Best Practices for Protecting Client Information, According to the CFPB

New federal regulations promulgated by the Consumer Financial Protection Bureau will apply to real estate lawyers. But they are also a pretty solid starting point for any lawyer or law firm.

Here’s a summary of the best practices, compiled by Law Technology Today’s Pegeen Turner:

1. Create and implement a written Privacy and Information Security Policy which describes how Non-Public Information (read client data) is protected. This policy should include data stored on mobile devices.
2. Obtain an Information Security Risk Assessment to verify where data is stored, processed, transmitted and disposed—including external threats to data exposure.
3. Verify that your data security system is regularly tested and any issues resolved.
4. Create an Acceptable Use Policy that is annually reviewed, updated and verified by employees including use of the internet, email and company resources.
5. Confirm that data is only available to authorized users, including procedures for removing terminated employees. (Lock down your network and don’t give everyone access to all of the firm’s data unless they need it).
6. Create, test and implement complex password policies.
7. Create and implement a policy regarding removable media and restricted use of USB drives.
8. Provide encrypted email and encrypted hard drives.
9. Document intrusion detection and security alerts. If this has been outsourced, have external party provide reporting of detection and security.
10. Verify physical security to the office, server room and other data (offsite storage) is limited to authorized personnel.
11. Create and implement a Clean Desk Policy.
12. Create, implement and test a Disaster Recovery Plan.
13. Create and implement policies for hardware and software updates and modification.
14. Create, implement and test backup procedures to prevent data loss, including if this is done through a third-party backup company.
15. Require third-parties that have access to your data that they comply with all of the same security procedures.
16. Create and distribute a Privacy Policy to your clients.
17. Include a privacy statement on your website and describe how the data that is collected on your website is protected.
18. Create and implement a policy for record retention and destruction, including these same policies for third parties that retain and destroy firm data.

How close is your firm to following these best practices?

Featured image: “Hand holding pen and checklist on a clipboard” from Shutterstock.

Best Practices for Protecting Client Information, According to the CFPB was originally published on Lawyerist.