 So this is our first of two trainings this year on Baseline technologies we've got an advanced one coming up later in the year I'll be dropping a link to that into the chat and talking about that a little bit more at the end of the day We've got four people here are who are helping us out three are here right away and William's gonna be joining us You know minutes myself. I am Brian Roe. I'm the project coordinator for The legal services national technology assistance project, which is housed out of Northwest justice project I work a lot on several different things here at Northwest justice project and I try to answer Questions for the community provide a help desk provide an email list that I strongly recommend people Check out. I'm gonna be putting a link to our email at a list in the Chat area it is a Google group If you have an email address that is linked to Google and you can just apply to join If you have an email address that is not linked To Google you can email me I'll put my email address in there and I can manually add you one of the best Resources for help around the baselines is the email list. We've got over 600 legal services Technologists from around the country if there's something that you're looking at implementing technology wise whether it's a baseline technology or a cutting-edge Innovative technology. There's probably a few other organizations that have done similar things there We have with us today Jeff Hogue who is the community and relation relations and operations manager over at legal server formerly of Legal services organizations in the New York area who has worked on several different takes and then we have Jane ribbon era Program analysts for technology for legal services For the legal services corporation and then William Geithen the director of information and technology for legal aid services of Oklahoma will be joining us shortly The way that these Slides are set up. They are in the order of the baselines So if you download that PDF document and follow along You'll have a significant amount of extra Text and recommendations that are in the baselines beyond what is just in the slides that we're talking about here today So I strongly recommend downloading that We're gonna start with technology planning and the way that this is gonna work is that One of the three or four of us are is gonna introduce and talk about the topic a little bit And then the other members of the panel are going to add any Suggestions or best practices that they have and we will take Questions as we go along on the first one here. We've got several different points on technology planning Technology planning plans should be reviewed and updated as needed every year I just want to ask one Kick this over to Jeff for a second. What types of things do you think should really be in that technology plan? And what things would you want to change? On a yearly basis, or what are things that are a little more concrete in looking at a technology plan? Thanks, Brian. Well, you know one thing that I've noticed is that Ever since LSC said hey, here's what a you know, you guys should have technology plans you know people kind of treated as something that's Something to get off their checklist and so I think what a lot of folks did was look at that Requirements and or that recommendation and then fill some things in I think the My two senses to keep it short. So the first one I made was 20 something pages And I'm sure absolutely no one read it after I finished it so First I'd say just as a matter of format keep it short and then I would recommend if you're really going to do it once a year Try to pick right at the very beginning Pick a goal or two of what you're going to try to accomplish because the truth is when you sit down and look at all of your technology You're probably going to come up with a pretty long list of things to do Oh, make sure we're ready for you know IPv6 and I haven't really looked at the firewall settings in a while. Oh, I should back those up. You know all those things Might become an unwieldy to-do list. So I think having a Goal right at the beginning on the front page that you know everyone you distribute it to is actually going to read Our goal is a better job of training this year Might be be good. I Think that we have we had once solicited some technology plans there's probably time to do that again because I'm curious if the sophistication people are putting into it has changed but Yeah, that's what I'd that's what I'd say and then I think you know the first thing that you do when you do the review technology plan is did we meet our goal and And and and it's really about priority setting in my mind. So staffing and and dollars have to be a part of it Yeah, one one of the things I really want to point out is that the The sub points under this also Definitely include that you should be evaluating things like our cloud services useful. What are the risks? What are the benefits there? What is the backup situation for your servers? Disaster preparedness. We did a series of webinars and a best practices guide on that about two and a half years back That's available on L a cent up But it should look at some of those common scenarios and have some ideas there Jane Is there anything that you would like to add or some Things that you've seen from good technology plans that you think people should include Sure, Jeff, I think you made a great point about that don't get too involved or too long of a plan You know and and also sometimes, you know, we go on site visits and and look at technology plans different programs submit And oftentimes I think of it as as it's not really a plan It's kind of like here. We are but what you know what we often don't see is where are the goals? Where do you want to go? You know, and you have to kind of break it down between what are sort of ongoing maintenance things that the IT people Whether it's internal staff or whether you have you know outside consultants working on, you know Those are those are ongoing things but what are sort of the strategic goals to move the organization forward in its use of technology and In order to do that effectively That's something beyond just the IT people Involvement is really important. We often Recommend that programs look at kind of having a technology planning committee and to include people from various types of positions from support people intake staff To paralegals and attorneys and managers So that you have a cross-departmental and cross-positional Kind of representation on that committee to really think about, you know What what they need to help them do their jobs? Well, not just what the infrastructure is And and to make sure that that leadership understands that, you know Technologies should be a part of any sort of strategic planning process that might not be done yearly You know, but that might be more of the long-term goals But then each year kind of think about what can we tackle this year and set some goals that set some timelines of when you want to Accomplish these things so that you can go back and review it You know periodically with that committee and it doesn't have to be a month You know, this could be something that meets twice a year You know kind of in a planning stage and then maybe six months later in a review stage Just to kind of do a check-in and see see how you're doing see if your priorities need to change at all or not I did post some some good resources we have That's on a later slide when we get to the end. There's some resources up there One of the things I want to make sure and point out is there was a session a couple years ago at the TIG conference It's Steve Hyde Did on it's called the tech planning smackdown and he talks a lot about sort of tactical planning versus Strategic versus, you know, what kind of things are you going to do to drive and furtherance of your mission of your organization? and I'd really recommend people interested in kind of Thinking about how to go about that planning process take a look at that Video that we have Excellent now. I really like that breakdown of tactical and strategic It gives you the idea of those overarching goals where you're trying to go But then also a breakdown of things like what does our computer replacement policy look like do do we have a Continual system for upgrading things is there a way that we check occasionally to make sure that our Servers are secure that type of stuff on kind of the tactical side So we've got on here that it covers more than just hardware and software That we have client data related issues, which we've talked about a little bit And I think Jane did a great job of talking about how they're working on several different areas across the organization This is not just something the tech staff should sit down and come up with themselves having end users involved in the process Helps significantly The next one that we have on here Covers kind of budgeting and staffing personnel issues Organizations should at least have two full-time technology staff or consultants per 100 FTE staff Members and I know that this is one of the more kind of current concrete recommendations that was added when the Baselines were updated in 2015 What types of things do these staffs? do particularly and What are some examples of putting those staff internal versus kind of External consultants that you guys have seen Jane are you willing to take a first crack at this one? sure so Yes, oftentimes that the internal staff can be somebody that that You know it really understands how the Legal services program makes the best use of technology and can can help them be a little bit more strategic about that use You know and then also be be there for kind of day-to-day troubleshooting. It's you know I have actually been Impressed by programs ability to to get some real sort of generalists who can cover a lot of different areas, but oftentimes, you know, especially as as technology Advances more and more. It's really difficult to find one person who knows everything whether it's from networking to software You know to knowledge management document assembly those types of things So you have to sort of prioritize what's the most important internal expertise you need and then You know have a combination of Maybe you know some of the network infrastructure is making sure all of your systems are updated You know whether you want to move to the cloud or not You know even some of the help desk function functionality that can maybe best be done through a consultant who has maybe multiple staff people on board and you're just You know paying them one fee, but you're getting the expertise of a lot of different people depending on what you need at any one time Yeah, they give you a little bit of an example of what the staff breakdown kind of looks like Here at Northwest Justice Project. We're about a 230 240 person Organization gets a lot larger when we take on interns we've got one individual who's newer on the tech staff that is kind of learning everything and Primarily doing that through help desk kind of a junior member We've got one individual who has significant server experience. He does mentor with the harder help desk questions But he basically does disaster recovery Implementation of new systems that type of stuff from a network admin So about 80 or 90 percent of his time is there and then the third individual we have Does support between the two is kind of a mid-level member Of the team who is also at that network admin Level and then we have one individual who works specifically with our law help Website and we occasionally bring on consultants to deal with more challenging web related things we do not have a Drupal developer although our website is in Drupal and we contract externally with Pro bono net for law help interactive stuff. So there is some consulting that goes on there also That's kind of the the four to five FTEs and where they are kind of in Northwest Justice Project for one other example of an order that I worked with recently This was about a 30 person order from the protection and advocacy area Disability rights Washington they actually go with that external help desk model where they Have a service that Maintains their computers does updating they can ask any questions related to servers printers those types of things So that is all external and then they have one individual who is a Part-time kind of admin staff person who also Helps a bit on the internal onsite things and kind of keeps track of their strategic planning Does some of the light duties that you would see kind of at a chief information officer On the planning side and strategic side and works with external contractors for their website or for their Video production needs or other things like that Jeff is there any Examples from organizations that you can share or any suggestions here on when you kind of look at internal versus external stuff Sure, and I should say you know when we looked at as a group at what I think Partly we wanted to just communicate to programs that maybe still we're having technology done as a 110th FTE of somebody who kind of new computers that the industry in general Was this was staffing technology to a much higher rate than what we saw in legal aid And I'd say even since we work on the baselines, you know Back then it was still sort of new to some programs that if email or Networks stopped working workers wandered out in the hallway and said what do I do now? And now I think this is just presumed that these are mission critical systems So a lot of times I see somebody who's been an advocate Who ends up in the sort of strategic position of what should our priorities be? Hey, you know, we really could save some time if we automated some pleadings or We finally got rid of word perfect and only supported one You know we're processing program and then a lot of times if it's just to the other person is helping with more of the retail Support so my printer doesn't work Somebody's got to run that back up on Saturday that sort of thing. So that's that's a common breakdown I will say that the closer the strategic person is to the executive director's office the more likely it is that the Efficiencies that can be gained from technology are going to be noticed and listened to And one it is very common for orgs as they grow in size To initially give those responsibilities to a lawyer who happens to know word really well And then that person develops over time The skill set and ends up moving a lot of their position into the strategic planning a Technology side if that happens to be the case I would strongly recommend getting that person to some conferences kind of the way that we send our all of our lawyers to CLE training and get them out to the NTC conference which just happened out in DC, which is a national technology Conference that has a lot of sessions on planning All of the different areas that are in these baselines you can find a session on them from data security to backups to staffing To how to do outreach Make sure that you're giving the people that you're putting into those positions the ability to Gain these skills and that they're not just looking at contracts and kind of dealing with the tactical You're the benefit from that is going to be much higher The other thing I want to point out with with N10 the nonprofit technology network that ones that run the NTC is One of the resources with the baselines that we used for guidance on the both the personnel and I think looking at budgeting too It's it's a good resource Is there they do an annual technology staffing and investments report? So you can just Google N10s nonprofit tech staffing and investments report and and that's it's for it's for all different Sizes of nonprofits you can sort of determine or we can certainly know is your organization Consider small medium-large and kind of see how you compare to what other nonprofits in the sector Do in terms of budgets and and staffing Now that is excellent. They they have a wonderful website with lots of good resources I just put the URL for N10 into the Chat and then the 2016 Staffing report I'm going to drop into the chat here in just a second Let's move on to the next topic here, which is budgeting and we've got a few different points here that need for ongoing maintenance and upgrades as part of this budgeting the Personnel and consultants and then training in the use of technology When I end up dealing with organizations The training issue tends to be one of those that is often missed in budgeting And there are some things that you can definitely plan in and try to also leverage the community as part of that As you probably know LSM tap has an entire list of trainings throughout the year There are some of the trainings that we do such as some of the security type things that Taking pieces of that and then working with a professional to turn that into a training in your organization is is really useful Jane what are some of the things that you see that people Commonly miss in budgeting that catch them unaware or unexpected later Um Well, I think that I think the training is is definitely something people always under budget or neglect of budget for You know we especially in TID projects We see people trying to implement new technology and there's kind of two parts of that is First you have to make sure your staff is capable and it has the tech basic tech skills They need before you start implementing something even higher level, you know If they're currently not making the use of the functions that you have in either your work processing or your case management Program and you're trying to introduce Higher level document management system, you know, you're you're kind of missing a step there So you need to really be able to assess their skills And then also budget and adequately provide training in what you what your current systems are You know to to you know before you start doing anything Even more expansive, you know, make sure people are functioning and Performing at the highest level that they can Mm-hmm When one other thing to definitely think about there when putting together this budget is look at how It can benefit the organization. I've worked with several organizations That have had kind of a replacement policy where they they wait for things to die And then they order a new computer or maybe they have a have a computer to sitting around that they then Transfer in and out. I'm having a more proactive strategy that upgrades on a regular basis Can actually save you a significant amount of staff time during those transitions And keep things moving although it may seem like you're spending a little bit more In the process of doing those continual upgrades the lack of downtime for staff needs to really be considered as part of the Return on investment for putting together those maintenance and upgrade things Jeff, is there any recommendations that you have here with regards to budgeting? Just the only thing I'd say is that you know in in lean times The truth is that the budgeting for technology and preserving that and probably fighting for that that piece of the pie if you're the technology responsible person is You know a way to gain efficiency and do more with less resources Definitely Next topic that we've got here is case management systems And as with most of these areas Or as with everything in the baselines, they're really written to be General and to give you some things to Consider There isn't a particular case management system that we recommend But there are several different basic feature sets that are part of this baseline and one of the things that I would really recommend in starting to look at a case management system or Change case management systems is not only looking at what you currently do But going out there and talking to several different Both vendors and actual organizations that have Implemented these case management systems about their workflow about what they use the case management system for The features between them tend to be very different the types of things that you can do in person or remotely or cloud hosted versus on-site can be very different and One of the best things to do is ask the email list who is using a particular case management system and connect directly with Organizations that are using them when you're evaluating a new case management system If you need any help in finding individuals about two years ago We asked the community generally if there were people that were would be willing to mentor or share from different organizations And we still have that list available or if you have trouble finding someone who's using an organization and taps definitely here to help that The baseline itself goes far beyond the flexible response of importable that are just on this slides It's one of the larger sections It has different things that are even more down there to the tactical side including Conflicts checks entering and editing CMS data in real time that type of stuff Jane have you got any recommendations for people that are either looking at changing to a new case management some system or Implementing one and how to deal with this rather long baseline that could be an entire webinar in and of itself That's true Well one thing I want to point out too. That's that people have found helpful is we've started LSE has started Extracting the data we collect we've done this for the I think about the last three three years or so From we it's called our k-form. So we we asked for What technology systems programs are using and that is available on our website and there's some good graphics That that are associated with it. It's under the data portion I will text in the link to it in the chat box but that also that has actually a list of everybody who's Currently using different case management systems. So You know, it's it's usually it might be a few months behind because we collect the data like every spring So, you know by the fall if somebody's changed over that might not be Completely up-to-date, but it's pretty accurate in terms of trying to you know If you're thinking about switching and you want to find somebody similar size program that's using something you're looking at Then you can you can use that as a resource as well I guess the the the other thing is just Do your research You know make sure you you get good demos from from all of the providers They are all willing to come in show you some good demos You know have again have staff at different levels There's some systems that may be better at doing intake and other systems that are better at doing Management of cases and supervision Some have some more innovative features So you kind of have to think about What's going to best meet the overall needs and goals of of your organization? And make sure you plan enough time for it. You know these this is a this is a major Change in that type of system. It's not something that you can expect to do in six months So the link is in the chat there and on the email list serve On March 2nd David bone break also sent out that information and has several different breakdowns for software usage connectivity and works LSC data technology generally and and specific Beagle-aid stuff. I'm going to put all of those links in I'd like to take a second and welcome William Geithen here as part of this discussion and If if your audio is working, I would like to kick it over to you for a second and ask for your thoughts on Implementing case management systems or some of the best practices or things that organization should really give a try to or consider Well going through that process And those additional links are now in the chat Thanks, Brian. Can you hear me? Yes, definitely good. Sorry. Apologize for for being late I've gone through two conversions Both in Alabama and now in Oklahoma Converting from different converting from legal files to legal server in Alabama and converting from prime legal file a legal server in Oklahoma and As many times as I do it it's always There's always a couple of little things that basically make your life Difficult and it's it's it usually revolves around understanding the workflow of the firm and What piece of the case management system is more important rather than the others? Because we have a tendency to focus on migrating everything and in reality a good 50 to 60 to 70 percent of the data that's in your old case management system is probably not relevant anymore It's probably should have been gotten rid of it the seven-year data deletion point in terms of data you want to retain and not retain from any discovery perspectives but the You know the thing that I've learned just the hard way is really Fundamentally talking to to staff and understanding how their case management system works Fundamentally works for them and their workflow and the and how that how that impacts the way the office works You may go into a situation assuming you understand the way that that case goes from intake to Representation and come to find out that it really doesn't work the way in reality. It doesn't work the way you think it does Until you've actually interviewed staff and actually walked through the process so that that's just my big take away in terms of things that those kind of those software skills soft skills that you need to have when you're When you're migrating from an old case management system to anything Jeff have you got any Suggestions of the type of questions that people should be asking when they're looking at case management systems What what helps a transition go well for them? Well, I haven't done this and in case anybody's not aware I'm on the legal server team So I didn't participate in the baseline list here Alice and Paul the my co-chair at the NLAD a tech section did that part the biggest you know issues I see are data quality and not having clean data so Right now, you know, then there's still some folks who are keeping things on spreadsheets and that sort of thing so But even in even in case management systems or other kinds of databases. It turns out over the years people fiddle with them Or there's just bad data and that that can be transitioned difficult but it's interesting to me this conversation is about you know Thinking and choosing and that sort of thing where I think when the baselines were originally drafted, you know I think the main gist was let's get to systems and right and not and and use the technology that's out there and I just don't think that's even controversial anymore the funders needing reports and that sort of thing just Necessitated a pretty serious purpose-built tool Mm-hmm Right and one of the things that I definitely Recommend is in this process try to create a few what I would call personas individual user types from your organization Figure out what the workflow for them is going to be what their most common features are and how those can Be represented easily for an individual so they don't have to bounce around to a bunch of different screens so that it is Efficient in how they use it and then test it with them as you're putting that forward So that you make the trend the transition or the upgrade those types of things as easy as possible For staff whenever you do something like this training is a big part of the transition also Now any final words or before I move on to supervision? I think we've covered this on supervision, we've got several different things that are kind of covered in the in this But there's a lot of areas where technology can really help calendaring document production timekeeping Supervision data Online research. These are this is a very broad topic. This is another one that could easily be a webinar in and of itself but Yeah, finding ways that individuals can collaborate on documents that they may be able to check them out or Work off of Best practices that other people have already put forward Use a pleading that somebody else has and improve that as part of whatever you're doing there Are there some suggestions of? Software or tools that people should look at that are relevant to kind of your senior attorney or Admin staff in this supervision area that people would really recommend Now let's go over to Jane first Well first is is this is really kind of underneath and part of the importance of it the making full use of your case management system you know do managers have the ability to See case lists of the people they're supervising be able to do remote reviews of those cases with them You know be able to see is is there something that that they need to kind of find out what's going on with this or not You know that you're being able to use like I said you use what you have to its to its full extent That should be something all supervisors have access to and is really easy for them to to pop up and and get those types of reminders and see in terms of of kind of You know remote supervision we we in legal services you you often have Teams that are spread spread across a state or service area and You know we've we've found people use Web conferencing tools like the go to meeting or join me or WebEx You know those are all really good good tools idealware.org. That's a good resource for they are often doing Articles about the differences between those different types of remote software tools You know Skype now is built into the office through 65 that offers You know the ability to do presence and chat instant messaging as well as Really quick and easy Check-in meetings things like that So, you know, it's it's it's the the growth of all of those tools make it make it Much easier to to work remotely and supervise remotely as well Also, definitely if you're if you're working with a large team if you've got a hotline with several different attorneys Being able to see easily opening closed cases to see what they're working on the those type of things Can help you identify areas where individuals need help very quickly that type of thing William do you have any recommendations or thoughts here? Well, we're we're very much having to relearn the the supervision piece in Oklahoma primarily because We are competing for and and getting grants that that really fund an embedded attorney We're seeing more and more of our staff are embedding and in in third-party organizations They're in legal medical legal medical partnerships. They're in they're in clinics. They're in domestic violence shelters We've seen a fairly large number of grants that we've received over the last two years that that That basically fund an embedded position So we're having to figure out as an organization Exactly what those remote supervision tools are and what that what the best tool set is And it's one of the reasons we've spent the last year and a half and we'll spend the next year and a half migrating to all off-premise services, so 365 and dialpad and AWS and Google and all of those remote Tools that help us Be effective as an organization Where in another year or two half of our attorneys will not be in a physical law office Wow half of your attorneys that we we just put in the capability at Northwest Justice Project To be able to have individuals on our hotline from anywhere throughout the state or potentially even At home and we just drafted our first draft of the year At home and we just drafted our first kind of Remote supervision Telecommuting policy and we're having individuals apply for that and that is one of those areas where Technology and supervision and your case management system all kind of merge together And how you deal with that? Bring your own device policy and other stuff going on also Any I mean everything we're doing is is is is web-based because we don't know where that attorney is going to be Where we're going to be representing clients We can't be tied to an on-prem type of architecture anymore And it's really being driven by that the the opportunity to compete for Grants that require an embedded presence at some point Mm-hmm, which which I think it brings back a point from very early on here in this discussion of really considering cloud-based options the economies of scale on them bring down the price and The options continue to increase every year for example We put together a document sharing site on site on SharePoint several years ago as part of a tick grant As we've been reevaluating that on a year-to-year basis. We just moved that into a 365 environment and No longer maintain those servers because it was just not cost-efficient for us with upgrades and customization and the online version Improved so much in just three years that it took over all of the functionality that we had originally custom built into the system Yeah Jeff any thoughts on this area Yeah, I'll just add a uniformity is key so You know, I can tell you right now if I have it we are mostly remote We have very little physical presence. We have a couple of tiny offices and all remote workers and and yet, you know Part of the way that supervision works is if I don't see someone in slack for a couple of hours You know contact them and say hey is everything okay? Are you sick? Yeah today and the only reason that that works is because Everyone uses the same tools and they use them Religiously so calendaring instant messaging whatever the tools are great to have them I think the real thought behind this baseline was you know and use technology for it Don't don't have a paper calendar out by the receptionist. That is the big the key But if you use the electronic tools, there needs to be really program-wide adoption for it to work for supervision Mm-hmm We've got a lot of good information here, although I'm gonna speed things up a little bit if any of the panelists have Particular points and I don't call on you for a particular item Please speak up, but I would like to just get through kind of the overview of everything here And I want to let people know that Myself and others are available to go much more in-depth on any of these and if it's an area that Ntap isn't particularly familiar with what we'll usually do is find an expert in in the field somebody else from the community to kind of act as a Mentor when dealing with these things Jane would you like to start us off on electronic records some of the things to really consider about in that area? And what would the policies regarding access? What what does that really mean? well, you want to you know Make sure you're you know that you have the appropriate security levels for your for your records more and more security is Such an issue. I think William was going to talk about some things too with our LSE's Office of Inspector General just just released a report dealing with with overview of security network systems, but also revolves around Electronic records and access to all of the information you're collecting So you want to the program, you know, make sure you have the appropriate policies That that governs, you know, who gets access to what? Files who has access to the move files rename things how long? What is your your retention of electronic records and what's the process for? You know removing those records, you know, is it's easier and easier to just keep things perpetually in storage, but as we're seeing for for e-discovery and Migration if you are changing case management systems for a lot of different reasons, you know, do you really want to? And should you be keeping things in perpetuity? You need to kind of think about having a set policy for how long? Those electronic records are going to Remain in your systems just like paper records and paper files And a quick note on that and Northwest Justice Project has a part-time Law student working on a model draft policy It should be the first draft of it should be out with regards to data retention and destruction next week for Comments from the community so that we can try to improve it But it will be out on the email list and we'll be looking for feedback and people who want to be Interested in putting together the final draft of that That's one of those areas where a lot of organizations they have a policy for physical paper and they because the cost of storage is so cheap They end up just holding on to everything in digital and it creates a huge security and privacy risk for Clients William, did you have some things that you wanted to cover in this area? The only point I wanted to make Brian was that if you if you're in 365 and you're monitoring your office 365 instance Microsoft recently released the the security score dot office calm site So it's a it's a security focused Dashboard that basically gives you best practices to follow in securing your office 365 tenant And of course it it dovetails into a lot of the things that we're talking about in terms of data retention Personally identifiable information. You know, how do you deal with social security numbers and bank records and PID? You have the tools available to you Through the security and compliance application within office 365 that will drive Your policies and drive your retention and drive a lot of your data policies already built into 365 so Microsoft has spent a tremendous amount of time in the last 12 months developing the The security score analyzer and it has a very in fact, I'm looking at ours right now It has a very straightforward Q of actions that you can do to your instance to increase to decrease your risk So the first one in my list is enable MFA for all global admins That that's probably a pretty good thing to do anyone that has global admin privileges within your 365 instance Probably should be using multi-factor authentication Um, but again very straight, huh? Definitely. Yeah, and it that's the very first thing it pops up and it says You know the the user impact is low the implement case the implementation cost is low The threats of not doing it or account breach and elevation of privilege. So it's it's really well thought out It's in very plain language. Um, and you can sit there and pick and choose which which actions you want to Research and actually implement through that security score interface Now that that sounds like a great tool I would I would love to even consider putting together like a short 15 minute demo of it So that people can see how it works something to that effect at a later point in time. Thank you. I'm very impressed Excellent Moving on next to knowledge management systems. Is there somebody I've talked about this a little bit with SharePoint Does anybody on the panel have any specific experience with knowledge management systems and some of the Best practices and putting these together and making sure that they actually work for the community or for your organization Well, I this is Jane. I mean we we've had a few a few different projects to move to implementing SharePoint with kind of mixed success levels and I think sometimes That involves You know, there there's a lot of pre planning and thought that needs to go into How you're going to implement any document management system Um, I need to make sure you have buy-in from from management and staff across all levels to say You know what kind of goes back to that archiving and how long do you keep everything for because if you're You know, if you don't have a good document structure in your whatever you're currently using And you want to move to a more structured You know or or tagged environment whatever you want to do it in in a document management system You know, that's that's You have to kind of say we've seen some programs where they've just said okay We're going to archive everything have it accessible, but it's we're not going to move it over Because if it's never looked at it's just stored somewhere We're leaving it there and then we start and move over what you need to And go from go from there with with with a new document system You need to kind of plan out, you know, is it going to be is is there going to be tagging? Is there automatic tagging? Is it more search based? You know, what are the kind of the tools that that people will actually use because if you expect people to add on and And do more tagging as the filing documents that may or may not be successful in practice Brian, I know I mean you've you've you know, what what your northwest justice project did was one of the more successful moves to Document management systems. I'm interested in hearing your tips Yeah, we we definitely looked at both the kind of search appliance option and having a dedicated system like SharePoint SharePoint has a very strong search though built in with it And we found from user data that people definitely search although they also use a feature which We kind of call dashboards. They're kind of like wikis where you have very easily editable pages That individuals can put together and put some commonly used resources. So for example our hotline area created some Pages for the most common like housing resources that are used for the entire group they assigned and someone who just updates and checks on those every month or so and those kind of Pre vetted resources or place where you can put a tier one resource are definitely used We've also found that the individual work groups if you don't have kind of that champion or somebody who is Helping make sure that new documents move forward The it can get ignored so getting that buy-in training people in how to do it and then actually finding those champions in the organization who are gonna Make sure that interesting new cases get posted in the area that they're really interested in or update that page If it ends up being kind of a static resource And then search is just essential whatever system you use Make sure that there is a good search the tagging of documents on the way up sounds like a great idea but it's very difficult to get people to Put the tags in it ends up being a transactional barrier to adding new items and in The last thing you want to do is discourage people from adding stuff So I would say search is more important at this point than tagging Anyone else have any thoughts on the knowledge management systems and a quick note the resource that william had mentioned is in the Chat as a direct link It's secure score dot office dot com Dashboard or I won't read out the whole url. It's there Check it out in the chat if you want to use that resource I think given time we're going to move forward to legal information statewide websites This is an area that has a lot of different things on it Two of the really important areas that come out of this Are statewide collaboration between other partners that are there and figuring out ways To get them to help update or add new information resources Including services that are offered one of the things that we're working on currently for washington law help Is the ability for the volunteer lawyer programs? To add update or change their own clinic schedules their own Resources that are available through our site so that if somebody's asking for help in a particular area They may get direct referrals from that information and that information is updated More often there are several different platforms that you can use for creating a statewide Website the two most popular ones at this point are Drupal using the d-law template Which is freely available open source although you can also get vendors to host manage to Service on that also and then The law help platform through pro bono net There are some great examples out there of websites that are done on both And there was a major audit of those websites that was done And the information released about that at the last tig conference Those sessions were recorded and they're well worth looking at as they talk about Different things to look at in legal websites Jane can you give us a little bit more information on this area and Some of the things that you think really help a successful statewide website Sure And as you said, there's there's actually going to be another session at the equal justice conference and we're finalizing kind of the external report and and toolkit that was developed out of the statewide website evaluation project, which was funded through A generous grant from the ford foundation that lsc received Some of the some of the the most important takeaways from that were Things like the importance of developing a mobile first approach to website design To use you know very To kind of modernize the the visual graphics And and overall usability of this site So there's a lot of focus on actual user testing You know and and accessibility that that I think it's it's up to 20 to 25 of the population has some kind of accessibility Issue so that if you design for for good website accessibility then that site improves the Usability for for everyone So and there's some there's some good tools and resources that They'll be providing about how to to assess your site one of the things I think we found too with with some of the sites is just there's There's sometimes there can actually be too much content or not enough Kind of prioritization of the content. So if somebody searches for something or goes to an area You get a really long list of resources, but you know, they're not really sure Well, what's the most important thing for them to look at? So sort of thinking about You know, how do you break that content down? into Sort of a more step by step approach for an end user. So here's some some Basic information if you need more information go to this next step. Here's sort of the next steps you can take you know, those those kinds of Dynamic help and guidance Are just really important but that you know that again this could this will and can be a whole nother session so There'll be additional resources coming out in the next month or so With the with the toolkit and the final external report on on that assessment project Excellent. I really look forward to seeing the toolkit And one thing that has really jumped out at me is the the number of different resources that are available I would love to maybe late in this year or early Next year do an equivalent of 50 tech tips type webinar where we just do 50 resources for individuals Implementing baselines because there's just so much good stuff out there and we've got a whole slide full of Links, but I'm sure there's a lot more if we kind of crowdsource that with the community Moving on to social media here and what really the Kind of focus for social media Should be this is definitely a newer area on the baselines And it's one of those things that I think Will at next time that we see an update or in the future will this is something that will even be Covered more But one of the things that is most important to me really links in with a comment that jane just made over mobile technology for clients one of the Things that we see at our statewide websites is more and more people coming Using mobile devices and we need to design for mobile first Social media is designed for mobile first We took all of our videos from both lsn tap and northwest justice project Put together a pair of youtube channels to distribute those the number of people that view those videos went through the roof We're getting more mobile device use it just makes it so much easier to distribute that information to the community With regards to facebook We're in the middle of a project put together by a three third year law student from seattle university law, which i highly recommend working with Law students if you get an opportunity Who also works at microsoft in their artificial intelligence area and is Working on a chat bot with us that will let somebody come to our facebook page Ask a few questions and then get referred to or their question answered or referred to A portion of our statewide legal website Most of the referrals that i personally give out on legal issues are people asking me stuff on facebook Going to where your clients are and making it easy to find you And your legal resources help significantly and i know this is an area where there's a lot of fear in the community But it is definitely worth looking at because that's where your clients live on a day-to-day basis Does anybody else have any comments on social media that they would like to add or Interesting ways that it really interacts with the baselines Brian this is i just want to say the baseline itself is really general It just says that each organization should have a strategy as the weather and how they use social media And if you do use social media, um, you should have a policy to govern its proper use. So That should include The agency owning the account, you know, that sounds small, but In some places this has happened right somebody's like, oh, I know facebook like i'll become me myself as a My my personal account. I'll monitor. I'll spin up that org site That's something to look out for But the baseline itself like you need it if you have a plan and if you actually implement Some social media efforts if you have a policy to govern that and this was I think the team that met was um LSE, you know, jane was there clan david bonebrake and then nla da and so we didn't really address this but the baselines are designed to be just that they're um their suggestions and A self auditing tool. So this baseline is very simple and Implementing social media is is a well as a big topic You know more and more you're trying to see how do you Create resources to help encourage pro bono attorneys to take cases Some of it can be training for the pro bono attorneys. There's a really a good project going on in california with Los angeles and the and the statewide California support center on Creating online trainings because often that's a impediment to To getting pro bono attorneys to take those on You know the the one caveat I think I would just say in terms of It's still a limitation with with technology is is a tool. It's not necessarily always A standalone answer they're they're um, you know, we found that You know as much as you can automate the process of kind of putting cases out there and asking pro bono attorneys to come Take a case. They're interested get an assignment. They can get the information and do all of that automatically You know, if you if you build it they may not come, you know, you still need to plan for Having enough Kind of in-person and interpersonal relationships To get people to come on to the site and to use the tools So it's it's it's always kind of a balancing act of of having the tools available make it as easy as possible You know, but don't forget about still needing to build those interpersonal relationships as well Hey, I guess two quick points on this particular area When we looked at upgrading our phone system at njp. We looked at how could we possibly integrate pro bono attorneys and we now have a technology support structure that would allow them to participate or Enable them to participate externally as part of that planning So it it really needs to be something that you look at when you upgrade or look at new technology I've also been involved With the washington web lawyer project, which is similar to the aba's online legal answers project And there's a lot of opportunity to do online Clinics to provide information back and forth We've seen some very good examples of being able to do very limited scope Answering one or two questions for someone and being able to help them out We are just in the process of evaluating How useful that is if it's helping people with their day in court that type of thing I hope to have some more information coming out in a report within the next year On that and i'll be putting some pressure on aba to share the outcomes type side of that type of stuff But I think there's a lot of technology that could be used but Jane hit on one of the most important points you need a community manager a legal supervisor somebody who is going to Oversee that and help make those partnerships with Private firm attorneys other people so that they are participating in it It's not a matter of just standing up the technology It is really a community based effort that someone needs to shepherd Moving on next to Training we discussed this a little bit earlier But there should be some effective Continual training that is put in place for your staff The way that I like to think of this is the equivalent of the cle type credits is a technology Continuing education for your staff Sit them down do a security training talk to them about your social media policy and then Work with them in crafting those messages if that's part of their job Make it interactive We have larger lectures here But the advantage that you have working with your staff is the ability to do smaller group and interactive trainings around that We also try to share a lot of the free trainings that are available throughout the community Joshua pesky who does security trainings has kind of a A security ninja series that he is putting online available for free We will be sharing those As they come up with the community on the email list But there's a lot of resources out there and finding ones that are relevant to your staff And integrating them into your training is definitely Well worth it and part of what you should be Planning forward I'd like to turn it over to another panelist at this point to cover some of the broad stroke areas Around security What types of things should we really be looking at in security? We've touched on it a little bit with that security audit But what other are the really important baseline security things here Jeff are you willing to take a first run at this? Sure, no problem So, you know again, we're just going over what the baselines are It is its own topic, but we some of the things that are listed are Keeping operating systems and antivirus and other software up-to-date in the link that I think William has shared from the oig I don't know visit of a few programs That was one of their top recommendations was keeping things up to date and our most The guy who I'm pretty sure could read everything about my life in five minutes if he wanted to who works for us The very first thing he told me is Sounded so simple to keep your Keep your operating system up to date because when Security holes are identified the good software vendors get a patch out really fast We also have in here in the baselines to maintain backup and recovery systems the We need to have security policies and procedures for protecting client-based data And then it talks that we talked a little bit in the baselines about sensitive and personnel data So probably everyone on the call. I recommend we all make sure we know about Especially sensitive data. It's more than just social security number and date of birth And the server and equipment should be kept in this secure environment. I mean at least At least put it in a in a room with a lock Pretty sure most programs across the country I could put on it Put on a polyester shirt and put my name on a patch and walk right in And touch some data that I shouldn't get get to So I just asked to have a disaster recovery plan is in there policies on the use of the internet and social media so You know Every use case is different Uh, I think at the end of the day Most of this is is resolved if you do good user training about how to recognize Malware and phishing. I'm I'm I'm about you guys. I'm constantly doing it with my family No, no just because it says your browser slow don't click on the wiggling little box with the okay on it And you know, some of the organizations on this call are pretty big. So That's information needs to get passed down And there was a there was a discussion on osn tap about instant messaging and encryption And like a lot of these it kind of in my opinion gets I tracked on Questions of privilege and confidentiality As relates to lawyers I think these security Baselines are really focused at What is the baseline you have to do to keep information? Safe from accidental loss or from a bad after trying to grab it so We had a long discussion on the the very important lsn tab email list and you know, the conclusion was Encryption in transit, which is the current pretty much state of the art unless you use a Of a specific set of tools is probably fine And uh security for outlets and mobile devices flash drives usp sticks Personally, I would encourage everybody to think about just not allowing them their use As painful as that might be And then when people are working remotely the baseline is that you should have policies In place for security security data integrity and data storage Where I work now I also give them permission to scan me and try to hack my home network because I do work from home So periodically I can get basically audited To see if what I'm doing here is secure legal aid program. That's not a baseline. That's probably Maybe over the top, but Uh, the baseline says there needs to be a policy and hopefully that by having one you transmit to workers that You know, great. You get to work remotely or you get to work out of a hospital That's that's great. Um, but you're you're touching and viewing very sensitive information about our clients and uh And so we need to think about security in relation to those Now there's just so much stuff in this area I strongly agree especially on uh, once we get into bring your own device policies that type of stuff We've covered the data destruction Uh, a little bit But having ways to clear that data to wipe remotely to make sure that individuals have Uh, up to date virus scans. I I strongly recommend even providing that in the remote Work environment because it's it's so essential that it must be kept up to date Additionally the comments on the thumb drive that is it's a really challenging one What you have to do is make sure that you enable ways that individuals can Securely take that data and use it in court or use it at home If you're going to ban that if you just ban it outright You create this kind of shadow IT network where people are just going to do it anyways So you have to give them easy alternatives that are safe and secure Um Because the last thing you want is them using their own tech and not telling you about it So having a great bring your own device policy having a good remote working policy I'll look at anonymizing the one that uh, njp did and trying to use that as an example That we can post on the lsn tap website But these are just so important for security Now we've talked some about maintaining backups having Multiple systems that are in multiple locations the ability to do this with cloud based technology Is very very easy even if you're using on site In at njp We looked at and did implement for email and for our phone system backups that are One's hosted here on the west side of the state and the other one's hosted on the east side We're really trying to think about Disaster planning if there's an earthquake or something that goes on We don't want the whole organization going down and we want the ability for people to be able to reroute calls use Skype On their phone in order to access their voicemail from clients that type of stuff Even though our main server may be now in a particular area Um, I've mentioned the trainings here and as we're getting at the very very end I would like to move forward to um a list of resources that's here and open it up entirely for Questions i am going to paste this entire list of resources into the chat And i'm going to give each panelist as we've got about 10 minutes here Two to three minutes a piece to cover any particular topic That we weren't able to get to or that they think Is very important for people to look at in these last few minutes while I cut and paste these resources into our chat William would you like to go first on just covering another topic while we're available for questions here? sure, um, I wanted to just just mention to the to the group that The oig sent out a memorandum Probably last week. I think it was on the 28th to your Executive directors and and mine turned around on a Sunday morning and emailed me and said, you know, what is this? So be prepared to to potentially answer some questions from your executive director if you're in the In if you're part of or in charge of information technology in your organization But basically it's it's the subject because results of information technology vulnerability assessments The way it's written it kind of intimates that that we were somehow audited from an it perspective Which is not the case it clearly states it's not an audit, but it's it's really a non audit service non audit service that lsc contracted with a third party to perform And it and it really revolves around if you read the entire document It really revolves around risk assessment and best practices So when you see it or if you get asked about it, um, you know, read the whole thing But most of us on the call that have done enough risk assessments can look at it and say, oh, yeah You know, these things obviously make sense one of the one of the findings uh in the common security vulnerability section of the of the memorandum is The risk rating is critical and the finding is unsupported operating systems So, you know chances are if you have when does xp running in your organizations that you can should consider that a Critical risk rating and you may want to upgrade to a supported os But I just wanted to mention it to the group because it kind of caught me by surprise But once you read it, you'll you'll understand what it is That is great. We've definitely run into some questions about that I mean any of the things that are that are mentioned in it We're happy to help people understand what they're talking about or that type of stuff Jane would you like to take a minute and cover another area here or talk about one thing that you think is Most important kind of takeaway here at the end Um, well the I think building on that One of the things I think you're starting to see I was just uh at a program where as part of their regular annual financial audit That audit company also provides it audits and um, you know, so so part of their annual audit process Was they added on let's do an audit of our it systems And I think that's something that we're going to be seeing more and more of The other thing I I I just heard recently that that uh, I think Glenn and I heard this and we both kind of said oh well, this makes perfect sense is um trying to get some outside technology expertise on Your board of directors Now I know sometimes with lsc programs. It's you know, there's a lot of different requirements on on The structure of your board, but you can also look at having a technology committee As a committee of the board So you might have a chair of the committee be a board member But then it's a way to maybe bring on some additional outside expertise Just in an advisory capacity to the to your board and and get some some additional people to to help you in a in a pro bono effort with some of the the big ideas and planning and Some of the things that that you may not have as much if you if you don't have as much internal expertise on that then That's kind of a Tip and tool The last thing I wanted to mention too was lsc is currently We redoing our performance criteria And the the first one we're doing is is performance criteria area four which includes looking at technology when we go on site and do program visits And that's going to become performance criteria one And jim same man just sent out an email Last friday to directors and i'll see if I can get the link to to post in there Where we're seeking comments on kind of the revised performance criteria, which which includes and covers technology So I would just kind of point that out to people You know if your directors haven't forwarded that to you to To make sure and kind of take a look at to to provide any feedback and comments to us on on that as well Excellent so wonderful points there Jeff you get to close us out today any final Remarks or closing things that you think are really important for people to take away Thank you, and and thanks for putting this together. I think I hope folks who have attended have found it useful to hear us kind of go through these baselines and talk about And extrapolate from them about some best practices They really were designed and and the lady is you know inputs was to not turn it into an owner's checklist That made programs roll their eyes, but really is guidance. So I hope I hope people see it that way I think it's incredibly exciting and I guess if we started meeting again to Advise LSE on revising these I one thing I would change is I would probably pull out of personnel a little tiny bullet point that says Maintain basic knowledge of trends and technology security Purchasing options and best practices and I think I would make that its own big that bullet point because Things are changing so fast now that some of these baselines already seem kind of outdated and More than any one thing in this list um, my advice is find at least two resources Preferably two that don't always agree with each other and try to figure out what's coming around the bend because You know their big ships it can take a while to turn and it's just I do run into you as I work with lots of different programs sometimes they're just um Sometimes the program just would have benefited from more cross pollination of ideas that are out there and There's a real broad enthusiastic community ready to help Every program learn about other options and I encourage everyone to do that Excellent. Thank you so much. I want to say thank you William Gaten. Thank you to Jane Rubin and Nara Thank you to Jeff Hogue for Joining us My contact information is up there on the screen Brian are at northwest justice dot org Please feel free to contact me with any questions Also, if there's a particular topic that we cover today that you would like to see turned into a full webinar Or us write a guide on something to that effect We will definitely take that into consideration and do what we can to create more resources around these Thank you so much for attending and I strongly encourage you to join The lsn tab google group, which is where all of our email Discussion is it's really the heart of this community. Thank you all