Use This 10-Point Framework to Evaluate a Law Firm IT Provider
To choose an IT company for a law firm, evaluate more than technical skills and monthly price. The provider should demonstrate 10 capabilities: legal workflow experience, live 24/7 support, measurable response standards, layered cybersecurity, Microsoft 365 expertise, tested recovery, compliance support, proactive planning, transparent pricing, and a structured transition process.
For a 25–50 employee law firm, the wrong provider can create slow support, recurring interruptions, unclear accountability, weak security, and lost billable time. The right provider should function like an extension of the firm: understanding how attorneys and staff work, preventing avoidable problems, and responding quickly when an issue threatens a deadline or client matter.
Use the following framework to compare providers using evidence rather than sales promises.
1. Confirm That the Provider Understands Legal Workflows
A law firm does not operate like a generic office. Its technology supports deadlines, client confidentiality, document production, timekeeping, billing, legal research, court filing, remote work, discovery, and communication with clients and opposing counsel.
An IT company that specializes in legal environments should understand how technology interruptions affect:
- Electronic court filings
- Practice-management systems
- Document-management platforms
- Timekeeping and billing applications
- Legal research databases
- Secure client communications
- Document scanning and production
- Remote attorney access
- Microsoft 365, Outlook, Teams, SharePoint, and OneDrive
- Third-party vendors supporting legal applications
The provider does not need to sell every application your firm uses. It should know how to support the surrounding computers, identities, permissions, networks, cloud services, backups, and vendor relationships.
Questions to ask about legal experience
- How many law firms do you currently support?
- What size are those firms?
- Which legal applications have you supported?
- How do you handle issues involving a legal software vendor?
- How do you protect confidential client information?
- How do you support attorneys working remotely or after hours?
- Can you provide a relevant client reference?
A vague claim that the provider “works with professional services firms” is not enough. Ask for examples involving legal workflows, security requirements, urgent deadlines, and application coordination.
2. Test the Help Desk Before You Sign
When an attorney cannot access a case file or submit a court filing, the most important question is not how many certifications the provider lists. It is whether a capable person answers and takes ownership of the problem.
Evaluate the help desk using five criteria:
- Availability: When can attorneys and staff request help?
- Access: Does a live technician answer, or does every request enter a queue?
- Capability: Can the first technician resolve common problems?
- Escalation: What happens when an issue is complex or urgent?
- Ownership: Does someone remain responsible until the issue is resolved?
Ask for measurable support standards
Request written definitions for priority levels, initial response targets, escalation procedures, and communication expectations. A promise of “fast service” is difficult to evaluate unless the provider explains what fast means.
Ask questions such as:
- What qualifies as a critical incident?
- How quickly is a critical ticket acknowledged?
- Who is available outside normal business hours?
- Can users call and reach a live technician?
- When is an on-site technician dispatched?
- How are unresolved tickets escalated?
- How often will the firm receive progress updates?
- Who reviews recurring problems?
911 IT provides live 24/7 access to technicians and reports that most routine support issues can be handled remotely within minutes. That model is especially valuable when a law firm has attorneys working outside conventional office hours.
Learn more about managed IT services and the support, monitoring, security, and planning included in an ongoing relationship.
3. Require a Layered Cybersecurity Program
A provider should not describe cybersecurity as antivirus, a firewall, or a collection of products. Law firm security requires coordinated protection across identities, devices, email, cloud platforms, networks, employees, vendors, backups, and incident response.
At minimum, ask whether the provider manages:
- Multi-factor authentication
- Endpoint detection and response
- Email filtering and impersonation protection
- Microsoft 365 security settings
- Conditional Access
- Disk encryption
- Administrator privileges
- Security updates and application patching
- Vulnerability management
- Security awareness training
- Backup monitoring and recovery testing
- Incident response planning
- 24/7 alert monitoring
Ask who responds to security alerts
Many security tools generate alerts. The important issue is who reviews those alerts and what authority that person has to act.
Ask:
- Are alerts monitored outside business hours?
- Who investigates a suspicious login or compromised device?
- Can the provider isolate a device immediately?
- When is the managing partner or administrator contacted?
- Are incident-response services included in the monthly agreement?
- Will the provider coordinate with cyber insurance and outside counsel?
Explore cybersecurity services and compare the actual controls included in each proposal.
4. Verify Microsoft 365 and Cloud Expertise
Microsoft 365 is central to many law firms, but licenses alone do not create a secure or efficient environment. Email, files, permissions, external sharing, mobile access, retention, administration, and identity policies must be configured and maintained.
A qualified provider should be able to explain how it manages:
- Microsoft 365 user accounts and licensing
- Multi-factor authentication
- Conditional Access policies
- Separate administrator accounts
- SharePoint and OneDrive permissions
- External file sharing
- Teams governance
- Mobile-device access
- Email security
- Audit logs and security alerts
- Retention and recovery requirements
- Employee onboarding and offboarding
Look for practical knowledge, not product familiarity
It is easy for a provider to say it supports Microsoft 365. Ask it to explain how it would handle a realistic legal scenario.
For example:
An attorney needs to share a confidential document set with an outside expert for 14 days. How would the provider limit access, require authentication, prevent broad sharing, monitor activity, and remove access at the end of the engagement?
A capable provider should describe a controlled process rather than recommending that the attorney email attachments or create an unrestricted public link.
Review cloud services for Microsoft 365 management, secure remote work, cloud migration, data protection, and collaboration support.
5. Demand Proof That the Firm Can Recover
Most providers will say they offer backups. That does not establish that your law firm can restore critical systems within an acceptable timeframe.
Ask for evidence of:
- Successful daily backup jobs
- Protected or immutable backup copies
- Separate backup administrator credentials
- Microsoft 365 data protection where required
- Regular restoration testing
- Documented recovery priorities
- Defined recovery time and recovery point objectives
- A written business continuity plan
- Procedures for ransomware, equipment failure, deletion, and cloud outages
Ask to see the most recent restoration-test report
A credible report should identify:
- What system or information was restored
- When the test occurred
- How long the restoration took
- Whether the restored information was usable
- Which problems were discovered
- What corrective actions were assigned
If a provider cannot produce evidence of testing, the firm may have a backup process but not a verified recovery capability.
Learn more about business continuity services and how tested recovery reduces downtime after cyberattacks, system failures, and human error.
6. Evaluate Compliance and Cyber Insurance Support
A law firm’s technology obligations may come from professional rules, privacy laws, client contracts, outside counsel guidelines, court orders, insurance requirements, and industry-specific data.
An MSP should not provide legal conclusions unless it is qualified to do so. It should help the firm translate approved requirements into technical controls and evidence.
Ask whether the provider can help with:
- Security risk assessments
- Client security questionnaires
- Cyber insurance applications
- Written security policies
- Asset and account inventories
- Multi-factor authentication reports
- Encryption verification
- Vulnerability and patching reports
- Backup restoration documentation
- Security training records
- Incident response exercises
- Remediation tracking
Beware of unsupported compliance promises
A provider that promises to make every law firm “fully compliant” without first identifying the applicable requirement and scope is oversimplifying the issue.
A stronger answer is:
“Your counsel determines the firm’s legal and contractual obligations. We map those requirements to technical controls, implement the approved safeguards, test them, and provide evidence.”
That distinction protects the firm from relying on broad assurances that may not withstand a client review, insurance claim, audit, or security incident.
7. Determine Whether the Provider Is Proactive
Reactive support waits for an employee to report that something has failed. Proactive IT management identifies risk, maintenance needs, aging equipment, recurring problems, and capacity issues before they interrupt legal work.
A proactive provider should perform recurring activities such as:
- Monitoring computers, servers, networks, and backups
- Reviewing failed updates and security alerts
- Identifying recurring support issues
- Tracking equipment age and warranty status
- Reviewing Microsoft 365 security and licensing
- Planning replacements before equipment fails
- Evaluating new vulnerabilities
- Reviewing user and vendor access
- Testing backup restoration
- Meeting with firm leadership quarterly
Ask what the provider found before a client reported it
This question quickly separates proactive providers from reactive help desks:
“Give us three examples of issues your monitoring or review process identified before the client experienced an outage.”
The provider should be able to describe real examples involving failing storage, backup errors, expiring certificates, unusual account activity, insufficient capacity, aging equipment, licensing problems, or vulnerable software.
Customer feedback about 911 IT repeatedly emphasizes proactive planning and follow-through. Clients describe the team as looking ahead, recommending improvements, preventing issues, and checking that a fix remains effective instead of closing a ticket prematurely.
8. Compare the Full Scope and Price
For a 25–50 employee law firm, managed IT pricing may be structured per user, per device, as a flat monthly fee, or through a combination of those methods. The lowest proposal is not necessarily the lowest total cost.
Compare whether each proposal includes:
- 24/7 help desk support
- On-site support
- Monitoring and maintenance
- Cybersecurity tools and monitoring
- Microsoft 365 administration
- Backup and recovery
- Security training
- Vendor coordination
- Quarterly strategy meetings
- Technology budgeting
- Incident response
- Projects and after-hours work
Identify exclusions before signing
Request a written list of services that will generate additional charges. Common exclusions can include:
- New hardware and software licenses
- Office moves
- Large cloud migrations
- Cabling
- Major remediation projects
- Special compliance assessments
- Penetration tests
- After-hours project work
- Recovery from physically damaged equipment
Transparent pricing does not mean every possible expense is included. It means the agreement clearly explains the recurring fee, included scope, exclusions, approval process, and project rates.
9. Review the Provider’s Team, Capacity, and Accountability
A law firm should not depend on a single technician who may be unavailable during vacation, illness, or a major incident. The provider should have sufficient depth to support routine tickets, complex projects, cybersecurity events, and on-site needs at the same time.
Ask about:
- Help desk staffing
- Escalation engineers
- Cybersecurity resources
- Microsoft and cloud expertise
- Project-management capabilities
- Local on-site technicians
- After-hours coverage
- Employee background checks
- Training and certifications
- Documentation standards
Ask who will be accountable for your firm
The provider should identify:
- Your primary relationship contact
- Your escalation contact
- Who leads quarterly reviews
- Who owns onboarding
- Who coordinates projects
- Who communicates during a serious incident
Review the 911 IT team to understand the people responsible for help desk support, technical escalation, administration, and client service.
10. Examine the Onboarding and Exit Processes
A provider’s transition process reveals how organized it will be after the sale. Onboarding should involve more than installing remote support software and waiting for tickets.
A structured onboarding process should include:
- Technology discovery
- Account and access review
- Network and device inventory
- Microsoft 365 assessment
- Security baseline review
- Backup validation
- Documentation collection
- Vendor coordination
- Employee communication
- Prioritized remediation plan
Ask for a written 30-, 60-, or 90-day plan
The plan should identify what will happen, who is responsible, what information the firm must provide, and which risks require immediate correction.
Also review what happens when the relationship ends. The agreement should address:
- Ownership of documentation
- Return of credentials
- Removal of management tools
- Transfer of licenses and vendor accounts
- Cooperation with a replacement provider
- Data retention and deletion
- Final billing
A provider confident in its service should not need to hold the firm’s passwords, documentation, domain, or cloud accounts hostage.
Use a 100-Point MSP Evaluation Scorecard
Score each provider from 0 to 10 in the following categories. Multiply nothing; simply add the 10 scores for a total out of 100.
| Evaluation category | Maximum score |
|---|---|
| Legal-industry and workflow experience | 10 |
| Help desk availability and responsiveness | 10 |
| Cybersecurity capability | 10 |
| Microsoft 365 and cloud expertise | 10 |
| Backup and verified recovery | 10 |
| Compliance and insurance support | 10 |
| Proactive planning and reporting | 10 |
| Pricing clarity and service scope | 10 |
| Team depth and local support | 10 |
| Onboarding, documentation, and exit process | 10 |
A provider scoring well should be able to support every answer with a service description, report, process, demonstration, client reference, or contract provision.
Do not award a high score based solely on a salesperson saying, “Yes, we do that.”
15 Questions to Ask Every Prospective Law Firm IT Provider
- How many law firms similar to ours do you currently support?
- Which legal applications and workflows have your technicians supported?
- Can our employees reach a live technician 24/7?
- What are your written response and escalation standards?
- Which cybersecurity protections are included in the monthly fee?
- Who monitors and responds to security alerts outside business hours?
- How do you secure and administer Microsoft 365?
- When did you last test recovery for a client, and what evidence was produced?
- How do you help clients answer cyber insurance and security questionnaires?
- What reports will our partners receive every quarter?
- Which work is excluded from the fixed monthly fee?
- Who will be accountable for our relationship?
- How often will a technician be available on-site?
- What happens during the first 30, 60, and 90 days?
- What documentation and credentials will we receive if the relationship ends?
Red Flags When Interviewing an IT Provider
Pause the selection process when a provider:
- Promises that breaches are impossible
- Cannot describe experience supporting legal workflows
- Uses “unlimited support” without defining scope
- Does not provide written response standards
- Describes antivirus as a complete cybersecurity program
- Cannot show evidence of backup restoration testing
- Provides unverified answers to compliance questionnaires
- Cannot explain who monitors after-hours alerts
- Avoids discussing exclusions and project charges
- Does not perform an assessment before preparing a proposal
- Depends on one technician for most client knowledge
- Will not provide documentation or credentials
- Has no structured onboarding process
- Focuses on products rather than business outcomes
A Practical Example: Comparing Two MSPs for a 35-Employee Firm
Consider a Salt Lake City law firm with 35 employees, one office, remote attorneys, Microsoft 365, a cloud practice-management system, and confidential client information.
Provider A submits the lower monthly price. It includes business-hours support, basic antivirus, remote monitoring, and backup software. On-site service, Microsoft 365 projects, security training, after-hours help, and incident response cost extra. The provider cannot produce a recent restoration-test report.
Provider B costs more each month but includes live 24/7 support, local on-site assistance, managed endpoint security, Microsoft 365 administration, email protection, backup testing, employee training, vendor coordination, quarterly planning, and documented escalation.
The correct decision depends on the firm’s needs, but the two proposals should not be treated as equivalent. Provider A is selling a narrower service. Provider B is offering a broader operating and risk-management model.
The firm should compare total scope, security exposure, downtime risk, additional charges, and leadership time—not just the monthly total.
What Legal Clients Value in a Long-Term IT Relationship
Customer feedback collected by 911 IT reveals several consistent expectations that are especially relevant to law firms:
- A real person answers when help is needed.
- Technicians remain patient when users are stressed.
- Remote support resolves problems without unnecessary delay.
- The provider learns the client’s systems and working style.
- Problems are owned until they are completely resolved.
- Security and maintenance are handled proactively.
- Local technicians are available when on-site help is required.
- The provider feels like part of the client’s internal team.
One legal-industry partner described the benefit of using one company for interconnected IT, phone, and hosting services. Remote diagnosis helped minimize downtime and created peace of mind.
A legal-services owner described relying on 911 IT for email, court filing, legal research, document access, and daily attorney technology. The client emphasized live support, patience, clear explanations, and technicians who stayed with the issue until it was resolved.
These examples reinforce an important selection principle: technical expertise matters, but the quality of the working relationship determines how that expertise is delivered during a stressful moment.
Frequently Asked Questions
Does an MSP need to work exclusively with law firms?
No. A provider can serve several industries and still have meaningful legal experience. It should be able to demonstrate that it understands legal workflows, confidentiality concerns, support urgency, Microsoft 365, legal applications, and client-driven security requirements.
Should a law firm choose a local or national IT provider?
A national provider may offer broad coverage, while a local provider may provide faster on-site assistance and a closer working relationship. A multi-location firm may benefit from a provider that combines centralized remote support with technicians near its offices.
How many employees should an MSP have?
There is no universal minimum. The provider should have enough depth to cover help desk support, escalation, cybersecurity, projects, strategic planning, and employee absences without depending on one person.
Should 24/7 support be included?
Law firms with attorneys working early, late, remotely, or across time zones should know how urgent issues will be handled outside business hours. Confirm whether live support is included or billed separately.
What certifications should a law firm look for?
Certifications can demonstrate training in Microsoft platforms, networking, cloud services, cybersecurity, and compliance frameworks. They should supplement—not replace—relevant experience, documented processes, client references, and measurable service results.
How long should it take to switch IT providers?
The timeline depends on the firm’s size, locations, documentation, security condition, vendors, and cooperation from the outgoing provider. A 25–50 employee firm should expect a phased process involving discovery, documentation, security review, deployment, communication, and remediation.
Should an IT provider own the firm’s accounts?
The law firm should retain appropriate ownership and administrative control over its domain, Microsoft tenant, software subscriptions, documentation, and other essential business accounts. The provider may administer them on the firm’s behalf.
How often should the MSP meet with firm leadership?
Quarterly strategic reviews are appropriate for many 25–50 employee firms. More frequent meetings may be needed during onboarding, major projects, rapid growth, compliance initiatives, or security remediation.
Choose Evidence, Accountability, and Fit
The best law firm IT company is not simply the provider with the lowest price, largest tool list, or most polished proposal. It is the provider that can prove it understands your workflows, responds when legal work is at risk, protects confidential information, tests recovery, documents controls, and accepts responsibility for results.
Score each candidate using the same 100-point framework. Verify important claims through reports, processes, references, demonstrations, and contract language. Then select the provider whose service model best fits the firm’s risk, working style, support expectations, and growth plans.
911 IT has served Salt Lake City-area businesses since 2004 and provides live 24/7 support, local on-site service, managed cybersecurity, Microsoft cloud expertise, business continuity, proactive planning, and predictable managed IT pricing.
Explore our managed IT services, read the six questions law firms should ask their IT provider every quarter, or schedule a 10-minute discovery call to evaluate your firm’s current support, security, and technology risks.
