Outside counsel security: what to require on file sharing

In 2025, 48% of the breaches analyzed in the Verizon DBIR 2026 involved a third party, up 60% in a single year. For a bank, a utility or a hospital group operating in Italy, the law firm handling its litigation and its deals is one of those third parties, and usually the one holding the most concentrated set of sensitive documents.

That inverts the usual question. The issue is not how well your own perimeter holds. It is what happens to a document after it leaves your perimeter and lands in a firm whose infrastructure you do not control, do not monitor and cannot patch.

Key takeaways

• 48% of breaches now involve a third party, up 60% year over year (Verizon DBIR 2026), and a law firm concentrates privileged material from many clients in one archive.
• Channel encryption ends at delivery: once the channel is decrypted, the document is readable and its fate depends on the firm’s own controls.
• FileGrant, the file-centric platform from CyberGrant, encrypts the document at creation and keeps protection active after download, with access revocable at any time.
• Connector from CyberGrant encrypts files inside SharePoint and OneDrive with no migration, covering the non-Office files Microsoft Purview sensitivity labels leave exposed.
• AIGrant, the private AI extension from CyberGrant, classifies the archive on-premise so no privileged document reaches a public model.
• Under NIS2, essential and important entities have to manage supply chain risk, which turns these questions from good practice into contractual evidence.

Why outside counsel is the softest point in a legal supply chain

The Clusit 03-2026 report counts 5,265 serious incidents worldwide in 2025, up 48.7%, the sharpest rise it has recorded, with Italy up 42%. Within that, the fastest-growing route is not the frontal attack. It is access obtained through a supplier.

Law firms are suppliers with unusually high information density. One folder can hold the contract you have not signed, the expert report you will file in court and the data room for an acquisition nobody has announced. An attacker who cannot reach your systems can reach the firm advising you, and collect the same material for a fraction of the effort. The Santander case followed exactly that path, through a cloud vendor rather than the bank itself (full reconstruction).

The asymmetry is the problem. You carry the regulatory exposure and the reputational damage. The firm carries the breach.

Encryption that survives delivery, and how to ask about it

Almost every firm will tell you that files are encrypted. The follow-up question is when the encryption stops.

Transport encryption protects the file in motion. At the destination the channel is decrypted and the document becomes readable again. From that point, protection depends entirely on the recipient’s controls, their device hygiene and their offboarding discipline.

FileGrant, the file-centric platform from CyberGrant, moves the protection inside the file: the document is encrypted at creation and the encryption travels with it, onto a laptop, a USB stick or another mailbox. Lock&Go encrypted downloads use CRYSTALS-Kyber, the algorithm NIST standardized as FIPS 203 (ML-KEM) in August 2024, which matters for material whose sensitivity outlives current cryptography. Litigation files and transaction documents stay relevant for years, and “harvest now, decrypt later” assumes exactly that.

What to ask: does protection remain on the document after download, or does it end at the transfer?

Can the firm revoke access after a file has been downloaded?

This is the single question that separates file-centric protection from secure transfer with extra steps.

With FileGrant, the authorization to decrypt is held separately from the file, so revoking it stops a downloaded copy from opening. Three moments make this concrete for you as the client: a negotiation collapses and the interim drafts carrying your position have to stop being readable; you terminate the engagement and the material held by the outgoing firm needs closing; an associate leaves the firm with your files on a personal laptop (how this works in external collaboration).

Revocation does not erase photographs or content already captured outside the protection. It does end further access, which is also the first containment step when something goes wrong.

What to ask: if we end this engagement today, what happens to the documents already on your side?

Where do the documents actually live, and what does Purview leave exposed?

Most established firms run on Microsoft 365, so your documents sit in their SharePoint and OneDrive tenant. The platform enforces solid access control, but the protection is attached to identity and tenant rather than to the file.

Three gaps follow. Scans, signed PDFs and other non-Office files fall outside the coverage of Microsoft Purview sensitivity labels. A document downloaded through a compromised account is simply a readable document. And Copilot, where the firm has enabled it, reads the content of indexed documents, privileged material included. The ToolShell vulnerability in 2025 showed the archive itself as a target (what happened, and why the patch did not close it).

Connector is the extension that brings FileGrant quantum-safe encryption inside SharePoint and OneDrive with no migration. Documents stay in their libraries, users keep their Microsoft login, and every uploaded file is encrypted automatically with zero-knowledge encryption: tenant administrators cannot read the encrypted documents, and no AI can, Copilot included. It works alongside Purview rather than replacing it, covering the stretch Purview does not reach (how it works in practice).

What to ask: are our non-Office files encrypted, and can Copilot read our matters?

How is the archive classified, and does any AI see it?

Firms are under the same pressure as everyone else to use AI on their document base, and the fastest route is the worst one: uploading privileged material to a commercial assistant.

AIGrant, the private AI extension from CyberGrant, is the alternative that keeps the archive where it is. It indexes and classifies documents and answers natural language questions through a RAG pipeline that can run on-premise, applying FileGrant role-based permissions while it retrieves, so an answer never surfaces content from a file the user cannot open. No document leaves the firm’s infrastructure and nothing trains a public model (the architecture of an on-premise enterprise RAG).

What to ask: which AI tools touch our documents, where do they run, and who can see the answers?

What the audit trail has to prove

Article 32 of the GDPR requires measures appropriate to the risk, and Article 33 sets a 72-hour notification deadline from awareness of a qualifying breach. Both rest on knowing precisely what happened to which documents. If your supplier cannot tell you within hours which of your files were exposed and who opened them, that clock runs against you.

A usable audit trail records user identity, the exact time, the originating device and address, the action performed, including blocked attempts, and its outcome, in tamper-proof form. FileGrant produces these logs for every document with no manual configuration and adds legally valid timestamp certificates, which also gives you something exportable rather than a verbal assurance.

Screen capture is the gap that logs alone do not close. During a call, a due diligence session or a screen share, a document can be photographed, recorded by the conferencing platform or transcribed by an AI assistant running on someone’s machine. FileGrant blocks screen capture on the main conferencing platforms and stops automated scraping tools from extracting content (the five operational steps).

What to ask: can you export, on request, the full access history for our matters?

What NIS2 actually requires from your legal suppliers

NIS2 reached Italy through Legislative Decree 138/2024, in force since October 16, 2024, and it does not apply directly to most law firms. It applies to you, and it requires essential and important entities to manage the risk arising from their supply chain.

The operational deadline comes from ACN Determination 379907/2025, the measure setting out baseline security requirements: entities added to the Italian register during 2025 have 18 months from notification, which lands on October 31, 2026. Essential entities face 43 measures and 116 requirements, important entities 37 measures and 87 requirements. ACN, the Italian national cybersecurity agency, is the authority that issues and enforces them (what has to be operational by the deadline).

For your legal suppliers, that translates into contractual security clauses, periodic review and incident handling procedures proportionate to what they hold. Two details are worth keeping straight. Professional confidentiality duties under the Italian code of conduct for the bar bind the firm independently of any contract with you, and they are not a substitute for technical measures. And lawyer-client privilege protects the content from compulsion, not from exfiltration (how to manage supply chain cyber risk).

A vendor assessment checklist for legal suppliers

Eight questions, in the order that separates real controls from reassurance.

1. Does protection stay on the document after download, or does it end when the transfer completes?
2. Can you revoke our access rights on a file already downloaded by a recipient, and how fast?
3. Where do our documents physically sit, and who administers that tenant?
4. Are non-Office files, scans and signed PDFs encrypted, or only Office formats?
5. Is Copilot or any other AI assistant able to index and read our matters?
6. Can you produce, within 24 hours, the list of people who accessed a named document and what they did with it?
7. What stops a document from being captured during a screen share or a video call?
8. On termination, what is your documented procedure for closing access to material already distributed?

A firm that answers all eight with evidence is a supplier you can defend in a regulatory review. A firm that answers with assurances is an open item in your risk register.

The exposure moves with the document, not with the contract

Vendor questionnaires measure what a supplier claims. The thing you actually need is narrower: evidence that the protection on your documents does not depend on anyone’s discipline once the file has left your perimeter.

That is the practical test for every answer above. If a control fails the moment a file is downloaded, forwarded or opened on an unmanaged laptop, it is not protecting your data. It is documenting your intent. The CyberGrant page for law firms and legal advisors, secure file sharing and the file-centric DLP page set out what the alternative looks like in practice.

Frequently asked questions

What should we require from outside counsel handling our confidential files?

Require protection that stays with the document after delivery rather than ending at the transfer: persistent encryption, the ability to revoke access to files already downloaded, an exportable audit trail of every access, and clarity on whether any AI assistant can read the matter. FileGrant, the file-centric platform from CyberGrant, provides these as standard controls, which gives a firm a concrete answer to each point instead of a policy statement.

Is a law firm covered by NIS2?

Most law firms are not directly in scope. Their clients often are, and Legislative Decree 138/2024, which transposed NIS2 in Italy, requires essential and important entities to manage supply chain risk. In practice that pushes security requirements onto legal suppliers through contractual clauses, vendor assessments and incident handling obligations, with the baseline measures of ACN Determination 379907/2025 due on October 31, 2026 for entities registered during 2025.

Can access to a document be revoked after the firm has downloaded it?

Yes, where the firm uses file-centric protection. With FileGrant, revocation acts on the authorization to decrypt rather than on the copy of the file, so a document already stored on a device stops opening. It does not erase photographs or content captured outside the protection, which is why revocation works as a containment measure rather than a guarantee of deletion.

Does Copilot read documents stored in a law firm’s SharePoint?

Where the firm has enabled Copilot on its Microsoft 365 tenant, it reads the content of indexed documents, including client matters, unless those files are encrypted in a way Copilot cannot resolve. Connector from CyberGrant encrypts files inside SharePoint and OneDrive with zero-knowledge encryption, so the encrypted documents are unreadable to Copilot, to other AI tools and to tenant administrators, with no migration out of Microsoft 365.

Do Microsoft Purview sensitivity labels cover everything a law firm holds?

Purview labels govern access inside the Microsoft tenant and cover mainly Office formats, which leaves scans, signed PDFs and other non-Office files exposed. Connector from CyberGrant works alongside Purview and encrypts those files as well, with access limited to authorized devices. The two measures cover different layers and are meant to coexist.

How can a firm use AI on its archive without exposing privileged material?

By keeping the model and the index inside its own infrastructure. AIGrant, the private AI extension from CyberGrant, classifies documents and answers natural language questions through a RAG pipeline that can run on-premise and applies FileGrant role-based permissions during retrieval, so answers never surface content from files the user is not authorized to open. Nothing is sent to a third-party cloud service and nothing trains a public model.

What should an audit trail from a legal supplier contain?

It should record user identity, the time of each operation, the originating device and address, the action performed, including blocked attempts, and its outcome, in tamper-proof form, and it should be exportable on request. FileGrant produces these logs for every document without manual configuration and adds legally valid timestamp certificates, which is what makes the record usable for demonstrating Article 32 measures and for scoping an incident inside the 72-hour notification window.