The one deposition you never want to sit for
You've spent a career making witnesses answer for what they didn't check. A breach at your firm puts you in that chair, in front of your client, your carrier, and the bar. Overwatch Technology is the IT and security team for trial firms that can't afford a bad answer.
One call, then a written findings memo. Yours to keep either way.
Exhibit A
You build chronologies for a living. Here's the one that gets built about your firm. Nothing in it is exotic. It's the same sequence at firm after firm, and it starts weeks before anyone notices.
A paralegal enters credentials on a convincing sign-in page reached from a docketing email. No malware. Nothing to detect.
A quiet mailbox rule is created: anything containing “wire,” “settlement,” or “trust” is moved to a folder nobody opens.
The intruder reads. They learn the case, the defense carrier, the adjuster's name, how your firm writes emails, and roughly when the money lands.
Settlement is reached. The intruder is on the thread before you are.
A message that reads exactly like your firm sends updated account instructions. It arrives from a domain one character off, or from your own mailbox.
The funds are wired, converted, and gone, usually within hours and often overseas.
The client calls to ask where the money is.
Now: notification obligations, a claim on your malpractice policy, a trust-account problem, a client who will never be made whole by an apology, and a story that reaches every referring lawyer you have.
Already on you
The professional rules got here before the vendors did. Every one of these duties assumes someone at the firm is actually managing the technology.
Confidentiality
The duty of confidentiality reaches unauthorized access to client information, not just deliberate disclosure. “Reasonable efforts” is measured against what's available and affordable, and it moves every year.
Competence
Competence includes understanding the benefits and risks of the technology your practice runs on. You don't have to administer it. You do have to be able to answer for it.
Client property
Funds held for clients carry the strictest obligations in the rules. A wire diverted out of a settlement is a client-property problem long before it's an IT problem.
Supervision & response
Outside providers are nonlawyer assistance, and you're responsible for how they handle client information. After an incident, the duty runs toward investigating and notifying affected clients, not toward quietly moving on.
General description of duties under the professional conduct rules. Not legal advice; you know your jurisdiction better than we do.
Scope of engagement
Built around how litigation actually works: intake that never sleeps, discovery volumes that never shrink, and trial weeks where nothing is allowed to break.
Close the path in Exhibit A, the single highest-dollar risk your firm carries.
Case files, medical records, deposition video, and expert work product: controlled, logged, and retrievable.
Phones answered after hours only help if the phones work.
The documentation that supports your malpractice and cyber coverage, and answers the questions after an incident.
Self-assessment
Answer them the way you'd have to answer them under oath. Nothing is sent anywhere.
Does every mailbox at the firm require multi-factor authentication, including the partners'?
Do you have a written rule that account or wire instructions are verified by voice, at a number you already had on file?
Would anyone be alerted if a hidden mailbox rule were created in a staff account tonight?
Has someone actually restored a backup of your case management system in the last 90 days, not just seen the job report green?
Can you produce a log showing who opened a specific client file, and when?
Does the firm have a written incident response plan that names who calls the carrier, the clients, and counsel?
When a paralegal or contract attorney leaves, is access removed the same day, everywhere, including file-sharing and phone?
If systems went down on the Sunday before a trial, do you know who you'd call and how fast they'd answer?
Answer above and this line will tell you how the examination went.
Get the findings memoStraight answers
Multi-factor authentication adds a few seconds a day, and verifying wire instructions by phone adds a few minutes a settlement. Everything else should be invisible. If a control creates real friction for the people billing hours or trying cases, we redesign it rather than lecture you about it.
Good. We'd rather work alongside them than replace them. What one person can't provide is continuous security monitoring, incident response at 2 a.m., and the written program your carrier wants to see. That's the part we own.
Yes, and you should require one. Under the rules, outside providers handling client information are your responsibility. We're used to being treated that way: engagement terms, confidentiality obligations, and named personnel included.
A scoping conversation, a review of your environment, and a written findings memo: what we found, which duty or exposure it touches, and what remediation costs, ranked with the cheap fixes first. The memo is yours whether or not you engage us.
We schedule around your calendar. Nothing changes during a trial except our response time getting shorter. Tell us the dates and we'll treat them like a court deadline, because they are one.
Tell us how many people you have, what case management system you run, and how many offices you're covering. We'll tell you what's exposed, in writing, in about a week.
Request a Free Assessment