Managed IT Services for Law Firms: The Complete Buyer’s Guide

Choosing an IT provider for a law firm is about more than finding someone to fix technical problems.

Technology supports almost every part of modern legal work, from accessing matter files and communicating with clients to managing documents and working securely outside the office. The provider responsible for that environment can therefore have a direct impact on productivity, security and business continuity.

However, managed IT services for law firms can vary considerably between providers. Similar-looking proposals may include very different levels of support, security and strategic advice.

This guide explains what a managed IT service should include, what to look for in a provider and the questions worth asking before making a decision.

What Are Managed IT Services for Law Firms?

Managed IT services involve outsourcing some or all responsibility for an organisation’s technology to an external provider.

Rather than only responding when something goes wrong, a managed IT provider should proactively maintain the IT environment, identify risks and help plan for future requirements.

For a law firm, this commonly includes:

• IT service desk support;
• proactive monitoring and maintenance;
• device and user management;
• Microsoft 365 and cloud support;
• cyber security;
• patching and vulnerability management;
• backup and disaster recovery;
• support for legal applications; and
• ongoing technology planning.

The exact scope varies between providers, making it important to understand what’s actually included when comparing managed IT support for law firms.

Why Does Legal-Sector Experience Matter?

The technologies used by law firms may be similar to those found in other professional services organisations, but the environment brings particular requirements.

Firms routinely handle confidential client and commercially sensitive information, while fee earners depend on reliable access to systems, documents and communications to progress time-sensitive work.

Cyber security is also a significant consideration. Legal practices hold information and, in many cases, funds that can make them attractive targets for cybercrime. Effective protection extends beyond security software to include access controls, monitoring, processes and user awareness.

An IT provider supporting a law firm should therefore understand areas such as:

• client confidentiality and data protection;
• secure hybrid working;
• identity and access management;
• legal and practice-management applications;
• cyber-security monitoring and incident response;
• backup and business continuity; and
• technology controls supporting wider risk management.

An IT provider doesn’t replace the firm’s own regulatory responsibilities, but it should be able to support the technical controls behind them. Firms assessing their current position can use an SRA IT compliance checklist for law firms to identify areas where technology, policies or processes may need closer attention.

What Should Managed IT Services for a Law Firm Include?

One of the biggest challenges when comparing providers is determining what the proposed monthly service actually covers.

Service desk and escalation

Users need a clear route for getting help and a defined process for escalating complex or urgent issues.

Check the provider’s support hours, how issues are prioritised, expected response times and what happens if a problem can’t be resolved by first-line support.

Proactive monitoring and maintenance

Managed IT support should aim to prevent problems as well as resolve them. This can include monitoring infrastructure and devices, maintaining systems and identifying potential issues before they cause disruption.

Microsoft 365, devices and access

Support should extend across the technologies employees rely on day to day.

Depending on the firm’s requirements, this could include Microsoft 365, Teams and SharePoint alongside device management, multi-factor authentication, Conditional Access and user permissions.

Patching and vulnerability management

Keeping systems updated helps close known vulnerabilities and reduce avoidable security exposure.

A provider should be able to explain how systems are patched, how vulnerabilities are identified and how higher-risk issues are prioritised.

Backup and disaster recovery

Maintaining copies of data is only part of the requirement.

Firms also need to understand how systems and information would be restored following an outage, cyber incident or other disruption. Ask what is backed up, how recovery is tested and what recovery objectives the service is intended to meet.

Cyber security

Cyber security should be considered as part of the managed IT service rather than an afterthought.

Depending on requirements, the service might include:

• endpoint and email protection;
• MFA and access controls;
• vulnerability management;
• security monitoring;
• security awareness training; and
• incident response.

Where the required controls extend beyond day-to-day IT management, establish whether they’re included within the service or require more specialist cyber security support for the legal sector. Akita’s existing legal security content covers areas including access controls, third-party technology, incident response and security governance in greater depth.

Legal application support

Ask providers about their experience with the applications the firm actually depends on, such as practice and case-management systems, document-management platforms, accounts systems and eDiscovery solutions.

An IT provider doesn’t necessarily need to replace specialist vendor support. However, it should understand how those applications interact with the wider IT environment and be able to work effectively with software vendors when issues arise.

Strategy and reporting

Managed IT shouldn’t stop at operational support.

Regular reviews should help the firm understand recurring issues, security risks and upcoming technology requirements, as well as opportunities to improve the IT environment.

Fully Managed vs Co-Managed IT Support

Not every law firm needs to outsource its entire IT function.

Fully managed IT typically suits firms without a substantial internal IT team. The provider assumes responsibility for agreed areas of day-to-day technology management and support.

Co-managed IT combines the firm’s own IT resource with additional external expertise. An internal IT manager might retain responsibility for business systems and strategy, for example, while using a provider for service desk capacity, specialist security knowledge or escalation support.

Neither approach is automatically better. The right model depends on the expertise already available internally, where additional capacity is needed and which responsibilities the firm wants to retain.

What Should You Look for in a Law Firm IT Support Provider?

Before comparing prices, establish whether each provider can support the environment your firm actually has.

Relevant legal-sector experience

Ask about experience supporting other legal practices.

The important consideration isn’t simply whether the provider has law firm clients. It is whether its team understands the requirements around confidential information, specialist applications, fee-earner productivity and the potential impact of downtime.

Clear service commitments

Avoid relying on vague promises such as “responsive support”.

Establish the provider’s:

• support hours;
• response targets;
• priority definitions;
• escalation routes; and
• onsite support arrangements.

These should be clearly documented.

If recurring issues or uncertainty over service quality have prompted a review, it can be useful to consider whether your current IT support provider still meets the firm’s needs before comparing alternatives.

Security expertise

Security shouldn’t be something discussed only after a provider has been selected.

Ask how identities, endpoints, Microsoft 365 and other systems will be protected. Also establish which organisation is responsible for detecting and responding to security incidents.

Third-party services deserve particular attention.

Case-management applications, cloud services and hosted eDiscovery platforms may process or store sensitive information outside the firm’s immediate IT environment. The provider should be able to explain how access is secured, how risks are managed and where responsibility sits between the law firm, IT provider and software vendor.

Strategic capability

Technology requirements change over time.

A provider should be able to help with technology roadmaps, Microsoft 365 development, security improvements and planning for growth, acquisitions or office changes rather than simply maintaining the current environment indefinitely.

10 Questions to Ask a Managed IT Provider

Asking prospective providers broadly the same questions makes their services much easier to compare.

1. What experience do you have supporting law firms?

Ask for relevant examples and, where appropriate, case studies or client references.

2. What exactly is included in the monthly service?

Identify both inclusions and exclusions. A lower headline price may simply represent a narrower service.

3. What response and escalation commitments do you provide?

Understand how priorities are determined and how unresolved or urgent problems are escalated.

4. Which of our legal applications can you support?

Give providers a list of critical systems and establish where their responsibility ends and the software vendor’s begins.

5. How will you manage cyber security?

Establish which controls are included, what requires a separate service and who is responsible for monitoring and responding to incidents.

If certification forms part of the firm’s security plans, it is also worth considering how Cyber Essentials applies to law firms and what technical changes may be required to achieve it.

6. How will you protect Microsoft 365, users and devices?

The provider should be able to explain its approach to MFA, permissions, endpoint protection and access management in practical terms.

7. How do you manage third-party technology risk?

Ask how the provider approaches cloud systems, case-management applications, eDiscovery platforms and other services that hold or provide access to firm data.

8. What does onboarding involve?

There should be a structured process for discovering systems, documenting the environment, reviewing security and transferring support.

9. How will our IT service be reviewed?

Establish who will manage the relationship, how service performance and risks will be reported and how future technology requirements will be discussed.

10. What happens if we leave?

Understand how documentation, administrative access and data will be transferred, whether exit charges apply and what assistance will be provided to a replacement supplier.

How to Compare Managed IT Proposals

Don’t compare proposals purely on monthly cost per user. Similar prices can represent significantly different services.

Provider red flags

Look more carefully at a proposal if:

• exclusions aren’t clear;
• response commitments aren’t defined;
• cyber security is largely absent;
• the provider can’t explain how key legal applications will be supported;
• there’s no structured onboarding process;
• incident-response responsibilities are unclear;
• additional project charges are difficult to identify; or
• ownership of credentials, documentation and data at contract end isn’t clear.

No provider can take responsibility for every technology-related risk. The important thing is knowing where responsibilities sit.

What Does Managed IT Support Cost for a Law Firm?

There is no meaningful standard price for outsourced IT support for law firms because requirements can differ substantially.

Cost is typically influenced by:

• number of users, devices and offices;
• condition of the existing technology;
• required support hours and service levels;
• cyber-security requirements;
• Microsoft 365 and cloud requirements;
• backup and disaster recovery;
• complexity of legal applications; and
• onboarding and project requirements.

Two proposals can therefore have significantly different prices without the more expensive option necessarily providing better value.

A better question is: what does each provider take responsibility for at the proposed price?

A low monthly charge can quickly become less attractive if important security controls, strategic support or routine activities regularly incur additional costs.

What Should You Expect When Changing IT Provider?

Concern about disruption can make firms reluctant to change provider even when the existing service is no longer meeting their requirements.

A properly managed transition should reduce that risk.

This will typically involve:

1. discovering the existing environment;
2. gathering and validating documentation;
3. reviewing administrative access and security;
4. agreeing responsibilities with the outgoing provider;
5. creating a transition plan;
6. onboarding users, devices and systems;
7. communicating new support arrangements; and
8. monitoring the environment following handover.

Changing provider doesn’t necessarily mean changing the firm’s technology at the same time. Maintaining continuity, gaining control of the environment and addressing material risks should normally come before longer-term improvements.

The transition should also be considered when evaluating providers, not after one has been selected. A prospective provider should be able to explain what its onboarding process involves, who manages the handover and how disruption will be minimised.

For a more detailed look at the process, including preparing for the handover and managing the outgoing provider, see how to switch IT provider without disrupting your business.

Managed IT Services for Law Firms: Buyer’s Checklist

Before appointing a provider, make sure you’ve established:

• what’s included and excluded;
• support hours and escalation arrangements;
• response commitments;
• experience supporting law firms;
• responsibilities for legal applications;
• cyber-security responsibilities;
• Microsoft 365 and cloud responsibilities;
• backup and recovery arrangements;
• onboarding steps and costs;
• reporting and service reviews;
• strategic technology support;
• additional project charges;
• contract and notice periods; and
• offboarding, documentation and data ownership.

The aim isn’t necessarily to find the provider offering the longest list of services. It’s to choose one whose capabilities, responsibilities and service model match what the firm actually needs.

Choosing Managed IT Services That Fit Your Firm

The right managed IT services for law firms should do more than provide somewhere to call when technology goes wrong.

They should help maintain day-to-day systems, manage technology risks, protect critical information and give the firm a clearer direction for future IT decisions.

That makes due diligence important. Compare service scope rather than headline price, establish responsibilities before signing a contract and make sure prospective providers understand the operational realities of a legal practice.

For firms currently comparing providers, Akita’s IT support for law firms combines day-to-day support with Microsoft 365, cloud, cyber security and strategic IT expertise for legal practices across London and the South East.