This document summarizes a presentation on vendor risk management in complex matters. It discusses key considerations for vendor selection, including regulatory requirements, cybersecurity, and policies. It also addresses whether to bundle or unbundle legal services from other vendors. Ongoing vendor risk assessment is important and requires data sharing oversight and communication between in-house and outside counsel. Managing these risks is a hot topic for regulators given increases in data breaches and privacy laws.

1. Norton Rose Fulbright US LLP
Vendor Risk Management
in Complex Matters
Dan Jackson
Senior Associate, Norton Rose Fulbright US LLP
Ashley Senary Dahlberg
Senior Associate, Norton Rose Fulbright US LLP
Marissa Helm
Senior Counsel, Parallon

2. 1 – Vendor Selection
2 – To “Bundle” or Not to “Bundle”?
3 – Ongoing Vendor Risk Assessment

3. Vendor Selection

4. A Hot Topic for Regulators
4

5. • Consumer privacy laws (GDPR,
CCPA, Regulation S-P)
• Nearly half of firms suffer data loss
through dealings with vendors
• Opus Study: 59% vs. 16%
• NRF Litigation Trends Annual
Survey
Cybersecurity and Data Privacy
5

6. • Key considerations in the selection of vendors include:
–Enterprise expectations regarding vendor risk
–Regulatory requirements
–Cybersecurity
–Vendor’s policies and internal risk assessments
–Ability to monitor risks that cannot be eliminated
–Cost and contract terms
Selection Criteria
6

7. Internal risk
assessments
and security
checks
Written
policies for
safeguarding
confidential
information
A disaster
recovery
plan
Protocols
regarding
data
breaches
(and breach
attempts)
All vendors should have:
7
This includes law firms!

8. • Outside counsel guidelines
• Information security protocols
–Cybersecurity certifications
–CSI
• Alternative fee arrangements
• “Bundling” of legal services
“More than 100
law firms have
reported data
breaches” since
2014 (law.com).
Outside Counsel Management
8

9. To “Bundle” or Not to “Bundle”?

10. Unbundling
• Outside counsel retained for
specific legal advice
• Other vendors (and often ALSPs)
retained separately by client
Bundling
• Experts, consultants, web hosting,
etc. all under “one umbrella”
• Typically managed and billed as a
package, through outside counsel
Unbundling of Legal Services
10

11. Pre-selected panels Project management
approaches to legal operations
“Special” expertise
TAR, research, and outcome
prediction software
Cost ALSPs “AI” Solutions
Unbundling – Key Drivers
11

12. • Management burdens on in-house
counsel
• Strategic coordination between
providers
• Elusive cost savings
Challenges of Unbundling
12

13. 13

14. • Client-dependent
• Matter-dependent
• Trend may be slowing, as large law firms begin
to launch their own on-demand services to
compete with ALSPs
Unbundling: The Panel’s Verdict
14

15. Ongoing Vendor Risk Assessment

16. • Data and information sharing
• Oversight of fourth-party vendors (e.g.,
experts retained by outside counsel)
• Strong communication between in-house
and outside lawyers
Ongoing Risk
16

17. Questions?
17

18. Law around the world
nortonrosefulbright.com
Norton Rose Fulbright US LLP, Norton Rose Fulbright LLP, Norton Rose Fulbright Australia, Norton Rose Fulbright Canada LLP and Norton Rose Fulbright South Africa Inc are separate legal entities
and all of them are members of Norton Rose Fulbright Verein, a Swiss verein. Norton Rose Fulbright Verein helps coordinate the activities of the members but does not itself provide legal services to
clients.
References to ‘Norton Rose Fulbright’, ‘the law firm’ and ‘legal practice’ are to one or more of the Norton Rose Fulbright members or to one of their respective affiliates (together ‘Norton Rose
Fulbright entity/entities’). No individual who is a member, partner, shareholder, director, employee or consultant of, in or to any Norton Rose Fulbright entity (whether or not such individual is
described as a ‘partner’) accepts or assumes responsibility, or has any liability, to any person in respect of this communication. Any reference to a partner or director is to a member, employee or
consultant with equivalent standing and qualifications of the relevant Norton Rose Fulbright entity.
The purpose of this communication is to provide general information of a legal nature. It does not contain a full analysis of the law nor does it constitute an opinion of any Norton Rose Fulbright entity
on the points of law discussed. You must take specific legal advice on any particular matter which concerns you. If you require any advice or further information, please speak to your usual contact at
Norton Rose Fulbright.