Most of what a firm needs is what every business needs. The parts that are genuinely different are confidentiality boundaries, deadlines that cannot move, and an audit trail somebody will eventually read.
Vendors selling to law firms tend to open with how specialised legal IT is. It is a good sales line and it is about forty percent true.
Most of what a firm needs is what any professional services business needs: identity that is hard to abuse, email that does not go down, devices that are patched and encrypted, backups somebody has restored from. If a provider cannot do those things well, their legal vertical experience is decoration.
But there are three places where a firm genuinely is different, and they are the three places where generic managed IT falls short. None of them are about technology you have never heard of. All of them are about obligations that outlive any particular system.
One: confidentiality is per matter, not per firm
In most businesses, the access question is "which department are you in". In a firm it is "which matter are you on", and the answer changes weekly.
This breaks the standard pattern in two ways. First, a shared drive organised by practice group gives everyone in the group access to everything the group has ever touched, which is more than the client agreed to and more than professional conduct rules contemplate. Second, ethical walls are usually implemented once, at the point a conflict is identified, and then quietly erode as people move teams and group memberships are copied from colleagues.
The practical test is not whether you have a document management system. It is whether you can answer, right now, who has access to a given matter, and whether that answer is the same as the list of people who should.
Two: some dates genuinely cannot move
Every client says their systems are critical. In a firm, there is a subset of dates where that is literally true: filing deadlines, limitation periods, hearings. A four-hour outage on an ordinary Tuesday is an irritation. The same outage on the afternoon of a filing is a different category of event.
Two consequences for how the service should be run.
Change windows have to know the calendar. A provider that patches on a fixed schedule without reference to your diary will eventually patch through something important. This is a solvable problem and it is solved by asking, not by technology.
Recovery time needs to be measured, not estimated. Most firms have a number in a document. Very few have a number that came from an actual restore. Those are different numbers, and the gap between them is usually a factor of three or more. Ask your provider when they last performed a full restore of your document management system to a usable state, and how long it took. If the answer is a plan rather than a date, that is the finding.
Three: the audit trail is a work product
In most businesses, logging exists for the IT team. In a firm it is a potential evidentiary record and a professional obligation, and the questions asked of it come years later from people who do not care how your SIEM is licensed.
Who opened this document, and when. When was this file last modified, and by whom. Was this matter accessible to anyone who should have been walled off. Whether your platform can answer those questions, and for how far back, is a configuration decision somebody made, probably by default, probably years ago.
Retention is not a backup question. A backup is about getting data back; retention is about being able to prove what happened, including proving that something was properly deleted.
Legal hold deserves a specific mention. If triggering a hold requires a ticket to your provider, it will be slower than the moment demands. It should be something a partner or practice manager can do themselves, on a matter, in minutes.
Where the risk actually sits
Firms consistently over-invest in the network and under-invest in identity. This is understandable, because the network is visible and identity is not, and because the last thing that visibly broke was probably the internet connection.
Business email compromise is the pattern that hits firms hardest, and it is not a sophisticated attack. Somebody gets into a mailbox, watches a transaction for a few weeks, and intervenes at the point money moves, usually with a change of bank details on a completion statement. The technology involved is a stolen password and patience.
What stops it is unglamorous: phishing-resistant multi-factor authentication rather than SMS codes, conditional access that notices a sign-in from somewhere implausible, alerting on mailbox forwarding rules, and a firm-wide rule that bank details are confirmed by voice on a number you already held. The last one is not IT at all, and it is the most effective control on the list.
What to actually ask a provider
Four questions that separate providers who understand firms from providers with a legal page on their website.
"Show me how you would handle an ethical wall." The answer should involve groups, document management permissions, and a process for maintaining them, not a promise to be careful.
"When did you last do a full restore of a system like ours, and how long did it take?" You want a date and a duration. Anything else is a plan.
"Who in your team is cleared to see our documents, and how is that enforced?" A provider with administrative access to your tenant can read anything. How they constrain that, and how they log it, is a reasonable thing to ask and a surprising number of providers have not thought about.
"What happens on a filing day?" The right answer is a question back about your calendar.
The uncomfortable part
Most of the gap between where firms are and where they should be is not budget. It is that nobody owns the question. IT is a line item handled by a practice manager with eleven other responsibilities, the provider does what they are asked, and nobody is asked to look at the whole thing once a year and say what is missing.
That role is a few days a quarter, not a full-time job. Whether you call it a vCIO or just a standing item at a partners' meeting matters less than whether somebody does it.
