs worth budgeting
- Subscription fees per user
- Migration labor, which is often underestimated
- Training time
- Parallel running of old and new systems for a period
- Integration or customization work
Helpful decision test
Ask yourself: if this vendor disappeared tomorrow, could we get our data and keep working? If the answer is unclear, resolve it before migrating.
How Counsel Cyber helps
We help firms evaluate platforms, plan migrations and configure Clio, NetDocuments, iManage and Microsoft 365 securely. Ask for a pre-migration review, and we will go through this checklist with your team.