Artemy Kirnichansky Your firm has grown past the point where one IT person, or a partner’s nephew, can keep up. You have 50, 100, maybe 200 people, a document management system nobody fully understands, lawyers working from court and home, and trust account transfers going out every week. Then a client’s general counsel sends over a security questionnaire, and nobody knows how to answer half of it.
This guide covers what managed IT services for law firms should include, which Ontario obligations drive those requirements, and how to tell a provider who understands legal practice from one who just supports offices.
The short answer: managed IT services for a law firm should cover everything a general business needs (help desk, patching, backups, network) plus four things specific to legal practice: protecting privileged client data, securing the money movement around trust accounts, enforcing ethical walls inside your document system, and giving you evidence you can show clients, insurers, and the Law Society. If a provider can’t speak to all four, they are supporting your office, not your practice.
For an Ontario law firm, IT is part of professional responsibility. The Law Society expects technological competence, PIPEDA requires breach records, and LAWPRO’s cybercrime coverage has a ceiling. Managed IT should be scoped around those obligations, not just around keeping computers running.
Managed IT Services for Law Firms
Managed IT services for law firms is an arrangement where an outside provider runs a firm’s technology for a fixed monthly fee: user support, security, backups, cloud systems, and legal applications such as document management and practice management software. Unlike general office IT support, it is built around client confidentiality, trust account security, conflict and ethical wall controls, and records retention.
Why law firm IT is different from general office IT
Law firm IT is different because the data is privileged, the money moves through trust accounts, and the regulator holds individual lawyers responsible for how both are protected. A manufacturer that loses its email for a day loses productivity. A law firm that leaks a client file can face a negligence claim, a Law Society complaint, and the loss of the client relationship in one event.
Three things make legal environments harder to run than they look:
- Access is matter-based, not department-based. Who can open a file depends on which matters they work on, and conflicts mean some people must be actively blocked from files their own colleagues use every day.
- The work happens everywhere. Lawyers draft at home, review on phones between court appearances, and share files with opposing counsel and clients outside the firm.
- Retention rules are long. Closed files have to be kept, findable, and protected for years after the matter ends, which makes backup design a professional obligation, not just a disaster plan.
When we take over IT at a mid-size firm, the pattern we see most often is not a missing firewall. It is permissions that grew by accident: shared folders opened “temporarily” years ago, former associates still in distribution groups, and a document system whose security model nobody has reviewed since it was installed.
What Ontario rules and obligations shape law firm IT
Ontario law firms answer to three sets of expectations that directly affect IT: the Law Society of Ontario’s professional conduct rules, federal privacy law, and the terms of their LAWPRO insurance. None of them hands you a technical checklist, which is exactly why firms need someone who can translate them into controls.
| Obligation | What it says, in plain terms | What it means for your IT |
|---|---|---|
| LSO Rules of Professional Conduct, Chapter 3 | Lawyers must be competent, and the commentary on competence now covers understanding the technology they use. Confidentiality duties apply to client information wherever it is stored. | Partners need to be able to explain, in plain language, how client data is protected. That means documented controls, not “the IT guy handles it.” |
| PIPEDA breach rules | Breaches that create a real risk of significant harm must be reported to the Privacy Commissioner and affected people, and every breach must be recorded and kept for 24 months. | You need logging and monitoring good enough to know a breach happened, what was touched, and when. |
| LAWPRO cybercrime sublimit | The mandatory policy includes a $250,000 cybercrime sublimit, which LAWPRO itself describes as a modest safety net. | A serious incident can exceed that cover. Separate cyber insurance, and the security controls insurers require for it, are part of the plan. |
If your firm holds health information (personal injury, medical malpractice, disability claims), Ontario’s PHIPA can also apply to how that information is handled. Ask your provider how they treat health records differently from other client files.
The biggest cyber risk to law firms is the money, not the files
The most expensive attack on an Ontario law firm is usually not ransomware. It is a fraudster who gets into, or convincingly fakes, an email thread and redirects a trust account payment to their own bank account. LAWPRO has repeatedly warned about a rise in schemes that trick lawyers and law clerks into wiring funds out of trust accounts, especially around real estate closings and private mortgages.
These attacks work because they look like normal business. The email comes from a real client’s address (after their mailbox is compromised) or a near-identical domain, the timing matches a closing, and the request is a routine change to payment instructions. Recovery after the wire leaves is rare.
27%
of law firms surveyed reported having experienced a security breach at some point (ABA TechReport 2022, Cybersecurity)
Good managed IT reduces this risk on both sides: technical controls (multi-factor authentication on every mailbox, alerts on suspicious mailbox rules, filtering of look-alike domains) and process controls (a mandatory phone call-back to a number already on file before any change to payment instructions). We go deeper on the email side in our guide to business email compromise.
Check your mailbox rules today. In nearly every email compromise we investigate, the attacker’s first move is a hidden rule that forwards or deletes messages containing words like “wire,” “trust,” or “closing” so the real conversation never reaches the lawyer. Your IT provider should be alerting on new forwarding rules automatically.
What managed IT for a law firm should include
A complete managed IT service for a law firm covers day-to-day support, security, and the legal applications that the firm runs on. Use this table to check a current or proposed agreement. Anything in the right-hand column that isn’t in writing usually isn’t happening.
| Area | General office IT | Law firm IT should add |
|---|---|---|
| Help desk | Business-hours support | After-hours coverage around filing deadlines and trial prep; support for court and remote work |
| Identity and access | User accounts and passwords | Multi-factor authentication everywhere, matter-based permissions, ethical wall enforcement, same-day offboarding |
| Email security | Spam filtering | Impersonation and look-alike domain protection, mailbox rule alerts, encrypted email for client files |
| Monitoring | Antivirus | Endpoint detection and response with a 24/7 SOC (security operations centre) that can tell you exactly what an attacker touched |
| Backups | Nightly backup | Immutable backups that ransomware can’t delete, tested restores, retention matched to file-retention obligations |
| Applications | Microsoft 365 | Document management (iManage, NetDocuments), practice management, billing, e-discovery tools |
| Reporting | Ticket counts | Evidence for client security questionnaires, cyber insurance renewals, and partner meetings |
Offboarding deserves special attention in legal. Associates and clerks move between firms often, and a departing lawyer who keeps access to a shared drive or a synced phone is a confidentiality problem. We explain why the job isn’t finished on the last day in why user offboarding doesn’t end when an employee leaves.
Ethical walls need to exist in your systems, not just in a memo
An ethical wall (a screen that blocks specific people from specific matters because of a conflict) only protects the firm if the technology enforces it. A memo telling a lateral hire not to open certain files does nothing if their account can still open them, search them, and sync them to a laptop.
Done properly, a wall is applied in the document management system, mirrored in any shared drives or Teams sites that hold matter files, and logged so the firm can prove nobody behind the wall accessed the matter. When we review legal environments, the gap is almost always the second step: the document system is locked down, but copies of the same files live in a Teams channel or a personal OneDrive that the wall never reached.
Microsoft 365 Copilot and other AI assistants search everything a user is allowed to see. If your permissions are loose, an AI tool will surface walled-off or confidential documents in answers. Fix permissions before turning on AI tools, not after.
How to choose a managed IT provider for a law firm
The right provider can explain your obligations back to you in plain language and show how each one maps to a control they run. Use these steps to evaluate any provider, including your current one.
Ask about trust account fraud first: have them describe how they would stop a redirected wire. If the answer is only “spam filtering,” keep looking. You want both technical alerts and a payment-verification process.
Ask how they enforce ethical walls: they should be able to explain how a wall is applied across the document system, Microsoft 365, and devices, and how access is logged.
Ask who is watching at 2 a.m.: confirm there is a 24/7 SOC with the authority to isolate a compromised device immediately, not just an alert emailed to someone who reads it Monday.
Ask for a restore test: request proof that a closed matter from several years ago can be found and restored. Untested backups are the most common surprise during an incident.
Ask for a sample report: it should be something a managing partner can read and something you could hand to an insurer or a client’s security team.
If your firm already has an internal IT manager, you don’t have to replace them. A co-managed IT arrangement lets your person keep ownership of the legal applications and relationships while a provider covers security monitoring, after-hours support, and the infrastructure work.
Cyber insurance makes the controls non-negotiable
Because LAWPRO’s cybercrime cover stops at $250,000, most mid-size firms carry separate cyber insurance, and those insurers now ask detailed questions about multi-factor authentication, endpoint detection, backups, and incident response plans. A wrong answer on the application can give the insurer grounds to deny a claim later.
Your managed IT provider should help complete those applications accurately and keep the controls in place all year, not just at renewal. We cover the claim side of this in will your cyber insurance actually pay out when you need it?
Managed IT for a law firm should be judged on four questions: can it stop a redirected trust payment, enforce an ethical wall, prove what happened during an incident, and produce evidence for clients and insurers? A provider that answers all four with specifics is supporting your practice, not just your office.
BALANCED+ has supported Ontario businesses since 1994, with a 24/7 SOC and a 15-minute critical response SLA. If you want an outside view of where your firm stands, see how we work with law firms and legal practices, or start with our managed IT services overview.
Sources
- Rules of Professional Conduct, Chapter 3: Relationship to Clients, Law Society of Ontario
- What you need to know about mandatory reporting of breaches of security safeguards, Office of the Privacy Commissioner of Canada
- The LAWPRO $250,000 cybercrime coverage: What it covers and why, LAWPRO practicePRO, 2013
- practicePRO Webzine: fraud warnings, LAWPRO
- 2022 Cybersecurity TechReport, American Bar Association, 2022
Andrei Fomitchev 
Kavan Patel 