Managed IT Services for Law Firms: What’s Included and What’s Not

CONTRACT ANATOMY · LEGAL IT OPERATIONS

“Unlimited support, proactive monitoring, cybersecurity, and backups included.” It sounds like a complete managed IT service. But managed IT services for law firms must be evaluated against specific responsibilities, not just reassuring labels. But those four phrases cannot tell a managing partner whether a failed office firewall is covered, who tests a backup, whether a compromised account triggers an investigation, or whether a software migration is a separate project.

Managed IT services for law firms are a delivery arrangement, not a standardized package. Different providers use the same label for very different combinations of help desk, administration, monitoring, security, licensing, and recovery. A law firm needs to translate the marketing description into a service schedule that identifies the actual work and its boundaries.

This guide shows how to read that schedule. It is not a list of services that every MSP—or IT-Emergencies—automatically includes. Your signed agreement is the authority for the scope you purchase.

Four lines in a proposal that need definitions

“Unlimited help desk”

Unlimited tickets may still be restricted to named users, covered devices, standard working hours, and specified software. It may exclude application development, major system changes, repeat problems caused by unsupported equipment, personal devices, or onsite travel. Ask whether the provider handles the technical issue end-to-end or only helps the user contact another vendor.

“Proactive monitoring”

What is monitored? A managed laptop checking in, a server running low on storage, a backup failure, a firewall outage, and suspicious account activity are different signals. Ask what tool generates alerts, which systems are covered, whether someone reviews alerts outside business hours, and what happens when an alert cannot be resolved automatically.

“Cybersecurity included”

A bundle might include endpoint protection and multifactor-authentication administration without including a managed detection and response service, email threat investigation, penetration testing, forensic response, or compliance assessment. The relevant question is not whether security is in the proposal, but which controls are operated, who reviews them, and what action follows a detection.

“Backup included”

A backup license, a configured backup job, routine failure review, and a demonstrated restore are four different deliverables. Define the data sources, destinations, retention settings, access controls, recovery priorities, and testing cadence. Microsoft 365 retention or version history should not be casually described as a complete independent backup strategy.

Managed IT services for law firms: a contract scope map

The examples below illustrate common market arrangements. They are not universal rules and should not be treated as an IT-Emergencies price list. Ask your provider to replace every “typical” description with a written commitment.

The scope map is useful precisely because a provider might classify the same task differently. For example, a routine user-password reset may fall under the monthly agreement, while investigating a sophisticated identity compromise may be a separately scoped incident-response engagement. Neither treatment is inherently wrong if it was clear before the incident.

The hidden boundary: IT support versus legal application ownership

Many small law firms use a mixture of general business services and specialist software. Microsoft 365 may be administered by the IT provider; a cloud practice-management vendor may control its application’s backend; the firm’s legal team controls who should see client or matter files. An MSP may solve access or network problems but cannot promise to repair the vendor’s software or decide attorney-client authorization on the firm’s behalf.

Before agreeing to “application support,” record each important system and its ownership. At minimum, note the vendor, billing owner, administrator, support contact, authentication method, data location where known, and the escalation route. This one-page ownership record is often more useful than a glossy list of brand logos.

A cloud-first office also needs a plan for things that are not cloud based: printers, document scanners, conference-room equipment, networking devices, and hardware that can fail without internet access. Those items might require an onsite technician or coordinated local vendor even when everyday administration is remote.

What a good service schedule actually says

The agreement should answer operational questions with testable language. For the support desk, specify coverage days and hours, how priority is assigned, communication methods, and whether the published response commitment refers to acknowledgment, engineer engagement, or restoration. For managed devices, name the devices, update responsibilities, supported operating systems, and conditions under which remediation is deferred.

For security, specify the implemented controls, the monitoring window where applicable, escalation thresholds, handling of administrator accounts, and which actions require firm authorization. For backup, list the protected workloads, testing responsibilities, recovery dependencies, and material exclusions. For changes, identify which routine tasks are included and which require separate approval.

Finally, write down the customer’s responsibilities. The practice may need to authorize access, designate a business decision-maker, maintain vendor subscriptions, arrange physical access, preserve emergency contact details, and approve disruptive changes. Managed IT is not the transfer of every business decision to a technology contractor.

The NIST Cybersecurity Framework 2.0 supplier guidance emphasizes defining supplier requirements, while the FTC’s small-business cybersecurity guidance recommends writing security expectations into vendor contracts and verifying them. Neither source provides a one-size-fits-all MSP contract for law firms.

The cost of an exclusion is often a coordination problem

Consider a hypothetical example: a 12-person law practice cannot open files in a legal case-management system. The IT provider confirms that the computers, internet connection, and user identities appear healthy. The application vendor asks for logs and insists the problem is local. Who owns the ticket until the issue is understood?

An agreement that includes vendor coordination can make this handoff clear. An agreement that excludes it may still be appropriate, but the firm should know who will drive the investigation and keep the attorneys informed. The same distinction applies to internet carriers, printers, e-filing platforms, and hosted phone systems.

Another source of surprise is license ownership. The Microsoft 365 subscription may be purchased through a reseller, while the tenant remains under the firm’s administrative control. Subscription billing, delegated administrator access, and technical support responsibilities are related but separate relationships. Microsoft’s partner relationship documentation explains that removing a partner’s admin roles does not necessarily end its reseller relationship.

A practical coverage review before renewal

Use these prompts when reviewing a current agreement or comparing new proposals:

1. Coverage: Are every office, user group, server, cloud service, and critical device accounted for?
2. Access: Who can administer the tenant and endpoints, and how is privileged access reviewed?
3. Support: Which hours, channels, priority definitions, and escalation responsibilities apply?
4. Security: Which protections are actively operated rather than simply licensed?
5. Recovery: What can the firm actually restore, and when was the last meaningful test?
6. Exceptions: Which projects, onsite visits, vendor work, and incidents are separately quoted?
7. Reporting: What evidence will management receive about recurring problems, risk, and unfinished work?
8. Exit: How will accounts, documentation, tools, subscriptions, and data be transferred or discontinued?

Do not force the provider to mark every line as included. A transparent exclusion with a clear alternative is better than a blanket statement that collapses under pressure.

A useful definition of value

For a law firm, a managed IT agreement is valuable when day-to-day work is predictable, responsibility is visible, security measures are actually operated, and the firm knows how to recover from a disruption. More tools do not automatically create a better service. A smaller, well-defined arrangement can outperform an ambitious list of services that no one has clearly agreed to deliver.

If your current contract is difficult to interpret, begin with a scope discussion rather than an immediate product purchase. Our remote IT support for US law firms page explains the kinds of technical support we discuss with prospective clients; any actual service scope must be agreed separately. A short review of your users, systems, support requirements, and recovery dependencies can reveal which gaps matter before fees and packages are compared.

Sources and further reading

• NIST — Cybersecurity Supply Chain Risk Management Quick-Start Guide
• Federal Trade Commission — Cybersecurity for Small Business
• Microsoft Learn — Manage partner relationships in Microsoft 365
• American Bar Association — Rule 1.6, Confidentiality of Information