Litigation firm, five states.
✲ Every finding in a client’s security review closed in 12 weeks.
✲ The situation
A litigation firm with offices in five states gets a steady stream of work from an insurance carrier. In April, the carrier’s third-party risk team reviewed the firm’s security and asked for a documented action plan with remediation dates, noting that time was of the essence. The firm’s own plan had data loss prevention scheduled for 2027.
✲ Key issues we uncovered.
- Dedicated Engineering Pod
- Onboarding & Environment Discovery
- Monitoring, Hardening & Response
- Compliance & Audit Support
- Backup & Disaster Recovery
No data classification policy.
Problem 01
Problem 01
Problem 01
Problem 01
Problem 01
Problem 01
Problem 01
Problem 01
Problem 01
No data retention policy: no process for legal holds, destruction or certification.
Problem 02
Problem 02
Problem 02
Problem 02
Problem 02
Problem 02
Problem 02
Problem 02
Problem 02
A privacy policy that existed, but didn’t connect to classification or retention.
Problem 03
Problem 03
Problem 03
Problem 03
Problem 03
Problem 03
Problem 03
Problem 03
Problem 03
Nothing scanning outgoing email and attachments for client data, or blocking it.
Problem 04
Problem 04
Problem 04
Problem 04
Problem 04
Problem 04
Problem 04
Problem 04
Problem 04
✲ A clear plan. Step by step.
01.
A 60-day remediation plan with a target date for every item, sent the day after the request.
02.
Classification, retention and privacy policies written and delivered in five weeks. Four classification tiers: Public, Internal, Confidential, Restricted.
03.
Data loss prevention switched on in NetDocuments and Microsoft 365, run in audit mode first, then enforced.
04.
When off-the-shelf tools couldn’t classify documents in time, a classifier built on a private AI model with the firm’s NetDocuments consulting partner, and run against the carrier’s matters first.
05.
Training scheduled for roughly 75 users.
✲ What happened
The carrier accepted the three policies in week five. The data loss prevention, retention and privacy findings closed in week seven, and the last finding closed in week 12. The classifier processed 1,037 documents in its first full run and flagged 52 for a person to review, at about 6,000 files an hour for roughly two dollars.
Findings closed
4 of 4
Review passed
12 weeks
With DLP enforced
2 platforms
Related service
✲ Governance, Risk & Compliance.
A short conversation tells you more than a brochure. We'll ask what's working, what isn't, and where you feel exposed — and tell you straight whether we're the right fit.