SESSION OVERVIEW

Most established law firms already have cybersecurity policies, technology controls, onboarding and offboarding processes, backups, and vendor procedures. The harder question is whether those controls still work as intended after years of growth, exceptions, staff changes, new technology, client requirements, and accumulated operational decisions. This practical, scenario-based session will examine the gap between having a process, consistently following it, and being able to prove it works under pressure. Using situations legal administrators routinely encounter, the discussion will connect cybersecurity to the business consequences that matter most: client trust, productivity, leadership confidence, financial exposure, and the firm’s ability to keep operating when something goes wrong.

QUESTIONS WE’LL EXPLORE

• Do the right people have access - and can we explain why? We’ll look beyond basic onboarding and offboarding to accumulated permissions, role changes, special projects, shared workspaces, and whether access still reflects how people actually work today.

• Do we know where our stated security standards are not actually true? Temporary accommodations, legacy decisions, and informal workarounds can create a second set of rules that leadership may not realize exists.

• Can the firm adopt new technology quickly without losing control of its information? AI and cloud tools are moving faster than traditional approval processes. We’ll examine how firms can support useful innovation while keeping client and firm data appropriately governed.

• Could we defend the security claims we make to clients and insurers? We’ll explore the difference between having a policy, performing a control consistently and having evidence that demonstrates it.

• What failure has the firm actually designed itself to survive? Backups are only part of resilience. We’ll consider dependencies, recovery expectations, and what the firm can actually do when critical technology is unavailable longer than expected.

Specific scenarios and examples may evolve to reflect current technology, risks, and the issues most relevant to the audience.

LEARNING OBJECTIVES

• Identify operational and governance gaps that can exist even when established cybersecurity policies and controls are already in place.

• Evaluate whether key security processes involving access, exceptions, technology adoption, external requirements, and business continuity are defined, consistently performed, and demonstrable.

• Apply practical management questions to identify where assumptions, accumulated decisions, or untested processes may create meaningful business risk for the firm.

FORMAT & PARTICIPANT TAKEAWAY

The session will use realistic law firm scenarios and audience discussion rather than a technical walkthrough or security-product presentation. Attendees will receive a practical Law Firm Cyber Risk Checkup to help distinguish between controls that are defined and verified; informal or assumed; or unknown or inconsistent. The goal is to leave participants with a small number of meaningful questions they can take back to leadership, internal teams, and technology partners.

Speaker: Graham Roggli, Client Strategy Manager, Xantrion

Graham Roggli is a strategic IT Advisor at Xantrion, where he helps law firms identify and address the operational risks that can emerge as technology, teams, and business requirements evolve.

His work focuses on helping organizations move beyond simply having cybersecurity policies and processes to understanding whether those controls are consistently followed, effective, and defensible. Graham works with business and operational leaders to uncover gaps involving user access, technology adoption, security exceptions, vendor or client requirements, and business continuity, areas where everyday decisions and workarounds can quietly create meaningful risk.

Drawing on practical scenarios rather than technical theory, Graham helps leaders ask better questions about how their organizations actually operate and where assumptions or untested processes could affect risk, client trust, and resilience.

REGISTER NOW

The Golden Gate Chapter of the Association of Legal Administrators is an approved CLM provider. 
This session satisfies the required educational criteria in the following areas:

CLM® Recertification Credit:  1 hour in the subject area of Operations Management (OM).
CLM^® Application Credit for Functional Specialists: 1 hour in the subject area of Operations Management (OM) toward the additional hours required 
of some Functional Specialists to fulfill the CLM application requirements. 
CLM^® Application Credit: 1 hour in the category of Information Technology (IT).