Most law firms change IT providers reactively. Something goes badly wrong, patience runs out, and the search begins in a week when nobody has time to do it properly.
That’s the worst possible moment to make a decision you’ll live with for three or four years — and it’s how firms end up in arrangements that look fine on paper and disappoint in practice.
This guide assumes you’re doing it the better way: looking before you’re desperate, with time to ask proper questions. What follows covers what a firm your size actually needs, how to evaluate what you’re being offered, and the specific things worth checking before anyone signs anything.
Start by knowing what you’re buying for
Before evaluating providers, it’s worth being clear about what a law firm needs that a general business doesn’t. Otherwise you’ll compare proposals on price and miss the things that matter.
Confidentiality that holds technically, not just ethically. Every attorney understands the duty. Fewer have considered that it now depends on systems nobody in the firm has examined. You can conduct every conversation carefully and still have client files sitting somewhere a stolen password would reach.
Availability that respects the calendar. Filing deadlines don’t move for technical problems. The tolerance for a day-long outage is different in a law firm than in most businesses, and that should shape what you’re buying.
Document management that actually functions. In firms without a properly configured system — or with one nobody was trained on — finding the current version of something becomes a recurring tax on every matter. It’s rarely dramatic and it’s constantly expensive.
Evidence you can produce. Corporate clients increasingly send security questionnaires to outside counsel. Insurers require documented controls. Both want dates and percentages, not reassurances.
Protection against wire fraud specifically. Firms handling trust accounts, settlements, and real estate closings move funds on predictable schedules. That makes them a target for a particular kind of attack, and it deserves particular attention.
The questions that separate substance from marketing
Every provider will describe themselves as proactive, responsive, and security-focused. These questions establish whether the words mean anything.
“What exactly do you monitor, and what happens when an alert fires?”
You want specifics — which devices, which metrics, who receives the alert, what action follows, and whether that coverage extends outside business hours.
Vague answers about keeping an eye on things generally mean nobody is watching after five o’clock. Which matters, because ransomware is typically triggered on Friday evenings and holiday weekends precisely because nobody is watching.
“How often do you test our backups, and what will you send me afterward?”
The correct answer contains both a frequency and a deliverable.
If testing produces nothing you can read, it either isn’t happening or isn’t being recorded — and for an insurance application or a client questionnaire, those amount to the same thing.
Ask a follow-up: would our backup be reachable from an infected computer on our network? If the answer involves the server room, you’ve learned something important. Ransomware hunts connected backup storage as standard practice now.
“What’s your average first response time, and can you show me last quarter’s actual figures?”
A provider measuring their own performance will have the number. One that doesn’t measure will explain why measurement is complicated.
Push for the real figure rather than the contractual target. Those are frequently different.
“Have you worked with firms using our practice management system?”
Not essential, but it shortens the learning curve. More important is whether they understand how a law firm actually operates — the difference between a workstation being down generally and a workstation being down during a filing week.
“What’s included in the monthly cost, and what gets billed separately?”
Ask directly about:
- After-hours and weekend support
- Onsite visits
- Onboarding and offboarding staff
- Project work versus routine support
- Hardware procurement
- Software licensing
The value of predictable pricing evaporates if the predictable portion covers only routine tickets and everything else arrives as a variable invoice.
“How would you handle a request to change payment instructions?”
An unusual question to ask an IT provider, and a revealing one.
A good provider will immediately understand why you’re asking and will talk about verification procedures, email authentication, and staff awareness. One who looks blank hasn’t thought about the attack that takes the most money from firms of your size.
What good looks like in a proposal
Reading proposals is easier when you know what should be there.
Present in a strong proposal:
- Continuous monitoring of all devices, not just servers
- Multi-Factor Authentication enforced across every account without exception
- Endpoint detection and response — note the wording, this is different from antivirus
- Email threat filtering and DNS security
- Automated patch management with reported compliance figures
- Backups verified daily, replicated off-site, tested on a schedule with written results
- Defined response targets with actual measurement
- Secure client file sharing
- Documentation you can hand to an insurer
Missing or vague in a weaker proposal:
- “Antivirus” listed with no mention of behaviour-based detection
- Backup included but backup testing not mentioned
- Monitoring described without specifics about scope or escalation
- Response times as aspirations rather than measured commitments
- No mention of documentation or reporting
- Hardware recommendations made before anything has been measured
That last point deserves emphasis. A provider proposing new workstations before establishing where delays actually originate is guessing with your money. The constraint is frequently storage or network, in which case new machines wait in exactly the same queue the old ones did.
Contract terms worth reading closely
Firms are good at reading contracts and oddly reluctant to apply that skill to their own supplier agreements.
Term length and exit. Three-year terms are common. What matters more is what happens if the relationship isn’t working — is there a break clause, and what notice applies?
Data and access on termination. This is the important one. If you leave, what happens to your data, your documentation, your passwords, and your system configurations? A provider who makes leaving difficult is telling you something about their confidence in the relationship.
Response commitments. Are they defined, measured, and reported — or aspirational language with no consequence attached?
Scope boundaries. What specifically falls outside the agreement, and how is that priced when it arises?
Price escalation. How and when can the monthly figure change, and with what notice?
None of these are unreasonable to ask about. A provider who bristles at contract questions from a law firm has misjudged the room fairly badly.
Warning signs
A few things that should give you pause during evaluation.
Reluctance to give specific figures. Response times, patch compliance, resolution rates. If nothing is measured, nothing is managed.
Describing HIPAA-style compliance or security as a one-time achievement. Security degrades continuously without maintenance. Anyone describing it as a completed project has misunderstood something fundamental.
No questions about your practice areas. A provider who doesn’t ask whether you handle real estate closings or trust accounts hasn’t considered your actual risk profile.
Pressure toward a decision. Legitimate providers understand that a firm changing IT support is making a multi-year commitment and needs to do it carefully.
A proposal that arrives without an assessment. Anyone quoting without understanding what you currently have is quoting a template.
What we’d suggest for a firm in Sutter Creek specifically
There’s a regional consideration worth being honest about.
Specialist support has historically been thin in Amador County. Firms end up with a general computer vendor, or with whichever staff member is most comfortable with technology, and response times measured in days become normal because nothing else was available.
That reality used to shape what was realistic. It doesn’t anymore, and this is the practical point worth taking from the whole guide: remote-first support has removed distance as a factor.
The substantial majority of issues get resolved remotely within minutes regardless of where your office is. Monitoring requires nobody to be nearby. Backup replication runs through the cloud rather than depending on someone driving out with a drive.
So when you’re evaluating providers, don’t limit yourself to whoever is nearest. Ask about remote resolution rates and response times, and judge on those rather than on postcode. A provider forty minutes away who resolves 90% of issues remotely in under fifteen minutes serves you better than one down the road who takes two days to visit.
A practical evaluation sequence
If you’re starting this process, here’s an order that works.
One. Establish your baseline. Ask your current provider three questions: when was the last actual restore test, what’s your patch compliance percentage, and is MFA enforced on every account without exception. The answers tell you what you’re actually working with.
Two. Talk to two or three providers, not one. Ask each the questions above and compare the answers rather than the prices.
Three. Insist on an assessment before a proposal. Anyone quoting blind is quoting a template.
Four. Read the exit terms before the pricing. It’s the section that tells you most about the relationship you’re entering.
Five. Ask for a reference from a firm of similar size in a similar field — and actually call them.
Closing thought
The best time to choose an IT provider is when nothing is on fire and you have the space to ask proper questions. The worst time is a fortnight after a serious incident, when the priority is making the problem stop.
If your current arrangement is working, this is still worth doing every few years — not necessarily to change anything, but to know what you’re getting relative to what’s available. Those three baseline questions in step one take ten minutes and tell you a great deal.
And if the answers are vague, you’ve learned something worth knowing before the day it matters rather than during it.
Visit our office in Valley Springs, or we’ll come to you — either way, we’re happy to walk through what your firm currently has and give you a written, honest assessment of where the gaps sit. No proposal attached unless you ask for one. Call 209-920-4077 or arrange a time that fits around your calendar.
