Law firm IT support for everything but the law

No, and no vendor can; the ethics duties belong to the lawyers. ABA Model Rule 1.6 expects reasonable efforts to prevent unauthorized access to client information, and the technology competence comment expects lawyers to understand the benefits and risks of the tools they practice with; neither duty can be handed to a contractor. What an IT provider can honestly do is supply the reasonable efforts: encryption, multi-factor authentication, need-to-know access controls, logging, tested backups, implemented and documented so the firm can show its work if a client or a carrier ever asks. That is the part we do, and we put in writing which part is whose.

That is the right question, and a vendor that hesitates has answered it. A firm’s duty of confidentiality follows client information to every vendor who can reach it, which is why bar guidance on outsourcing expects firms to bind outside providers in writing. An IT provider with access to your systems sits squarely in that category, so confidentiality terms belong on paper before work starts, and that is how engagements are set up here: terms in writing, reviewed with the partner who owns the decision, before anyone logs into anything.

The implementation, never the decision. Whether to hold, which matters it covers, whose mailboxes and which date ranges: that is counsel’s call, full stop. Once counsel directs the scope, our part is making the systems obey it: suspending the automatic deletion and retention jobs that would otherwise keep running, placing the named mailboxes and file stores on preservation settings, and documenting what was preserved, when, and on whose instruction. When the hold lifts, the same steps run in reverse, on paper. A hold that exists only in a memo is a hope; the settings are what make it real.

Plenty. The application belongs to its vendor and the hosting belongs to the host; everything the session rides on is ours: the internet connection and the firewall, the workstations and scanners, identity and MFA, email and its retention, and the local files that never made it into the hosted system. When the vendor’s support line says the problem is on your end, we pick up that ticket and work it with them instead of leaving a partner to referee.

A verification procedure the firm never skips, backed by technical controls that make the setup harder. The attack is patient: a compromised mailbox, a quiet inbox rule hiding the real thread, then swapped wire instructions days before a closing, sent from an address everyone trusts. The technical half is ours: multi-factor authentication on every mailbox, defenses tuned for the impersonation mail firms actually receive, alerts when a new forwarding or inbox rule appears, encrypted email for instructions that should not travel in the clear. How to check your own tenant for the inbox rule trick is written up in our Microsoft 365 inbox rule fraud walkthrough. The procedural half is the firm’s, and no technology replaces it: wire instructions get confirmed by a call to a number already on file before money moves, every time, no matter how senior the name on the email.

Hourly for project work, or a flat monthly rate for full coverage, with the price in writing before work starts. Our published plans run $65, $80 and $99 per user per month; what each includes is on the MSP packages page. Firm specifics, like a satellite office near the courthouse or a conflicts wall that needs building, get priced in the first conversation.

As a team, not a replacement. Co-managed is a normal arrangement here: your administrator keeps what they are good at, often the practice management system and the way the firm actually works, and we carry the rest, monitoring, backups, security and the helpdesk depth one person cannot provide the week three matters heat up at once. Who owns what goes on paper, so nothing falls between two chairs.

No, that is an arrangement we expect. Firms grow by merger and lateral moves, and each acquired practice tends to arrive with its own server, its own backup tool and its own password spreadsheet. Every office goes onto the same monitoring, the same backup standard and the same helpdesk, so the whole firm behaves like one office with long hallways. The multi-location version of this page is our multi-site IT support page.