Law Firm IT Support: What It Should Cover and How to Compare Providers
/ Key takeaways
- What law firm IT support should cover
- Questions that separate providers
- Red flags in a proposal
IT support for a law firm should cover the accounts, devices, email, document storage, backups and security controls that client work depends on, with a named owner for every request. It should also work with the firm's practice-management and document-management vendors rather than leaving staff to chase both sides. Use the checklist below to compare proposals on the same terms.
Confidentiality is the reason this matters more for a law firm than for many businesses. In the US, ABA Model Rule 1.6(c) says a lawyer shall make reasonable efforts to prevent the inadvertent or unauthorised disclosure of, or unauthorised access to, client information. In England and Wales, the Law Society's cyber security guidance notes that legal professionals hold sensitive, confidential and valuable data, including client banking information. Your IT provider carries out much of that day-to-day effort, so the agreement should show how.
What law firm IT support should cover
| Area | What to confirm in the proposal | Record to ask for |
|---|---|---|
| Helpdesk | Who can raise requests, support hours, response targets by priority and how urgent issues reach a person | A sample ticket showing ownership, updates and closure |
| Accounts and access | Individual accounts, MFA, role-based access to matters and a same-day process for leavers | An access review showing changes and approvals |
| Devices | Managed laptops and phones, patching, encryption and what happens when a device is lost | A device inventory with patch status and exceptions |
| Email and documents | Email security, external sharing rules, retention settings and Microsoft 365 or Google Workspace administration | Current sharing and retention settings for review |
| Practice software | How faults with case-management, billing or document-management systems are split between the provider and the vendor | A named contact and escalation route for each vendor |
| Backup and recovery | What is backed up, how often, how long it is kept and when restores are tested | A recent restore test with what was recovered and how long it took |
| Security monitoring | Endpoint protection, alert handling and who acts on an alert out of hours | An example alert record with the action taken |
| Reporting | What you receive each month and who reviews it with you | A sample report |
Questions that separate providers
- Who owns a fault that involves our practice software? Ask for the process, not reassurance. A good answer names who logs the case with the vendor and who updates the fee earner.
- How quickly do you patch a critical vulnerability? The UK NCSC's guidance on choosing an MSP suggests patches for critical or high-risk vulnerabilities should be applied within 14 days of release.
- What are your response targets, in writing? The same NCSC guidance describes under one hour for urgent issues and one business day for general requests as standard targets.
- How do you access our systems? Expect individual named accounts for the provider's staff, two-step verification and only the access each person needs.
- Which files can you restore, and who checks they open? A backup job that completes is not proof that a matter folder can be recovered with the right permissions.
- What happens when someone leaves the firm? Access to email, document stores and practice systems should end at the agreed time, with matter ownership confirmed before anything is deleted.
- Which certifications do you hold? The NCSC page points to Cyber Essentials Plus, ISO 27001 and SOC 2 as recognised examples. Ask for current certificates rather than logos.
Red flags in a proposal
- Response targets described as "fast" or "priority" with no times attached.
- No mention of how practice-software faults are handled.
- Shared administrator logins for the provider's team.
- Backups described without restore testing.
- No written process for starters and leavers.
- Monthly reporting that lists ticket counts but not open risks.
How to compare quotes fairly
Give every provider the same information: user and device counts, offices, practice systems, current pain points and the hours you need covered. Then compare what is included, what is charged as project work and what needs separate approval. A lower monthly fee can hide onboarding, licence or out-of-hours charges.
Ask each shortlisted provider to walk through one recent incident from start to finish, with client details removed. How they describe ownership, communication and follow-up tells you more than a services list. For the security side of the decision, read Cybersecurity for law firms: the controls that matter.
BPro's IT services for law firms page sets out how we handle access, document protection and vendor escalation. Our guide to choosing a managed IT provider covers the same decision for any business.
/ Article map
What law firm IT support should cover
Questions that separate providers
Red flags in a proposal
How to compare quotes fairly
Sources
Frequently Asked Questions
What should IT support for a law firm include?
Helpdesk support with written response targets, managed accounts and devices, email and document security, backup with tested restores, security monitoring and a clear process for practice-software faults. Each area should have a named owner and a record you can review.
How do I choose an IT provider for a law firm?
Give shortlisted providers the same information, compare inclusions and exclusions line by line, ask for written response targets and patching times, and ask each one to walk through a recent incident. Request current certificates and sample records rather than relying on a services list.
Does a law firm need a specialist legal IT provider?
Not necessarily. What matters is whether the provider understands confidentiality obligations, can work with your practice-software vendors and can show how it protects client information. Ask for evidence in those areas.
/ Choose the next step
Move from article guidance to a practical review path.
Pick the route that best matches the issue behind the article so the next conversation starts with the right scope.
Legal IT support
Compare your current support against this checklist
Bring your current agreement, systems list and recent support issues to an initial discussion.