Litigation Powerhouse Shook, Hardy, & Bacon

Securing Client Data with ISO 27001

Shook, Hardy & Bacon’s information governance committee wanted to have a framework and methodology in place to guarantee it was following best practices for information security throughout the firm. It also wanted to have third-party verification that proved its efforts to outside parties.

In 2013, one of the trends the committee had been eyeing was the ISO 27001 certification, which, according to Anderson, was a relatively new certification to have in the legal industry.

To get started, the firm worked with an independent security consultant to create a roadmap for the ISO 27001 certification. The security consultant then recommended the firm use Schellman & Company for its audit.

“Shook, Hardy & Bacon saw this as an opportunity for them to broadcast that it takes information security very seriously,” said Ryan Mackie, ISO Certification Practice Director at Schellman & Company.

In 2014, the Schellman & Company team came to Shook, Hardy, & Bacon’s Kansas City headquarters to conduct the first audit and returned a month later to conduct the final audit.

How Law Firms Benefit From an ISO 27001

Among the first U.S.-based law firms to receive an ISO 27001 certification, Shook, Hardy & Bacon has used it as a competitive advantage and has also been able to create an internal culture of information security.

“Everyone knows their responsibilities and obligations, and we conduct annual training and ongoing awareness to reinforce it,” Anderson said of the firm’s culture of information security. “Many of our clients tell us they appreciate our approach toward information security, and that our ISO 27001 certification is proof of our commitment.” 

Anderson continued: “We always had an information security awareness program that let everyone know what their responsibilities and obligations were, but after we developed the additional policies and procedures that are required for ISO 27001 certification, we were able to require everyone in the firm to read and acknowledge those policies. We also conduct annual training to reinforce the policies and obligations.” Shook, Hardy & Bacon’s commitment to information security is allowing the firm to blaze new trails in the legal industry, according to Mackie.

“They’re considered a trailblazer and we definitely applaud them,” said Mackie. “It’s a big effort for any organization to undertake, specifically one like a law firm, not to mention a law firm that didn’t have necessarily a direct customer requirement. It was a great experience because they see the value of compliance.”

Thanks to Schellman’s professionalism, Anderson sees the two companies continuing to work together. “They clearly understand security and were always prepared,” said Anderson. “They always treated us very respectfully, and we enjoyed working with them and look forward to working with them in the future.” Given the massive amounts of data law firms handle today, it’s only a matter of time before ISO 27001 will become commonplace in the legal industry, according to Mackie.