Managed IT Services for Legal Teams

Choose Support for the Practice’s Actual Systems

Choose the provider whose support scope covers how your practice stores and uses matter records. A small cloud practice needs different support from a firm with managed laptops or a separate document server.

Request a schedule naming each supported system and the person responsible for it. For each system, distinguish the IT supplier’s administration work from the software vendor’s application support. The principal approves matter-access rules and decides the practice’s continuity requirements.

Supplier terms illustrate why this schedule matters. SaiIT’s published terms limit recurring managed services to expressly included work. They place responsibility for business continuity and appropriate backups on the customer unless a backup service is agreed in writing. Use that distinction when reading proposals, without assuming another supplier has identical terms.

For document repositories, the document management software for lawyers guide explains the access and retrieval controls your support arrangements must accommodate.

Limit Administrator Access to Client Records

Give technicians named administrative accounts with permissions limited to their assigned work. A confidentiality agreement records a commitment. Account permissions determine what the technician can actually reach.

The Law Society of NSW’s IT guidance identifies the lawyer’s confidentiality duty and the care required for electronic client communications. Translate that concern into a support-access procedure for your practice.

Require multi-factor authentication for administrative access. Record who approves elevated access, why it is needed and when it ends. Least privilege means granting only the access needed for that task. Keep routine email and browsing separate from administrative work.

Before accepting an unexpected support request, staff call the supplier using the practice’s recorded number and confirm the ticket. An email signature or caller’s knowledge of the firm is insufficient verification. Staff must never send authentication codes to someone who contacts them unexpectedly.

Ask for records showing administrative sign-ins and changes to permissions, including exports or other sensitive actions where the system records them. Agree who reviews unusual activity and how long the relevant records remain available. The Australian Cyber Security Centre’s managed-provider advisory recommends stating the provider’s security responsibilities in the contract.

When a technician leaves, disable their account and revoke active sessions. Review remote-access tools and delegated permissions as well. If credentials were shared, rotate them and replace that arrangement with accountable access. Record the removal so the principal can see that the former technician’s access ended.

Recover Matter Evidence With Its Source Links

Define recovery as a lawyer being able to use the matter evidence again. A successful backup notification establishes that a backup job reported success. A recovery exercise establishes what the practice can retrieve.

Consider a fictional financial dispute in which a matter folder disappears before a hearing. The folder contains original bank statements, a working review spreadsheet and a findings report. The spreadsheet contains references to specific PDFs and pages. Restoring only the spreadsheet leaves the reviewer unable to inspect those sources.

If the matter uses FinTrace’s bank-statement analysis service, its returned searchable Excel ledger and findings report belong in this recovery scope alongside the source PDFs. Preserve the references that connect findings to the original statements.

Agree the following acceptance outcomes before the recovery exercise:

• The recovered statements open and contain the expected pages. Compare the recovered file inventory with the matter’s retained inventory.
• The working spreadsheet and report are the intended versions. Follow selected source references through to the correct statement and page.
• Folder relationships and linked paths remain usable. Where paths change, document the replacement location and repair dependent links.
• Authorised staff can reach the restored matter. Test that a staff account without permission remains excluded.
• The recovery point meets the practice’s agreed limit on lost work. Identify which later changes require reconstruction and who will reconstruct them.

Record elapsed restoration time against the practice’s target, together with failures and outstanding repairs. Keep recovery copies separated from live records until the responsible person accepts the result. Include closed matters in the exercise where their storage differs from active files.

Assign Incident Response and Court-Work Continuity

Assign technical containment to the IT supplier and legal decisions to the principal or a nominated delegate. The practice manager coordinates staff instructions and the incident record. Each role needs a backup contact with authority to act.

The Office of the Australian Information Commissioner’s response-plan guidance recommends documented responsibilities, escalation and a plan that staff can access quickly. Keep an authorised copy and contact details available when the firm’s ordinary systems are unavailable.

For an incident discovered outside office hours, use a sequence with named owners:

1. The discovering staff member reports through the emergency channel and records what they observed. If the primary contact is unavailable, they call the named alternate.
2. The supplier contains the technical incident and preserves relevant logs. The principal authorises disruptive steps under the agreed emergency authority.
3. The principal or nominated legal adviser assesses confidentiality, privilege and applicable notification duties. The supplier supplies technical facts for that assessment.
4. The practice manager issues approved staff instructions. The principal controls client and external communications, with legal advice where needed.
5. The supplier restores access in an agreed order. The matter lawyer confirms that the recovered evidence supports the urgent work before normal activity resumes.

Where the practice is covered by the federal Notifiable Data Breaches scheme, assess whether the incident triggers assessment or notification requirements. The OAIC’s data-breach response guidance explains the conditional duties and the need to preserve evidence. Apply the rules relevant to the practice and incident.

Plan an alternate way for the matter lawyer to obtain authorised evidence while investigation continues. That could be a clean replacement device accessing an approved recovery copy, subject to the incident team’s clearance. Name who releases the copy and records its version. If an urgent court obligation remains at risk, the responsible lawyer decides the procedural response and necessary communications.

Compare Service Terms and Ongoing Evidence

Compare what the provider undertakes to do, when that commitment starts and how the practice will observe the result. A response target can promise acknowledgement while leaving resolution time open.

Use the same sample incident when comparing proposals, such as an inaccessible matter folder outside business hours. Ask each supplier to describe the included work and additional charges. This makes different scopes visible without treating a low monthly fee as the whole cost.

Review observed performance with the supplier at the agreed service meeting. A current access report, the latest recovery result and unresolved issues give the principal evidence beyond a service-level promise. Assign a correction owner and follow-up point for each failure.

Leave With Accounts, Records and Working Access

Make the supplier change an authorised handover with an acceptance step. Keep the practice’s account ownership independent of an individual technician or the outgoing supplier’s personal credentials.

Before the transfer, identify the practice-controlled account owner for cloud services, domains and subscriptions. Arrange secure transfer of administrative access and configuration records to the authorised replacement. Include backup locations, recovery access, encryption-key custody and licence arrangements. Keep secrets out of ordinary email and the general handover checklist.

The outgoing supplier must identify unresolved incidents and faults, with enough history for the replacement to continue the work. Agree any notice period, export format, transition fee and deletion or retention requirements in the contract. Preserve records required by the practice’s applicable obligations.

Schedule the access change so the replacement can administer the systems before routine outgoing access ends. Keep any necessary overlap short, explicitly authorised and recorded. Remove former accounts, remote-management agents and delegated permissions when the transfer is accepted. Rotate credentials the outgoing supplier knew, including recovery credentials where applicable.

Before signing off, have authorised staff retrieve an active matter and a closed matter through their normal accounts. Open the source statements and review files, then follow report references to the evidence. Confirm that backup access works under the new arrangement and that former supplier access has ended. Accept the handover when the practice can keep working and every remaining defect has an owner.