Every account in the firm is a door. This article is about who has a key, what each key opens and how a firm keeps that list true as people arrive, change roles and leave.
Our article on client portals covers how clients reach the firm. This one is about the firm's own staff and vendors.
The problem
A small firm grows by adding people and tools. Nobody removes the access of the intern who left, the temp who covered a leave or the vendor who finished a project.
A shared login saves a few minutes and costs the firm the ability to say who opened a file.
What is known
We found no independent figure on how access problems affect law firms that we could verify, so we give none.
The idea that security guidance repeats is called least privilege: each person, and each program, gets only the access the work needs. It is a way of limiting the damage of a mistake or a stolen password, and it also makes departures simpler.
Whether a particular matter needs to be walled off from some staff is a question for your attorney, not for this article.
What to do
- Give every person a named account and end shared logins, including the one at the front desk
- Define a few roles, such as attorney, paralegal, assistant, billing and administrator, and say what each role can open
- Keep administrator rights for the few people who need them, and use a separate account for administration, not for daily work
- Write an arrival and departure checklist, and run it every time: accounts, devices, email forwarding, shared links, phone access and keys
- Remove a departing person's access on their last day, or earlier when the departure is not friendly
- Give temporary staff, outside consultants and vendors accounts that end on a date, and record who approved them
- Review the list of accounts and roles at set times, and ask each team lead to confirm who still needs what
When to keep it simple
- The firm is very small and everyone works on everything, so a handful of roles is enough
- The tool cannot set permissions below the whole account, so extra rules would only create work-arounds
- Nobody has time to review the list, in which case the checklist for departures matters more than detailed roles
What to look for when you implement it
- Whether each system can show who has an account, which role they hold and when they last signed in
- Whether the provider keeps a log of who opened or changed a file, and how long the log is kept
- Whether links shared outside the firm can expire and can be turned off
- Whether a departing person's mail, files and matters have a named person to take them over
- Whether vendors use their own named accounts rather than a login of someone at the firm
- Test a departure with a spare account before you need it