Confidentiality is the one professional duty a firm can never hand off to anyone else, and yet almost every mechanism that protects it now sits inside systems the firm did not build. Privileged material lives in a document management system, moves through a mail platform, syncs down to laptops and phones, and comes to rest in backups that somebody else administers on somebody else’s hardware. So when a managing partner or firm administrator starts evaluating law firm IT support services, the useful question is not which provider has the longest feature list on its website.
A useful evaluation asks whether the specific controls that keep client information private are actually implemented, documented, and reviewed on a schedule that someone owns by name. In practice, those controls tend to fail in an order that begins with who can open a file and ends with how the firm proves that any of it is working. The goal is not to turn confidentiality into a technical hobby for the firm, but to make it operational enough that a partner can answer a client’s security questions without hedging.
How Confidentiality Duties Create Specific IT Requirements
Confidentiality rules were written to be outcome-based rather than prescriptive, which means they tell a firm to make reasonable efforts to protect client information without listing the settings that satisfy the standard. That leaves each firm to translate a professional duty into configuration, and the translation gets pressure from two directions at once. The first is the attacker, and the numbers are not comfortable to read. Uptime Legal’s guide to IT support for law firms cites the American Bar Association on this point: According to the ABA, 29% of law firms reported experiencing a security breach. The same guide reports that IBM’s Cost of a Data Breach Report 2024 put the average breach cost for professional services organizations, a category that includes legal work, at 5.08 million dollars.
The second source of pressure is the client, who increasingly asks the firm to demonstrate its controls before sending sensitive work. Uptime Legal points to the ABA’s 2023 Cybersecurity TechReport, which found that 27 percent of firms were asked for security requirements or guidelines and 22 percent were asked to complete security questionnaires. Between those two pressures, a general duty becomes a concrete list: control who can reach each matter, control how people prove who they are, decide how long material is kept, control how files move to and from clients, and be able to recover and verify all of it.
Matter-Level Access Controls and Why Firm-Wide Permissions Fall Short
Most firms inherit their permission model from the years when the whole practice fit in one office and one shared folder was genuinely sufficient. Everyone could open everything because everyone was already in the room, and nobody had to think about scope. That model quietly stops matching the obligation as soon as the firm takes on ethical walls, laterals arriving from opposing counsel, contract attorneys staffed to a single case, or a client whose engagement letter restricts internal access to a named team.
There is also a security reason to narrow permissions, and it has nothing to do with trust in your own people. A compromised account inherits exactly the access that account already had, so the reach of a single stolen password is determined in advance by how broadly you granted permissions. That matters because credential attacks are among the most common entry points reported. Uptime Legal, citing IBM’s 2024 report, notes that compromised credentials accounted for 16 percent of the breach cases studied and phishing for 15 percent, with average costs of 4.81 million dollars and 4.88 million dollars respectively. A firm-wide share turns one phished assistant into exposure across every open matter, while matter-level access keeps the same incident contained to the files that one person legitimately needed.
In practice, this means security groups built around matters and practice areas rather than around the entire staff directory, membership that changes when staffing changes, and a document management system configured to enforce restrictions instead of relying on people to avoid folders they can technically open. It also means asking an outside provider an uncomfortable question about its own access. Technicians usually need administrative rights to keep systems running, so the firm should know whether that access is standing or requested when needed, whether it is logged, and who at the firm reviews those logs.
Credential and Identity Controls That Reduce Phishing Exposure
Because stolen credentials and phishing sit near the top of the reported causes of breaches, identity is where most of the practical protection lives. Multifactor authentication is the baseline, but coverage is what actually matters, and coverage is where firms usually have gaps. Email may be protected while the remote access gateway, the legacy accounting application, the practice management login, and the administrative portals are not, and attackers reliably find whichever door was left with a single lock on it.
Stronger identity work goes further than adding a code to a login prompt. Phishing-resistant factors such as security keys or platform authenticators remove the approval that a tired attorney taps at eleven at night without reading it. Conditional access policies can require a managed, up-to-date device before granting access to client material, which quietly closes the gap created by personal laptops. Shared logins for scanners, portals, or billing systems need to be eliminated because they make it impossible to attribute activity to a person, and administrative accounts should be separate from the daily account that reads email. Sign-in monitoring should raise an alert when a login pattern makes no sense for the person it claims to be, and staff need a fast, blame-free way to report a suspicious message before anyone starts investigating.
Retention Schedules and Secure Deletion as Confidentiality Controls
Retention rarely feels like a security topic, but it is one of the few controls that reduces risk permanently rather than managing it. Material the firm no longer holds cannot be exposed in an incident, produced in error, or carried out on a departing employee’s personal drive. The schedule itself belongs to the firm, since decisions about closed files, client property, trust records, and conflicts history are legal judgments rather than technical ones. What a support provider owns is the machinery that carries the schedule out, which is where most policies quietly break down.
Real deletion has to reach every copy, and copies multiply faster than most firms expect. A closed matter can persist in mailboxes and archives, in a former paralegal’s cloud storage, in a departed partner’s laptop image, in a scanning appliance, and in backup sets that were designed to keep everything forever. Deletion also has to be suspendable, because a litigation hold overrides the schedule and the pause needs to be provable after the fact. This shared arrangement, where the firm owns the policy and the provider operates it, is increasingly the norm. Tabush Group reports the pattern in its own research: In the 2026 Tabush Group Survey on Law Firm Technology, 38 percent of firms now leverage a co-managed IT model, a sharp rise from 2024. That firm also recommends a structured IT assessment every one to three years, depending on firm size, risk exposure, and how much has changed since the last review.
Secure Client File Exchange and the Risks of Unmanaged Channels
Documents leave the firm constantly, and the channel people choose is almost always the one that takes the fewest clicks. That is how privileged material ends up as an unencrypted attachment sent to a guessed address, in a personal cloud account nobody can audit, or in a text thread on a phone that will eventually be sold. None of these channels leave the firm with a record of who received what, when access should have ended, or whether the file was ever opened by someone outside the intended recipient.
A managed alternative needs three properties to hold up under scrutiny. It should encrypt material in transit and at rest; it should log access so the firm can reconstruct who touched a document; and it should let links expire or be revoked when a matter closes or a recipient changes firms. Practicality matters just as much, because a portal that takes four steps to send one signature page will be abandoned within a week and replaced by whatever is faster. This is also the part of the environment clients ask about most directly, which connects back to the ABA finding cited by Uptime Legal that 27 percent of firms were asked for security requirements and 22 percent were sent security questionnaires. eSudo, comparing law firm IT support providers, says it gives every client a compliance report as part of standard onboarding, which is a reasonable expectation to carry into any evaluation, since it gives the firm something to hand a client instead of an assurance.
Backup, Recovery, and Ransomware Readiness for Client Data
Backup protects the duty of competence and the duty of confidentiality at the same time, and the two require slightly different things. Availability requires copies that ransomware cannot reach, which in practice means immutable or offline retention and backup credentials that are not the same credentials an attacker would capture on a domain administrator’s workstation. Confidentiality requires treating the backup as privileged material in its own right, with encryption, restricted access, and a clear answer about where the data physically sits and who at the provider can read it.
Recovery only counts if it has been rehearsed against a stated target, so the firm should know how much data it can afford to lose and how long a full restore of the document system actually took the last time somebody tried it. Detection deserves the same attention as recovery, because dwell time drives cost and exposure, and Uptime Legal cites the global average time to identify and contain a breach at 258 days. It is also worth being clear that restoring files does not resolve disclosure. When attackers copy data before encrypting it, the firm still faces client notification questions that no backup can answer. Ntiva describes a familiar starting point in its legal case study: a growing legal services firm whose outdated infrastructure could not scale to support expansion or meet strict data security regulations, and that combination of growth and aging systems is exactly where recovery plans tend to go stale.
Verifying That Controls Are Actually Operating
Controls degrade quietly as permissions accumulate, multifactor coverage lapses when a new application arrives, retention jobs fail without anyone noticing, and backup sets stop including the server that was added last spring. Verification is what separates a security posture from a security intention, and it should produce artifacts a partner can read: multifactor coverage by user and application, a periodic review of who belongs to each matter group, documented restore tests with dates and durations, patch status by device, and a log of administrative access by the provider’s own staff.
Cadence matters more than volume here, since a quarterly review that someone actually attends beats a monthly report nobody opens. eSudo frames its own approach around proactive monitoring, security tuned to the threats facing legal data, and flat-rate pricing, and says its onboarding protocol is built to finish within 30 days without disrupting daily operations, with a typical two- to four-week timeline for firms of five to thirty attorneys. Those figures are useful mainly as benchmarks for the questions you ask, not as a standard every provider will match.
Questions to Bring to a Law Firm IT Support Evaluation
Take a short list into the conversation and ask for evidence rather than reassurance, because the answers reveal how a provider works long before the contract does.
- How would you restrict a single matter to a named team, and how is that reviewed?
- Which systems are covered by multifactor authentication today, and which are not?
- Who at your company can read our client data, and how is that access logged?
- When did you last complete a documented restore test, and how long did it take?
- What do you hand us to answer a client security questionnaire?
- Which responsibilities stay with the firm under a co-managed arrangement?
Vintage IT Services has been headquartered and locally operated in Austin, Texas since it was established in 2001, serving small and mid-sized organizations, government agencies, and nonprofits with managed IT, IT consulting, cloud services, and IT security. If your firm is weighing providers and wants a grounded conversation about what your confidentiality obligations require from your systems, contact us and get the support your business deserves.
TL;DR: Law firms cannot delegate confidentiality obligations, but they can make them operational by ensuring IT support services implement and regularly audit the access controls, encryption, and documentation that protect privileged client information across every platform the firm uses.