IT Support for Law Firms

They set a standard, not a checklist, which is the part firms find hard to act on. Model Rule 1.6(c) asks for reasonable efforts to prevent unauthorized access to client information, and Comment 18 says that's judged on sensitivity, likelihood of disclosure, cost and difficulty of safeguards, and whether a safeguard makes it harder to represent the client. Formal Opinion 477R applied the same reasoning to client communications. Translated into infrastructure: multi-factor authentication everywhere, encryption in transit and at rest, access scoped to the matter instead of the whole server, a record of who opened what, and someone who can show a court or a carrier that all of it was in place before the question came up.

Yes. Connecticut added the ABA's technology-competence language to Rule 1.1, Comment 8, effective January 1, 2014, so competence here explicitly includes keeping up with the benefits and risks of the technology your firm uses. It doesn't mean an attorney has to configure a firewall. It does mean the firm has to know what it's running, what it protects, and who's accountable for it, which is one of the things a virtual CIO is for.

ABA Formal Opinion 483 says the firm has to act competently to stop the breach, investigate what happened, notify clients whose material confidential information was involved or likely involved, and keep them updated. So the quality of your logging, your backups, and your incident-response plan decides how narrow and how factual that notification can be. When something lands, we follow the bouncing ball: we own it, handle it, run it to ground, and make sure it doesn't escalate further. Then you get a documented account of what happened instead of a shrug.

We run the environment those platforms live in: the servers or the cloud path, the workstations, identity and access, email, the backups, and the integrations between them. Document management such as iManage or NetDocuments, practice management such as Clio, e-filing, and time and billing all depend on that layer working, and that layer is ours. The vendor secures and supports the application itself and we coordinate with them, which beats either side guessing.

Yes, and ABA Formal Opinion 498 already blessed virtual practice as long as the firm takes reasonable precautions on access, transmission, and supervision of staff. On the ground that means multi-factor authentication on everything, encrypted access instead of a home router forwarding a port, managed devices instead of personal-and-hoped-for, and a written policy your staff has actually read. We set it up and then keep it enforced, which is the half that usually decays.

That's most of the job. Your virtual CIO sits with firm leadership and talks about risk, budget, and the roadmap in business terms, not acronyms. When an acronym is unavoidable we say what it means the first time. Attorneys are not short on people willing to talk over them, and we're not trying to be one of them.

About four rings to a person, not to a queue. Seven minutes is the average first response on a ticket, under 1% of tickets ever need to be escalated, and client satisfaction runs 98.9%. On a filing day, that difference is the whole point.

Typically two to four weeks, phased so most of the work happens before cutover. It's white glove and we're onsite for the entire transition. Whether we overlap with your outgoing provider depends on them: where they allow it, day-to-day support overlaps through the switch, and where they don't, we go live on transition day and keep a line open to them for a week or two, because documentation is never as complete as anyone claims. We schedule around your calendar, not ours.