Managed IT for law firms: protect matter workflows

Map the life of a matter file

Follow a representative document from intake through drafting, review, external sharing and archive. Identify where copies live: a document-management system, email, a local workstation or a client portal. Ask a prospective provider how permissions are granted, reviewed and removed at every step. A folder that everyone can open is not a substitute for an intentional access model.

Include opposing counsel, experts and temporary staff in the discussion. Your firm should decide which people need access; the MSP implements and documents those decisions. Request a process for revoking a shared link without removing the authoritative matter record.

Separate infrastructure support from legal application support

List your document-management, case-management, timekeeping, billing and PDF tools, along with each vendor support contact. An MSP may support the computer and network but not application-specific configuration. Establish who investigates a failed integration, who opens the vendor case and who keeps the affected fee earner informed.

Test a concrete scenario during selection: an attorney can open a file but cannot save changes before a filing deadline. Ask the provider to explain its escalation path and the point at which specialist vendor help is needed. Do not assume every MSP knows your particular application stack.

Choose controls appropriate to your matters

Ask about multi-factor authentication, encrypted managed devices, separate administrator accounts and controlled remote support. Determine whether mobile access, personal devices and travel create exceptions. For highly sensitive matters, discuss additional safeguards with the responsible lawyer rather than treating a standard package as a universal answer.

ABA guidance describes reasonable precautions in context, including the sensitivity of information, applicable law and client agreements. An IT contract does not establish that your firm has met its professional duties. Keep legal judgments with counsel and ask the provider to identify the technical controls it can actually deliver.

Plan recovery around deadlines, not just backup status

Identify the systems needed to retrieve a document, communicate with clients and submit work. Ask what a restoration test includes, who can authorize recovery and whether cloud-only documents are within scope. A report that a backup completed does not prove a usable file can be restored with its permissions intact.

Agree on an escalation contact for time-sensitive disruption and clarify after-hours coverage. Discuss practical fallback access without scattering uncontrolled document copies. Response commitments, restore objectives and any exclusions should be written down; none eliminates the possibility of interruption.

What an engagement should establish

An initial engagement may include an inventory, access review, support takeover and a prioritized remediation plan. Sequence changes around hearings, closings and other firm commitments. Request a named transition owner, a method for handing over administrator access securely and a list of unresolved risks rather than an unsupported all-clear.

Compare proposals using the same number of users, locations and applications. Separate recurring support from migrations, license costs and specialist projects. Preserve firm ownership of accounts, documentation and data, and agree on an orderly exit process before signing.

Questions for prospective MSPs

1. How do you limit your technicians’ access to matter documents?
2. Who owns a document-management issue across multiple vendors?
3. Which recovery tests and after-hours services are included?
4. How will our firm receive credentials and documentation if we leave?