Law Firm IT Assessment: 12 Things to Check Before Hiring an IT Provider

A worksheet for practice administrators, not a pass/fail test

A law firm IT assessment is most useful when the firm can describe its current environment. Without that baseline, two bidders might be answering very different questions: one assumes Microsoft 365 is configured properly; another includes a security review. One assumes backups are tested; another assumes backups are someone else’s responsibility.

You do not need to become an IT administrator to complete a useful law firm IT assessment. Start with an evidence-based inventory of what your practice uses, who controls it, and what would happen if it became unavailable. The twelve checks below are designed for a managing partner or office administrator to work through with an existing IT contact. Do not include passwords, client files, or sensitive configuration details in an emailed checklist.

How to use this law firm IT assessment

For each item, record three things: what you know, what evidence would confirm it, and who currently owns it. Mark an item as confirmed, unclear, or needs attention. Those labels describe documentation status, not a certified security rating. A gap in evidence is a reason to investigate, not proof that a breach has occurred.

The 12-point worksheet

The table is a starting worksheet. A detailed law firm IT assessment may reveal additional issues, especially in offices with local servers, court-filing tools, specialized case-management software, multiple sites, or legacy devices.

What the evidence tells you (and what it does not)

Identity and access: who can get into the systems?

For items 2–4, ask your current contact to demonstrate who administers the tenant and where ownership records are kept. The practice should know how it would regain access if a vendor relationship ended. Review administrator privileges and MFA enforcement; a policy screenshot by itself is insufficient if large groups of users are excluded or accounts are forgotten.

Microsoft recommends least-privilege administrative roles and protected emergency access arrangements. A firm does not need to run every technical setting itself, but it should have an accountable person who can authorize access changes.

Data and devices: can the firm work after a failure?

Items 5–9 describe where work happens: the laptops attorneys take home, email and shared files, the practice-management service, and any remaining local applications. Ask what is actually included in backup, where recovery documentation lives, and when someone last restored a representative file or system successfully.

Do not confuse vendor uptime, version history, retention, and an independently tested recovery process. They can each help, but they are not interchangeable. If an application vendor handles backups, obtain the vendor’s documented recovery arrangements and determine whether they meet your firm’s requirements.

Operations: who acts when something changes?

Items 10–12 reveal whether the firm can maintain service while technology, people, or providers change. A new associate should receive appropriate access quickly; a departing employee should lose access according to an approved process. An incident should have named contacts even if the first technical response comes from a remote provider.

A tiny practice can maintain these records in a controlled document rather than buying a complex governance platform. Accuracy and ownership matter more than the format.

A practical evidence register

Use a compact log alongside the worksheet. For each uncertain item record: Item | Evidence missing | Responsible person | Agreed next action | Due date. For example:

Illustrative register only; these are not findings from an actual law firm. Avoid storing secrets in this file. Keep any sensitive evidence in an approved, access-controlled location.

What to send to prospective IT providers

Share a short, sanitized brief: number of users and devices; main platforms; number of offices; local versus cloud workloads; known coverage hours; and whether the firm needs hands-on onsite support. Add the twelve worksheet items as questions that bidders must address. You do not need to provide administrative credentials, confidential client matters, or unredacted network diagrams during the sales stage.

Ask bidders to specify which discovery activities are included in onboarding, how findings will be documented, which work requires separate approval, and who remains accountable on the firm’s side. The FTC recommends clear written vendor security provisions and a way to verify them.

What should happen after the assessment?

You should come away with a factual list, not a false sense of precision from an arbitrary score. Start with missing ownership information and recoverability; then review access, endpoint protection, and recurring processes. Some findings can be fixed by changing a setting. Others involve training, contract clarification, replacement equipment, or a longer migration.

An assessment is valuable even if the firm stays with its current provider. It creates a more precise conversation about scope, responsibilities, and priorities.

Need help turning your worksheet into an action plan? Request an IT discussion with IT-Emergencies. We can explore a remote review of eligible systems and explain which onsite dependencies would require local assistance.

Sources & further reading

• FTC: Cybersecurity for Small Business
• NIST: Cybersecurity Framework 2.0 FAQ
• Microsoft Learn: Best practices for Microsoft Entra roles
• ABA: Formal Opinion 477R — Securing Communication of Protected Client Information

This is a practical pre-engagement worksheet, not a security certification, compliance audit, or legal opinion. Applicable professional obligations can vary by jurisdiction.