Choosing a managed IT provider is a bigger decision for a law firm than for most businesses, because the provider will hold keys to client confidences. For a multi-office law firm, the stakes rise again. Every office needs the same support and security settings, on a network that keeps working when one site goes down. A provider that looks strong in a sales meeting can still fall short on any of these, and the gaps usually show up during an outage or a security incident.
This checklist gives you 12 points to test before you sign. It draws on ABA ethics opinions and survey data, along with government guidance written specifically for customers of managed service providers. It’s written for managing partners and the administrators or IT leads who need a structured way to compare providers and document their decision.
TL;DR:
Judge a managed IT provider on 12 points: legal software experience, support coverage at every office, network design across sites, baseline security controls, the provider’s own security, confidentiality controls, backup and recovery, incident response, help with client security questionnaires, compliance support, AI governance, and contract terms. Ask for evidence, such as a SOC 2 Type II report and references from other multi-office firms. Use government guidance to write the MSP contract, including incident notice and subcontractor disclosure. Keep your own offsite backups. ABA Model Rules and formal opinions provide guidance on supervising outside providers, while state-specific ethics rules and other applicable laws control the firm’s actual obligations.
What a Managed IT Provider Does for a Multi-Office Law Firm
A managed IT provider, often called an MSP, runs some or all of a firm’s technology under an ongoing contract. That can include help desk support, device management, network monitoring, security tools, backups, and vendor management for legal software. Some firms hand over everything. Others keep an internal IT lead and use the provider for after-hours coverage, security monitoring, or specific projects.
For a multi-office law firm, the provider also holds the firm together technically. It should keep access, identity controls, security policies, connectivity, and application availability consistent across locations, whether the firm uses cloud systems, SD-WAN, VPNs, or another multi-site design. When this work is done well, lawyers barely notice it. When it’s done poorly, each office drifts into its own setup, and problems at one site become hard to diagnose from another.
The provider’s role also carries ethical weight. Law firm IT support involves access to client files and email. That access puts the provider inside the firm’s confidentiality obligations, which is why evaluating a managed IT provider needs to go further than price and response times. Law firm cybersecurity depends on the provider as much as on the firm’s own policies.
Why Law Firms Need a Stricter Evaluation Than Other Businesses
Law firms carry professional duties that most businesses don’t. ABA Formal Opinion 08-451 says lawyers may outsource nonlegal support work, including using an outside vendor to maintain a firm’s computer systems, subject to the professional duties discussed in the opinion. The ABA Model Rules and formal opinions are professional guidance rather than a single nationwide set of controlling rules. The ABA notes that its Model Rules and ethics opinions are advisory, while the ethics rules, laws, and court decisions in each jurisdiction control the lawyer’s actual obligations.
Other ABA opinions address related issues. Formal Opinion 477R covers securing client communications, 483 addresses obligations after a data breach, and 498 deals with virtual practice. A firm evaluating an MSP should therefore check the rules that apply in its jurisdiction, along with any client, regulatory, or contractual duties, even when the provider manages the systems that store or transmit client information.
The survey data shows why this matters. The ABA’s 2023 Cybersecurity TechReport reported that 29% of respondents said their firm had experienced a security breach, though the report notes that “breach” included incidents such as a lost laptop. Newer 2024 ABA survey data reported that 39.9% of respondents said their firm had an incident response plan. The 2023 survey also reported that 40% of respondents said their firm carried cyber liability insurance. These figures come from different survey years, so they should be read as dated findings rather than current benchmarks for every law firm.
The 12-Point Checklist at a Glance
The table below lists all 12 points and what each one protects. The sections that follow explain what to ask and what evidence to request.
| Point | What to Evaluate | What It Protects |
| 1 | Legal software experience | Daily productivity |
| 2 | Support coverage at every office | Consistent service across sites |
| 3 | Network design across offices | Uptime and shared access |
| 4 | Baseline security controls | Firm and client data |
| 5 | The provider’s own security | Protection from supply chain attacks |
| 6 | Confidentiality and ethical walls | Client confidences |
| 7 | Backup and recovery | Business continuity |
| 8 | Incident response | Containment and notice duties |
| 9 | Client security questionnaires | Client relationships |
| 10 | Compliance frameworks | Regulatory and insurer demands |
| 11 | AI governance | Confidentiality in new tools |
| 12 | Contract terms | Negotiating power and exit options |
Weigh the points by your firm’s needs. A firm with heavy healthcare work may rank compliance higher, while a firm with many small offices may care most about on-site coverage. Agree on the weighting before you meet providers, so a polished presentation doesn’t reset your priorities.
Legal and Operational Fit
The first 3 points test whether a provider can actually run a law firm across several locations. Many providers support professional services firms, but legal work has its own software and deadlines.
Point 1: Experience With Legal Software
Ask which legal applications the provider supports today. Document management, practice management, time and billing, and e-discovery tools each have their own integrations and upgrade cycles. A provider offering law firm IT support for these tools can fix problems faster and plan upgrades without disrupting a trial calendar.
Ask for references from at least 2 other law firms with several offices, and call them. Ask how the provider handled a major software upgrade and whether lawyers trust the help desk. References from single-office firms are useful, but they won’t tell you how the provider handles work spread across sites.
Point 2: Support Coverage at Every Office
A firm with several offices needs the same level of law firm IT support in every location. Ask whether the provider has technicians near each office and how quickly someone can be on site. Check whether response times differ by location. Some providers offer fast on-site help in their home city and much slower help elsewhere.
Get response and resolution targets in writing for each office, split by priority level. Ask how remote lawyers and lawyers working from court or client sites are supported. Also ask about after-hours coverage, since filings and client deadlines don’t follow business hours.
Point 3: Network Design Across Offices
Ask the provider to describe how it would connect your offices. Key questions include how offices share files and applications, and what happens if one office’s internet connection fails. A good provider will explain its design in plain terms and show how it avoids a single point of failure.
Consistency matters as much as speed. Ask how the provider keeps settings and security policies the same across every office. When each site is configured differently, troubleshooting slows down and security gaps appear in the office that gets the least attention.
Include phones and video in the discussion. Many firms run a shared phone system and conferencing tools across offices, and a failure there can stop client calls and remote hearings. Ask whether the provider manages these systems or only supports the network they run on. If another vendor handles phones, agree on who owns problems that fall between the two, so issues don’t bounce back and forth while clients wait.
Security Controls and the Provider’s Own Risk
Points 4 to 6 cover security inside the firm and at the provider itself. They deserve close scrutiny because a managed IT provider may hold privileged access to firm systems and client data, so its security claims need evidence.
Point 4: Baseline Security Controls
Start with the basics. Ask whether the provider enforces multifactor authentication on all accounts, manages patching on a set schedule, runs endpoint detection and response tools, and filters email for phishing. The 2024 ABA Legal Technology Survey reported that 58.6% of respondents said their firms had 2-factor authentication available. Treat that as a 2024 survey finding, not as a current adoption benchmark for every firm.
Ask for evidence, not promises, since strong law firm cybersecurity depends on controls that actually run every day. Request sample reports showing patch status and MFA coverage. Check how privileged access is granted and revoked, whether technicians use named administrator accounts, and whether those administrator accounts are separated from day-to-day email and user accounts. Ask how the provider manages firm devices, applies encryption, collects security logs, and checks that required controls are operating consistently across every office. Check that the provider’s standard setup matches what your cyber insurer requires, since insurers often ask detailed questions about these controls at renewal.
Ask about training as well. Many attacks start with a phishing email or a convincing phone call, so staff awareness is part of the baseline. Find out whether the provider runs security training and simulated phishing tests, how often, and whether it reports results by office. Offices with weaker results can then get extra attention before an attacker finds them.
Point 5: The Provider’s Own Security
The provider itself is a target, which makes it part of your law firm cybersecurity program. CISA’s current #StopRansomware Guide identifies third parties and managed service providers as possible initial access vectors and notes that MSPs have been an infection vector for ransomware affecting multiple client organizations. Because a provider may hold privileged access across many customers, its remote access and administrative controls need direct review.
Ask how the provider protects its remote management tools and administrator accounts. Ask whether its staff use MFA for every client connection and whether access is limited to what each technician needs. CISA’s guidance also calls for least privilege and separation of duties for third-party access, which gives you practical controls to verify during the evaluation.
Ask for an independent SOC 2 report. A Type 2 report provides evidence about the operating effectiveness of tested controls across a review period, but the label alone doesn’t show whether the report fits the services you’re buying. Review the system and services in scope, the relevance and severity of exceptions, any subservice organizations, complementary controls the firm must operate, and whether the tested controls cover the services the law firm will actually use. AICPA guidance on SOC reporting provides the underlying reporting framework.
Point 6: Confidentiality and Ethical Walls
Law firms need controls that most businesses don’t. Ask how the provider will configure, support, monitor, and document matter-level permissions and ethical walls in the firm’s actual legal applications and identity systems. Confirm which controls the MSP manages, which stay with the software vendor or the firm’s internal administrators, and how the provider will show that access rules are working as intended.
Also ask how the provider limits its own technicians’ access to client documents. Most support work doesn’t require opening files. A good provider can explain how it separates administrative access from access to content and how it logs any time a technician views client data.
Some clients add their own rules. Outside counsel guidelines may require that access to certain matters be limited to named people or that data stay in a particular country. Ask how the provider would set up and monitor these restrictions, and how it would prove to a client that they’re being followed.
Resilience and Response
Points 7 and 8 cover what happens when something goes wrong. For a firm with several offices, an outage at one site shouldn’t stop work at the others, and an incident needs a clear plan from the first hour.
Point 7: Backup and Recovery
Ask where backups are stored and how they’re protected from ransomware. Ask how often the provider tests restores and whether you can see the results. The ABA’s 2023 survey found that 43% of respondents used online backup services. That figure is a 2023 finding, and the evaluation should focus on whether the provider can restore the firm’s systems within agreed targets.
Agree on recovery targets for each office and each key system. How long can the document management system be down? How much email can you afford to lose? Ask whether the provider can restore one affected office or service without disrupting locations that are still operating, and require records from recent restore tests that show what was recovered and how long it took. CISA’s guidance for managed service provider customers also recommends that organizations keep their own offsite backups of essential records and network logs so they can recover from an incident involving the provider itself.
Point 8: Incident Response
Ask for the provider’s incident response plan and how it would work with yours. Key questions include who leads the response and how quickly the provider will tell you about a suspected incident. For a multi-office firm, ask how the provider would isolate an affected location while keeping unaffected offices working, who the escalation contacts are for each location, and how status updates will be coordinated across offices. Make sure the plan fits the firm’s applicable ethical, client, and legal notice duties.
Ask how the provider works with cyber insurers and breach counsel. Many policies require the firm to use approved response firms, and the provider must be able to cooperate with them. Run a tabletop exercise before signing or make it a defined onboarding requirement. Use a scenario that starts in one office and tests whether the provider can contain the incident without unnecessarily interrupting the others.
Client and Compliance Demands
Points 9 to 11 cover the requirements that come from outside the firm: clients, regulators, insurers, and new technology. These affect law firm cybersecurity as much as any technical control.
Point 9: Client Security Questionnaires
Clients increasingly ask about security. The ABA’s 2023 Cybersecurity TechReport found that 22% of respondents had been asked by a client or prospective client to complete a security questionnaire, rising to 50% for firms with more than 100 lawyers. The same 2023 survey found that 27% of respondents had been asked for the firm’s security requirements documents and 14% had faced a request for a security audit or review. These are 2023 survey findings, not current benchmarks. Each request still needs accurate answers about systems the provider may manage.
Ask whether the provider will help answer these questionnaires as part of its law firm IT support and supply evidence, such as policies and audit reports. Provider documentation can reduce internal work and help the firm answer client requests consistently.
Point 10: Compliance Frameworks
Ask which security frameworks the provider aligns its services to. The NIST Cybersecurity Framework 2.0 is a common reference point for managing cybersecurity risk. CSF 2.0 added the Govern function and gives supply chain risk management a defined place in the framework. Ask the provider to map the controls it will operate for your firm to the parts of the framework that apply to those services.
Check specific obligations, too. If the firm is subject to HIPAA-related business associate obligations, determine whether the MSP will create, receive, maintain, or transmit protected health information on behalf of a covered entity or business associate and whether a business associate agreement is required for that relationship. HHS explains the circumstances in which covered entities and business associates must use written business associate arrangements. If you have clients in other regulated industries, ask how the provider supports the requirements that apply to the firm’s work.
Point 11: AI Governance
Many providers now help firms roll out AI tools, and that brings additional confidentiality and supervision questions. ABA Formal Opinion 512, issued in July 2024, applies existing ABA Model Rule duties to lawyers’ use of generative AI. The opinion discusses competence, confidentiality, communication, supervision, duties to tribunals, and fees.
For outside providers, the opinion says supervisory principles under Model Rule 5.3 apply when lawyers rely on nonlawyers using generative AI in connection with a representation. It points to vendor due diligence such as reviewing security policies, confidentiality terms, data handling, retention, and breach-related terms. Ask the MSP how it controls what firm or client information AI tools can access, what happens to submitted data, and how the provider evaluates AI vendors before deployment. As with other ABA ethics guidance, the firm’s controlling obligations depend on the rules and law that apply in its jurisdiction.
Contract Terms That Protect the Firm
The contract turns every answer above into a commitment. A weak MSP contract can leave a firm with few options if service slips or a breach occurs.
Point 12: Contract Terms
CISA’s guidance on managed service providers lists what customers should ask for before signing. It recommends specific service level agreements that separate IT operations from security services, detailed incident management terms, documentation of employee vetting, and notice of subcontractors that could access your data. It also suggests direct access to security logs for the systems the provider manages.
The joint advisory adds that customers should verify contracts include cybersecurity measures in line with their own security requirements. Use this table to check the key clauses in any MSP contract:
| Clause | What to Look For |
| Service levels | Response and resolution targets by priority and by office |
| Security services | Named controls, monitoring scope, and reporting |
| Incident notice | Time limit for telling you about suspected incidents |
| Subcontractors | Disclosure and approval before they access your data |
| Staff vetting | Background checks for anyone with access |
| Log access | Your right to see security logs for managed systems |
| Audit rights | Access to SOC 2 reports and the right to review controls |
| Insurance | Cyber and professional liability coverage with stated limits |
| Data ownership and exit | Return of data, credentials, and documentation, plus transition help |
| Pricing and renewal | Recurring fees, project charges, travel costs, onboarding and offboarding fees, and renewal increases |
Exit terms deserve extra care. Make sure the firm owns its data and administrator credentials, and that the provider must hand over documentation and help with a transition. Without these terms, changing providers can become slow and risky. CISA’s guidance also recommends a legal review of all MSP contracts, which is simple advice for a law firm to follow. The ABA’s list of cybersecurity resources for small and solo firms includes a vendor contracting cybersecurity checklist from its Cybersecurity Legal Task Force, which is a useful cross-check for the clauses above.
How to Run the Evaluation
A structured process makes providers easier to compare and gives you a record of your diligence. That record also supports your supervision duties under the ethics rules. Follow these steps:
1. Document your current environment. List offices, users, applications, and known problems.
2. Set your weighting. Decide which of the 12 points matter most before talking to providers.
3. Send a written questionnaire. Ask every provider the same questions, based on this checklist.
4. Request evidence. Ask for SOC 2 reports and a draft MSP contract.
5. Hold structured demos. Ask each provider to walk through a scenario, such as an office losing its internet connection.
6. Call references. Speak to at least 2 firms with several offices that each provider supports.
7. Score and decide. Score each provider against your weighting and record the reasons.
Involve a partner and whoever handles IT today. Lawyers can judge how a provider communicates, while operations staff can judge whether its process will work day to day. Keep the evaluation file with your vendor records.
Scoring Providers Side by Side
A simple weighted scorecard keeps the decision grounded. Before calculating a total, set minimum pass criteria for areas the firm treats as non-negotiable, such as the provider’s own security, incident response, or backup and recovery. A provider that fails one of those minimums shouldn’t move to weighted scoring until the gap is resolved. For providers that pass the minimums, rate each one from 1 to 5 on every point, then multiply by the weight you set. The example below is illustrative and uses made-up weights for a firm with 4 offices and a growing client questionnaire load.
| Point | Weight (Example) | What a 5 Looks Like |
| Legal software experience | 10% | Supports your core applications at other multi-office firms |
| Support at every office | 10% | Written on-site targets for each location |
| Network design | 8% | Backup connections and consistent settings everywhere |
| Baseline security | 10% | MFA, patching, and monitoring with sample reports |
| Provider’s own security | 12% | Current SOC 2 Type 2 report with relevant scope and no unresolved material exceptions affecting your services |
| Confidentiality controls | 8% | Matter-level access and logged content access |
| Backup and recovery | 10% | Tested restores and agreed recovery targets |
| Incident response | 8% | Written plan and insurer coordination |
| Client questionnaires | 6% | Standard answers and evidence packs ready |
| Compliance frameworks | 6% | Controls mapped to a recognized framework |
| AI governance | 4% | Clear data controls for AI tools |
| Contract terms | 8% | Accepts key clauses, including exit terms |
Change the weights to fit your firm. Apply the minimum pass criteria first, then compare weighted totals only among providers that clear those gates. This keeps an essential control failure from being hidden by stronger scores in lower-risk areas.
Pricing Models and What Drives Cost
Treat pricing as part of Point 12 and the contract review, rather than as a separate commercial check. Compare the scope behind each quote rather than the headline number. Most providers charge a monthly fee based on users, devices, or a fixed package, then bill projects and extra services separately. Per-user pricing is common for law firm IT support, since lawyers often use several devices. Per-device pricing can suit firms with many shared machines, such as those in conference rooms or at reception.
Ask what the monthly fee includes and what triggers extra charges. Common add-ons include after-hours support, on-site visits beyond a set number, security monitoring, backup storage, and project work like office moves or major software upgrades. A low base fee can grow quickly if routine work falls outside the package. For a firm with several offices, check whether travel time to remote sites is billed separately.
Onboarding fees are also common. Ask what the fee covers, such as documentation and security fixes found during the first assessment. Ask how pricing changes when the firm adds an office or new lawyers, and write that formula into the contract. Price increases should be capped or tied to a clear index, so renewal doesn’t bring a surprise.
Finally, compare total contract cost with the services included, the exclusions, the internal work the firm will still need to handle, and likely project charges. Include recurring fees, travel costs, onboarding charges, offboarding costs, and renewal increases in the comparison. Compare quotes over the full contract term so the evaluation reflects the full price of each proposal.
Onboarding and the First 90 Days
Evaluate onboarding before you sign. Ask each provider for its proposed 30/60/90-day onboarding plan, with dates and owners for documentation, security assessment work, support cutover, and fixes identified during the transition. Compare how specific each plan is and whether the provider can explain what it needs from every office before service begins.
Ask for the proposed credential-transfer and handover process. The provider should explain how it will receive and verify administrator credentials, network diagrams, license records, backup access, and other system documentation from the outgoing provider or internal team. It should also document how previous provider accounts and remote access tools will be identified, revoked, or removed after the handover.
Ask what the provider expects to review at 30, 60, and 90 days and what evidence the firm will receive at each point. That can include service metrics by office, unresolved security findings, documentation gaps, and remaining transition work. Evaluating this plan before signing shows how the MSP intends to take control of the environment and gives the firm terms it can attach to the contract.
Red Flags During Evaluation
Some warning signs should slow or stop a decision about law firm IT support. Watch for these during the process:
• No independent audit. The provider can’t share a SOC 2 report or similar evidence.
• Vague answers on its own security. It avoids questions about how it protects its remote tools and admin accounts.
• No law firm references. It can’t connect you with other law firms with several offices.
• Uneven coverage. Response times are strong in one city and unclear elsewhere.
• Hidden subcontractors. It won’t disclose who else may access your systems.
• Weak exit terms. The contract is silent on data return or transition help.
• Unclear administrative access. It won’t document who receives privileged access, how that access is revoked, or which offices and systems each account can reach.
One flag doesn’t always end the conversation, since a provider may fix a gap when asked. Several flags together, especially around the provider’s own security and contract terms, suggest a partner that will be hard to supervise.
Putting the 12-Point Checklist to Work
Use the 12 points to compare providers against the same requirements across every office. Request evidence for security and recovery claims, verify references from other multi-office firms, and test realistic scenarios before making a decision.
Document the obligations you accept in the contract, including service coverage, security responsibilities, incident terms, pricing, and exit requirements. Keep the evaluation record with the firm’s vendor documentation so later reviews can compare actual performance with what the provider agreed to deliver.
Frequently Asked Questions
Why Do Multi-Office Law Firms Need a Different Evaluation?
A multi-office law firm needs consistent support, access controls, security policies, and application availability across locations. The evaluation should also test what happens when one office loses connectivity or has a security incident while other offices remain operational.
Are Law Firms Allowed to Outsource IT?
ABA Formal Opinion 08-451 says lawyers may outsource nonlegal support services, including computer-system support, under the ABA Model Rules framework. The ABA’s Model Rules and formal opinions are advisory, so firms should check the ethics rules and other law that apply in their jurisdiction.
What Should an MSP Contract Include?
Key terms include service levels by office, defined security services, incident notice time limits, subcontractor disclosure, staff vetting, log access, audit rights, insurance, pricing and renewal terms, and clear data ownership and exit obligations.
How Important Is Law Firm Cybersecurity When Choosing a Provider?
Cybersecurity deserves close scrutiny because an MSP may hold privileged access to firm systems and client information. Evaluate the provider’s access controls, logging, incident response, and independent audit evidence alongside the other criteria that matter to your firm.
What Does Law Firm IT Support Typically Cover?
It usually covers help desk support, device management, security tools, backups, network monitoring, and vendor management for legal applications. Some firms also use providers for projects and compliance support.
How Does ABA Formal Opinion 512 Affect IT Providers?
ABA Formal Opinion 512 applies existing ABA Model Rule duties to lawyers’ use of generative AI. Its supervision discussion covers reliance on outside nonlawyers and points lawyers toward vendor due diligence on security, confidentiality, and data handling. Firms should still check the rules that control in their jurisdiction.
Can a Provider Help With Client Security Questionnaires?
Yes. Ask whether questionnaire support is included in the service scope and whether the provider can supply current policies, audit reports, architecture details, and other evidence needed for consistent client responses.
How Often Should We Review Our Managed IT Provider?
Review performance and incident records at least once a year. Also review after a major incident, a material service change, or a new office opening.
Should a Multi-Office Law Firm Keep Any IT Staff In-House?
Many firms keep an internal IT lead or firm administrator who manages the provider and sets priorities. The right model depends on the firm’s size, systems, office footprint, and the responsibilities it chooses to retain internally.