Law firms

Outside counsel guidelines, the client security questionnaire, and the ethics opinions behind both. We know the paper each one arrives on.

What arrives

The OCGs: Client outside counsel guidelines. Contractual, not regulatory, and carrying the data security, audit, notification and indemnity terms the client's own vendors were given.
The questionnaire, or the client audit: The client vendor-security questionnaire, and in some engagements an on-site security audit of the firm.
477R and 483: ABA Formal Opinion 477R on securing client communications, and Formal Opinion 483 on the duties owed after a breach.
Rule 1.6(c): ABA Model Rule 1.6(c). Reasonable efforts to prevent unauthorized disclosure of information relating to a client.