Certified Legal Manager (CLM) Technology Management Syllabus

What is the NIST Cybersecurity Framework, and name its five core functions.

A voluntary risk-based framework from the U.S. National Institute of Standards and Technology. Five core functions: Identify, Protect, Detect, Respond, and Recover. (NIST CSF 2.0 adds 'Govern.')

What is the difference between authentication and authorization?

Authentication verifies who a user is (e.g., password, biometrics); authorization determines what an authenticated user is permitted to access or do (permissions/privileges).

What is multi-factor authentication (MFA) and what categories of factors does it combine?

MFA requires two or more independent credentials from different categories: something you know (password), something you have (token/phone), and something you are (biometric).

Define 'defense in depth' as a security strategy.

Defense in depth layers multiple, redundant security controls (physical, technical, administrative) so that if one control fails, others continue to protect assets.

What is the principle of least privilege?

Users, accounts, and processes should be granted only the minimum access rights necessary to perform their functions, reducing the attack surface and limiting damage from compromise.

What is the difference between symmetric and asymmetric encryption?

Symmetric encryption uses a single shared key for both encryption and decryption (fast); asymmetric encryption uses a public/private key pair (one encrypts, the other decrypts), enabling secure key exchange and digital signatures.

What is the difference between data 'at rest' and data 'in transit,' and how is each typically protected?

Data at rest is stored data (on disks/servers), protected by storage/full-disk encryption; data in transit is data moving across networks, protected by transport encryption such as TLS/SSL or VPNs.

What is phishing, and how does spear phishing differ from it?

Phishing is a fraudulent attempt (usually email) to trick recipients into revealing credentials or installing malware. Spear phishing is a targeted version aimed at a specific individual or firm, using personalized details to appear legitimate.

What is ransomware and what is the recommended primary defense against data loss from it?

Ransomware is malware that encrypts a victim's data and demands payment for the decryption key. The primary defense for recovery is maintaining tested, isolated (offline/immutable) backups.

What are the four phases of the NIST incident response lifecycle?

1) Preparation; 2) Detection and Analysis; 3) Containment, Eradication, and Recovery; 4) Post-Incident Activity (lessons learned).

What is an Incident Response Plan (IRP) and why must a law firm have one?

An IRP is a documented, structured set of procedures for detecting, responding to, and recovering from security incidents. It enables a fast, coordinated response that limits damage, meets breach-notification duties, and preserves client confidentiality.

In incident response, what is the difference between containment, eradication, and recovery?

Containment limits the spread/impact of an incident (isolating systems); eradication removes the threat (malware, compromised accounts) from the environment; recovery restores systems to normal, validated operation.

What is the difference between RTO and RPO in disaster recovery planning?

RTO (Recovery Time Objective) is the maximum acceptable time to restore a system after disruption; RPO (Recovery Point Objective) is the maximum acceptable amount of data loss measured in time (how far back the last usable backup must be).

What is a Business Continuity Plan (BCP) and how does it differ from a Disaster Recovery (DR) plan?

A BCP is the broad strategy to keep essential business functions running during/after a disruption; a DR plan is a subset focused specifically on restoring IT systems, data, and infrastructure.

What is a tabletop exercise in the context of incident response?

A discussion-based, scenario-driven simulation in which key stakeholders walk through their roles and decisions during a hypothetical incident to test and improve the response plan without affecting live systems.

Who should typically be members of a law firm's incident response team (IRT)?

IT/security staff, firm management, in-house or outside counsel (privacy/breach), HR, communications/PR, and often external forensics and cyber-insurance contacts.

What does GDPR stand for, and to whom does it apply?

General Data Protection Regulation (EU). It applies to any organization processing the personal data of individuals in the EU/EEA, regardless of where the organization is located.

What does the CCPA/CPRA give California consumers, and who must comply?

The California Consumer Privacy Act (as amended by CPRA) grants rights to know, delete, correct, and opt out of the sale/sharing of personal information. It applies to for-profit businesses meeting revenue/data-volume thresholds doing business in California.

What is the difference between PII and PHI?

PII (Personally Identifiable Information) is any data that can identify an individual (name, SSN, etc.); PHI (Protected Health Information) is health-related PII regulated under HIPAA.

What is HIPAA, and when must a law firm comply with it?

HIPAA (Health Insurance Portability and Accountability Act) protects health information. A firm must comply when it acts as a 'business associate'—handling PHI on behalf of a covered entity client—typically under a Business Associate Agreement (BAA).

What is the difference between a data controller and a data processor under privacy law?

A data controller determines the purposes and means of processing personal data; a data processor processes data on behalf of, and under the instructions of, the controller.

What is a data breach notification requirement, and why is it critical for firms?

It is a legal obligation to notify affected individuals (and often regulators) within a defined timeframe after a breach of personal data. Firms must comply to avoid penalties and meet ethical/contractual duties; e.g., GDPR requires regulator notice within 72 hours.

What is data minimization as a privacy principle?

Collecting and retaining only the personal data that is adequate, relevant, and necessary for the stated purpose, and disposing of it when no longer needed.

What is the difference between a RFI, RFP, and RFQ in technology procurement?

RFI (Request for Information) gathers general vendor/market information; RFP (Request for Proposal) solicits detailed solution proposals and pricing for a defined need; RFQ (Request for Quote) seeks specific price quotes for clearly specified products/services.

What is a Service Level Agreement (SLA), and name two metrics it commonly defines.

An SLA is a contract clause defining the service standards a vendor must meet. Common metrics: uptime/availability percentage (e.g., 99.9%) and response/resolution time for support requests.

What is Total Cost of Ownership (TCO) in technology procurement?

TCO is the complete cost of an asset over its lifecycle—not just purchase price, but implementation, training, maintenance, support, upgrades, and disposal—used to compare options realistically.

What is the difference between perpetual licensing and SaaS subscription licensing?

A perpetual license is a one-time purchase granting indefinite use of a specific software version (a capital expense); SaaS subscription licensing is a recurring fee for ongoing access to cloud-hosted software with updates included (an operating expense).

What is vendor due diligence, and why is it important when procuring cloud/legal technology?

It is the evaluation of a vendor's security, financial stability, compliance, data-handling, and reliability before contracting. It is important to protect client confidentiality, ensure data security, and meet the firm's ethical and regulatory duties.

What is the ROI formula used to justify a technology investment?

ROI = (Net Benefit / Cost of Investment) x 100, where Net Benefit = total gains (savings/revenue) minus the investment cost. A positive ROI indicates the gains exceed the cost.

In change management, what does the ADKAR model stand for?

Awareness (of the need to change), Desire (to support the change), Knowledge (of how to change), Ability (to implement it), and Reinforcement (to sustain it).

What is the difference between a phased rollout, a pilot, and a 'big bang' implementation?

A pilot deploys to a small test group first; a phased rollout introduces the system in stages (by group/module/location); a big bang switches all users to the new system at once on a single cutover date.

What is User Acceptance Testing (UAT) and at what stage of implementation does it occur?

UAT is testing by end users to verify the system meets business requirements and works in real-world scenarios. It occurs near the end of implementation, before go-live/production deployment.

What is the role of a change advisory board (CAB) in IT change management?

The CAB reviews, assesses risk of, prioritizes, and approves or rejects proposed changes to IT systems to minimize disruption and ensure changes are properly evaluated before implementation.

Why is end-user training considered critical to a successful technology implementation?

Even well-chosen technology fails to deliver value if users can't or won't use it. Training drives adoption, reduces resistance and errors, maximizes ROI, and improves productivity and data quality.

What is data migration in a software implementation, and name one key risk.

Data migration is transferring existing data from a legacy system into the new system. A key risk is data loss or corruption/mapping errors, which is why validation and testing of migrated data are essential.

What is artificial intelligence (AI), and how is generative AI distinct from traditional AI in legal tech?

AI is technology enabling machines to perform tasks requiring human-like intelligence. Generative AI creates new content (text, summaries, drafts) from learned patterns, whereas traditional/predictive AI mainly classifies, predicts, or analyzes existing data.

What is blockchain, and name one potential legal-industry application.

Blockchain is a decentralized, distributed, tamper-evident digital ledger. Legal applications include smart contracts, chain-of-title/property records, and verifiable document/transaction authentication.

What is a smart contract?

A self-executing program stored on a blockchain that automatically enforces and executes the terms of an agreement when predefined conditions are met, without intermediaries.

What is the primary ethical/security concern when a law firm uses public generative AI tools?

Confidentiality risk: client/confidential data entered into a public AI tool may be stored, used to train models, or exposed, potentially breaching the duty of confidentiality. Firms should use closed/enterprise tools and verify outputs (which can be inaccurate or 'hallucinated').

What is Robotic Process Automation (RPA) and how is it used in legal operations?

RPA uses software 'bots' to automate repetitive, rule-based digital tasks (data entry, intake, document assembly, conflict checks), increasing speed and accuracy and freeing staff for higher-value work.