What Law Firms Should Require Before Giving an IT Provider Access

A managed IT provider usually holds the most powerful accounts in a law firm. Depending on the permissions granted, its technicians may be able to reset a partner’s password, access mailboxes, export the document management system, and switch off security tools. That access lets good support happen quickly. It also creates a concentration of risk, because a compromised provider can give attackers a route into several clients’ systems.

The 2021 attack on Kaseya’s remote management software showed how this works. Criminals compromised a tool that managed service providers used to look after their clients, then pushed ransomware downstream to the businesses those providers supported. Customers could be affected without an employee ever clicking a malicious link.

For law firms, the stakes go beyond downtime. Client files can contain legally privileged communications, commercial secrets and personal information that clients handed over on the strength of a professional promise. Before an IT provider gets the keys, the firm should require proof that the promise will hold.

Outsourcing IT Doesn’t Remove Your Duty of Confidentiality

Professional conduct rules in most jurisdictions place confidentiality on the lawyer, regardless of who stores or manages the data. Outsourcing the infrastructure doesn’t outsource the obligation. If a technician exposes a client’s acquisition documents, the client will call the supervising partner, not the help desk.

Clients know this. Corporate clients, banks and insurers routinely send security questionnaires during panel reviews, and many ask directly about third parties with access to their information. A firm that can’t explain how its IT provider handles privileged material will struggle to answer those questions honestly.

The expectations don’t stand still either. Like many of the hidden legal risks of digital transformation, security obligations shift as technology, threats and legal requirements change. Vendor oversight should be part of a firm’s regular review.

Ask for Evidence, Not Assurances

Every IT provider says security comes first. The useful question is what independent proof supports the claim.

Start with assurance that involves an external auditor. ISO/IEC 27001 certification shows the provider runs an information security management system that a third party has assessed against the standard. A SOC 2 Type II report provides a different form of assurance, examining the design and operating effectiveness of specified controls over a defined period. Ask for the certificate or report and confirm its scope covers the team that will service your account, not just a head office function. Check the dates. For a SOC 2 report, ask which exceptions the auditor found and how the provider fixed them. Neither document guarantees security, but both give you something concrete to test claims against.

Local benchmarks help when they exist. A Victorian practice weighing up options for managed IT services Melbourne should ask each provider for its assessed maturity against the Australian Signals Directorate’s Essential Eight, along with the assessment date, its scope and any outstanding gaps. Only then does it make sense to discuss the target maturity the provider proposes for the firm. The Essential Eight covers baseline controls such as patching, multi-factor authentication, restricting admin privileges and regular backups, though it doesn’t address every security risk. Unexplained gaps in the provider’s own controls should weigh heavily in the firm’s decision.

Then ask about history. Has the provider had a security incident in the past three years? Assess how the provider detected, contained, disclosed and remedied previous incidents, rather than treating a claimed spotless record as proof of security.

Control Who Gets In Law Firm Data and What They Can Touch

Certifications describe the provider. Access controls decide what happens inside your environment, and this is where firms should be most specific.

Require named accounts for every technician, with no shared “admin” logins that make it impossible to tell who did what. Every privileged account should sit behind multi-factor authentication, ideally a phishing-resistant method such as a hardware security key or passkey rather than a text message code. Technicians should use separate admin accounts for elevated work instead of carrying those rights in their everyday logins.

Least privilege is particularly important where access must respect confidential matters and information barriers. A technician fixing a printer driver doesn’t need access to the litigation folder. Ask whether the provider can grant elevated rights only for the duration of a task, and whether its staff can administer the document management system without being able to open matter content. An IT contractor who browses both sides of a conflicted matter can breach an ethical wall without ever realising it existed.

Finally, insist on logging. Privileged actions should be recorded, retained for an agreed period and available to the firm on request. Ask how the provider screens its own staff, too. Background checks and signed confidentiality agreements for anyone with access to client systems should be standard, not optional extras.

Find Out Where the Law Firm Data Actually Goes

Client data can end up in places firms overlook. Backups, system logs and support tickets all hold copies. Staff often paste screenshots of client documents into a help desk ticket to explain a formatting problem, which means confidential material may now sit in the provider’s ticketing platform indefinitely. Ask where that platform is hosted, who can search it and how long tickets are kept.

Subcontractors deserve the same scrutiny. Many providers hand after-hours support or security monitoring to a third party, sometimes in another country. Request a full list of subcontractors that could touch your data, and require notice before the provider adds a new one.

The provider’s tools need attention as well. Remote monitoring and remote access software can provide access across the firm’s devices, and the Kaseya incident showed what happens when attackers compromise them. Ask how the provider secures those platforms, who can push scripts through them and how quickly it patches them.

Write the Requirements Into the Law Firm Contract

Verbal commitments fade the moment a provider changes account managers. The agreement should capture the essentials:

• Notification within an agreed number of hours after discovering a suspected or confirmed incident affecting firm data or systems, with defined reporting and update requirements
• The right to request security evidence each year, including updated certifications and access logs
• Confidentiality terms that acknowledge legal professional privilege and limit use of firm data to authorized service delivery
• Professional indemnity and cyber insurance at levels proportionate to the data involved
• A defined exit process covering data return, revocation of all access, and written confirmation of deletion subject to documented legal retention obligations and agreed backup expiry periods

A firm that switches providers needs every admin credential, configuration record and backup handed over cleanly. Without a clear exit clause, a departing provider can leave the firm locked out of its own systems. Deleting data from every backup at once may also be impractical, so the contract should explain how any retained copies stay protected and when they expire.

Rehearse the Bad Day Before It Arrives

Even a well-chosen provider can suffer an incident. What matters then is how quickly both sides act, and that depends on preparation. Agree in advance who declares an incident, who contacts the insurer and breach counsel, and who speaks to clients. Run a tabletop exercise together at least once a year.

Test the backups as well. A monthly report saying backups succeeded proves very little until someone restores a matter file and opens it.

Read Next

A few related pieces worth your time:

• Jumper Expands Cross-Chain Routing to Lower Risk and Ease Transfers
• The Password Problem Nobody Solved Until Remote Work Broke Everything
• AI-Driven Transformation of Modern Cyber Defense Strategies

Make the Review a Habit

Due diligence shouldn’t end at signing. Revisit these requirements every year and whenever the provider changes ownership. The managed services market consolidates constantly, and an acquisition can bring new staff, new tools and new offshore arrangements overnight. Regular reviews give the firm a chance to assess those changes before they affect client data.