What Should a Law Firm Ask an IT Provider Before Hiring?
Most law firms hire an IT company the way they hire a plumber: someone is recommended, the price sounds reasonable, and the agreement gets signed without much scrutiny. It usually works out. When it does not, the firm discovers the gap during a week it can least afford one.
What should a law firm ask an IT provider before hiring them?
Six things: what is excluded from the monthly fee, who owns your data and documentation, how backups are tested rather than just run, how they handle email security specifically, what happens when you leave, and who actually answers the phone. The answers separate providers far more reliably than any list of certifications.
The questions, and what a good answer sounds like
1. What is not included in the monthly fee?
Every agreement has a line where the flat fee stops and hourly billing starts. That line is the single biggest source of friction in this industry, and it is almost never volunteered. Ask for it explicitly: projects, after-hours work, new employee setup, office moves, vendor coordination, work on software they do not officially support.
A good answer is a specific list. A bad answer is “we handle everything” — nobody handles everything at a flat rate, and a provider who says so has either not read their own contract or is planning to reinterpret it later.
2. Who owns the documentation, passwords and licences?
You do. This is not controversial, and yet firms regularly discover at the point of separation that their network documentation lives in a system they cannot access, or that domains and licences are registered to the provider rather than the firm.
Ask for it in the agreement rather than in conversation. Ask specifically whether you can obtain a current copy of the documentation at any time, without asking permission.
3. How do you test backups — not run them, test them?
A backup that has never been restored is a hypothesis. The distinction matters more in a law firm than almost anywhere else, because the thing you would be restoring is a matter file with a deadline attached.
Ask how often a test restore is performed, whether you get told the result, and how long a full restore would actually take. “We back up nightly” answers a different question than the one you asked.
4. What specifically do you do about email?
This is the question most worth asking, and the one most likely to get a generic answer. Email is where law firms actually lose money. The FBI’s 2025 Internet Crime Report put business email compromise losses at $3.04 billion, with $275.1 million of that across 12,368 real estate complaints alone — and the money that disappears in those cases is frequently the client’s, not the firm’s. The firm gets sued anyway for having been in the email thread.
A good answer covers three things: multi-factor authentication with no exceptions for partners, what happens when a mailbox rule is created quietly by an intruder, and whether anyone is actually watching for that. A bad answer is the name of a spam filter.
5. What does leaving look like?
Notice period, offboarding fee, how your data comes back, and in what format. Ask it during the sales conversation, when you have leverage. It is a reasonable question, and the reaction to it tells you as much as the answer.
6. Who answers when I call?
Not the response-time promise — the actual mechanics. Is the help desk in-house or subcontracted? Not disqualifying either way, but you should know before you find out at 4pm on a filing day. Ask for their real measured response time rather than the number in the brochure, and treat a provider who can produce it as more credible than one who quotes a guarantee.
Two things worth asking that most lists leave out
How do you handle a departing employee? Firms turn over associates and staff, and every departure is a small access-control event. Disabling the case management login is the easy part; the shared front-desk account, the e-filing portal, the scanner with a saved password and the phone that still has firm email on it are the parts that get missed. We wrote a checklist for the same problem in medical practices and it transfers almost directly.
What is your position on trust account access? IOLTA integrity is a bar matter, not an IT matter, but the two touch. Anyone who can reach the accounting system can reach the trust ledger. Ask who at the provider has that access, whether it is logged, and whether it can be limited.
What we would say about ourselves, honestly
We are a small firm in Haines City working across Polk and Osceola. Most of what we do is planned and remote rather than reactive; when hands are needed on site, we schedule it. If your firm needs a technician in the building within the hour, we are not the right fit and we will tell you that on the first call rather than after you sign.
Managed support runs $125 to $299 per user per month depending on whether you need compliance and security work on top of day-to-day support. There is a 90-day money-back guarantee — if we have not made your IT measurably less annoying in the first ninety days, you get your money back and keep your documentation.
If you would like to talk it through, or just want a second opinion on an agreement someone else has put in front of you, we are glad to look at it. Related reading: Clio vs MyCase vs PracticePanther, and how we support law firms.
The same question, other industries
Each of these covers the questions that matter in that specific business, rather than the generic list.
