Legal

Map where client material is stored and exchanged, including document systems, email, data rooms, discovery platforms, and local working copies. Give each matter an accountable owner and apply access appropriate to the team, external counsel, experts, and contractual confidentiality requirements.

Use Librarian to organize repositories and Cerberus within approved data-protection workflows. Review external links and large exports, but distinguish legitimate litigation activity from suspicious access before acting. Monitoring records can themselves contain sensitive information, so limit collection and access accordingly.

• Expire external access when engagements or expert assignments end.
• Review ethical walls and special client restrictions when teams change.

Before introducing a research assistant, transcription service, drafting tool, or client portal, determine what information it receives and how that information is retained and used. Include subprocessors, support access, training-related terms, and deletion capabilities in the review.

Spark can support privacy and AI-governance work, while Hunter can assist with authorized application assessment. Do not infer that a tool is appropriate for privileged material merely because it is marketed to lawyers. Firm leadership and responsible counsel should approve use cases and establish rules for reviewing outputs before they inform advice or filings.

• Use approved tools and accounts for client work.
• Verify citations and substantive outputs independently before reliance.

Develop a response plan addressing client communications, preservation, conflicts, insurers, outside specialists, and operational continuity. Payment instructions deserve independent verification, particularly for settlements, trust-account activity, and closing transactions. Never accept an email change alone as authorization to move funds.

Plutus can support payment-review workflows, Growler can assist with evidence handling, and Dewey can help coordinate recovery. Human owners must approve consequential actions, client notices, and external submissions. Counsel should assess privilege, confidentiality, and notification duties for the specific incident rather than relying on a generic legal-sector checklist.

• Test restoration of an active matter and its access restrictions.
• Preserve decision records while limiting unnecessary circulation of sensitive findings.