What Should a Law Firm Require From Its MSSP When Lateral Hires Join and Leave?

Require four things: a same-day way to turn an ethical screen into real access restrictions, individual accounts instead of shared logins, access logs that can support a certification to a former client, and a leaver process that revokes access when a lawyer departs. Whether a screen is needed, and whether it is enough, is a decision for the firm's ethics counsel. Making the screen hold in your systems is where an MSSP's work begins.

When a lawyer joins from another firm, the conflicts team asks whether the lawyer's prior work conflicts with the new firm's clients. When that answer is yes, the firm may be able to avoid imputing the conflict to everyone else by screening the lawyer, but only if the screen actually works. Under ABA Model Rule 1.10(a)(2), the lawyer must be timely screened from any participation in the matter and apportioned no part of the fee, the former client must get written notice, and the screened lawyer and a partner must provide certifications of compliance at reasonable intervals upon the former client's written request and upon termination of the screening procedures.

That last obligation turns a conflicts question into an evidence question. If a former client asks you to certify the screen, someone has to be able to show who could open the files. This guide covers what a law firm should require from its managed security provider so that the answer is available.

What the rules say a screen must do

The ABA's comment to Rule 1.0 describes the purpose of screening as assuring the affected parties that confidential information known to the personally disqualified lawyer remains protected. It lists measures that may be appropriate, including a written undertaking by the screened lawyer, notice to other firm personnel, denial of access by the screened lawyer to firm files or other information, including information in electronic form, relating to the matter, and periodic reminders. The same comment says screening measures must be implemented as soon as practical after the firm knows or reasonably should know that screening is needed.

Two points matter for the security team. First, "information in electronic form" means document management, email, chat, shared drives, and backups, not just a locked filing cabinet. Second, the clock starts when the need becomes apparent, which can be before the new lawyer's first day. Rules differ by jurisdiction. New York's Rule 1.10(c) took effect in 2025, and the City Bar's Formal Opinion 2026-1 notes that a screen will not prevent imputation in certain litigation matters where the lateral attorney substantially participated. Firms in other states should check local rules with ethics counsel before assuming a screen is available at all.

Why an MSSP is part of this

Model Rule 1.6(c) requires a lawyer to make reasonable efforts to prevent unauthorized access to information relating to the representation of a client. The comment lists factors for judging reasonableness, including the sensitivity of the information, the likelihood of disclosure if additional safeguards are not employed, and the cost and difficulty of the safeguards. A screen that exists only in a memo is a thin safeguard when the screened lawyer's account still has read access to the matter workspace. Your managed provider usually controls or watches the systems where that access is granted, so its processes and logs determine whether the firm can prove the screen held.

Five requirements to put in the contract or runbook

1. A defined trigger and turnaround. Name who tells the provider (typically general counsel or the conflicts partner), by what channel, and how quickly the restriction must be in place. Because the rule asks for a timely screen, write your target in hours, not "promptly," and ask the provider to commit to it.
2. Matter-level access restrictions that cover every copy. Restricting the document management workspace is the obvious step. Also confirm email, chat channels, shared drives, search indexes, backup restore points, and any assistant or search feature that indexes matter content. Ask how the provider tests that the screened account is actually denied, and keep the test result.
3. Individual accounts only. Shared logins defeat attribution and defeat screens. NIST SP 800-53 Rev. 5 control AC-2 calls for a process to change shared or group account authenticators when individuals are removed from the group, and the control's discussion says this is intended to ensure former group members do not retain access (NIST SP 800-53 Rev. 5). Inventory shared credentials for e-filing portals, legal research subscriptions, and client portals, then assign individual access or rotate credentials on every move.
4. Monitoring and retained evidence. Ask the provider to alert on attempted access to a screened matter by the screened lawyer and to retain the relevant logs for at least as long as the screen lasts. A former client can request certifications at reasonable intervals and on termination of the screen, so the logs should outlast the screen itself. Agree in advance how fast the provider can produce an access report for a given matter and date range.
5. A leaver process tied to HR and ethics. AC-2 also calls for aligning account management with personnel termination and transfer processes (NIST). For departing lawyers, define when accounts, mobile devices, and sessions are revoked, who approves any file transfer to the new firm, and how matter access is reviewed afterward.

What to ask a provider before you sign

• How quickly can you apply and verify a matter-level restriction after we notify you, and who on your team does it?
• How do you prove a restriction works, and can you give us the test record?
• Can you report every access attempt to a named matter by a named user over a date range, and how long do you retain that data?
• How do you find shared or generic accounts in our environment, and what is the process to rotate them on a personnel change?
• What is the contractual window to notify us if a screened account touches a restricted matter?

Providers that cannot answer these questions concretely are showing you the limits of their service. For a broader review framework, see our MSSP shortlist questions, and for the wider set of bar and client expectations, our guide to law firm cybersecurity requirements.

What the provider cannot decide for you

The screen itself is an ethics and risk decision. Counsel decides whether a conflict exists, whether screening is permitted, what notice to give, and who signs certifications. The provider's job is to implement the restrictions you specify, monitor them, and hand over evidence. Keep that division explicit in writing so nobody assumes the technology team already approved the screen, or that the provider already knows a screen exists.

Where managed security fits

For a firm that does not run a 24/7 monitoring function, a provider can supply the alerting, log retention, and reporting these requirements depend on. Cyberuptive's legal sector security practice and managed detection and response service are starting points, and the legal security assessment can help you see where access, logging, and shared credentials stand today.

Frequently asked questions about lateral hires and law firm security

What is an ethical screen in a law firm?

An ethical screen isolates a lawyer from any participation in a matter, using procedures that are reasonably adequate to protect information the lawyer is obligated to protect. Under ABA Model Rule 1.10(a)(2), a timely screen, no share of the fee, notice to the former client, and certifications of compliance can avoid imputing a lateral lawyer's conflict to the whole firm, where the jurisdiction permits it.

Does an ethical screen need technical access controls?

In practice, yes. The ABA's comment to Rule 1.0 lists denial of access by the screened lawyer to firm files and other information, including information in electronic form, as an appropriate measure. A written undertaking without enforced access restrictions is a weak safeguard.

Who is responsible for deciding whether a screen is needed?

The firm's ethics counsel or conflicts partner decides whether a conflict exists, whether screening is permitted in that jurisdiction, and what notice and certifications are required. The managed security provider implements and evidences the technical restrictions the firm specifies.

Why do shared logins matter for lateral hires and departures?

Shared credentials make access hard to attribute and can survive personnel changes. NIST SP 800-53 Rev. 5 control AC-2 calls for changing shared or group account authenticators when individuals leave the group, so former members do not retain access. Replace shared logins with individual accounts where possible and rotate the rest on every move.

How long should a firm keep logs that support a screen?

At least as long as the screen lasts. Rule 1.10(a)(2) allows the former client to request certifications at reasonable intervals and upon termination of the screening procedures, so the evidence should still be available at termination. Set the exact period with ethics counsel and your provider.

What should happen to a departing lawyer's access?

Align account revocation with the firm's personnel termination and transfer process, as NIST AC-2 recommends. Define when accounts, devices, and sessions are revoked, who approves any file transfer to the lawyer's new firm, and how matter access is reviewed afterward.