Your IT Company Is Not Your Security Team: What Law Firms Actually Need

The confidentiality duty in a law firm belongs to the lawyer, not the vendor. When the paralegal's mailbox gets phished at 8 p.m. on a Wednesday, or the document management server locks up over Memorial Day weekend, the bar treats the resulting disclosure as the lawyer's exposure regardless of who was operating what. That framing changes how a managing partner should think about the split between an IT provider and a security operation — because the two roles map to different professional-responsibility obligations, not just to different pieces of the technology stack.

This piece is not an argument that a firm should fire its IT provider. Most legal IT firms do their layer well. It is an argument that a specific set of tasks — the ones a bar inquiry or a Formal Opinion 483 breach-notification analysis will actually reach for — belongs to a different function than the one that resets a partner's Outlook profile.

The bar makes this a competence question first

The load-bearing rules for a small or mid-size firm sit in four places. Model Rule 1.1 Comment 8, added in 2012 and adopted in some form by more than forty state bars, requires competence in "the benefits and risks associated with relevant technology." Model Rule 1.6(c) requires the lawyer to make reasonable efforts to prevent inadvertent or unauthorized disclosure of client information. Formal Opinion 477R, issued in 2017, applies MR 1.6 to electronic communications and expects stronger protective measures as the sensitivity of the matter increases. Formal Opinion 483, issued in 2018, imposes an affirmative duty under MR 1.4 to notify current clients when a breach affects their material confidential information.

None of those texts names a product or a monitoring frequency. All of them are principles-based, and every one of them lands on the same load-bearing word: reasonable. The operational question a partner has to answer is whether the current arrangement — one IT firm on retainer, security implicit — would read as reasonable if it were being examined after a disclosure event. That is not a technology question. It is a supervisory-and-evidence question.

What a legal IT firm was built to keep running

Legal IT is a specialist trade, and the good firms handle the layer that keeps a matter moving:

• Helpdesk for the paralegal who cannot print the exhibit binder, the associate whose Outlook keeps hanging on a mailbox with fifteen years of matter mail, the conference-room display that will not project during a mediation.
• Deployment and upkeep of the document management system, whether that is a hosted iManage tenancy, NetDocuments, an on-prem ProLaw install, or the cloud-native Clio, MyCase, or PracticePanther stack.
• Practice-management and time-and-billing plumbing, e-filing integration with state and federal court portals, e-discovery ingestion for the litigation team, deposition-room video and audio, DocuSign flows for engagement letters.
• Microsoft 365 or Google Workspace administration — user provisioning, mailbox delegation for the executive assistant, license true-ups.
• Attorney laptop refresh, BYOD enrollment for the partner who insists on the iPad, the on-prem file server, Wi-Fi and firewall management in the office and the satellite location.

None of that is what a security operation does. All of it matters and none of it is what the bar will ask about after an incident.

What only a security operation does, mapped to the rules

The mapping is what usually reveals the gap. Every function below maps to a specific bar-facing obligation:

• Twenty-four-hour identity monitoring on the firm's Microsoft 365 or Google Workspace tenant answers MR 1.6(c). The reasonable-efforts test for a mailbox that holds sealed pleadings, minor client matters, or an ongoing IP filing is not "we run MFA." It is whether someone catches the adversary-in-the-middle session token replay that arrives while the paralegal is asleep.
• Endpoint detection and response, watched by a security operations center around the clock, is what stops the DMS-server encryption chain that FO 483 would then require the firm to notify current clients about. The rule assigns the notification duty; the operating capability decides how thin the notification list becomes.
• Written incident-response coordination and documentation produces the artifact FO 483 assumes exists — a scoped, dated record of what happened, when, who was notified, and what changed. Without it, a Rule 8.3 or state-bar inquiry answer is reconstructed from memory.
• Security awareness training with tracked completion and phishing-simulation click rates creates the evidence that reasonable efforts included the human layer. It is also what an underwriter and, increasingly, a matter-based client on a security questionnaire will ask about by name.
• A written information security program with audit-control logs, MFA-coverage export, encryption attestation, and vendor inventory is what a partner produces on request when a bar inquiry, a malpractice carrier, or a corporate client's outside-counsel guideline asks for it.

Each of these is an operating discipline. An IT firm may install some of the tools; a security operation runs the discipline behind them.

The three attack patterns that actually redraw firm risk

Reading the same fact pattern through the wrong lens is how partners get surprised. The three that show up in real matters:

Closing-wire fraud through the paralegal's mailbox. An adversary-in-the-middle phishing kit captures a session token, satisfies MFA, and quietly sets an inbox rule that routes anything with the word "wire" or "closing" to a hidden folder. The attacker impersonates opposing counsel or the escrow agent from inside the firm's own thread. The Thursday closing wires to a foreign bank. Average loss on a real-estate closing sits in the mid-six figures. IOLTA compounds the disciplinary exposure — the trust fund is not the firm's to lose.

Ransomware against the document management server over a long weekend. The intrusion begins on a Wednesday endpoint, dwells for a few days, lands the encryptor between Friday 6 p.m. and Sunday afternoon. Monday morning the matter files are inaccessible, sealed pleadings are staged for extortion publication, and the calendaring system is offline in front of a court deadline the judge is not going to move. Recovery-without-preparation ranges from a week to three, and the FO 483 duty to notify current clients whose confidential information was affected does not wait for backups to restore.

Sealed and privileged records leaking through the vendor chain. The e-discovery vendor, the transcription service, the cloud DMS itself — all hold matter data, some without a written engagement scoping how it is handled or how a breach flows back to the firm. A disclosure through a subcontractor is still a disclosure. MR 5.3 puts the supervisory duty on the lawyer regardless.

Where MR 5.3 applies to the IT firm itself

The rule most firms miss when they think about the IT relationship. Model Rules 5.1 and 5.3 place a supervisory duty on lawyers with managerial authority to make reasonable efforts to ensure that other lawyers and nonlawyer assistants conduct themselves consistently with the lawyer's professional obligations, including confidentiality.

An MSP with a domain-admin credential set across the DMS, the practice-management system, the tenant, and every endpoint has more direct access to client information than most associates in the firm. That access is nonlawyer assistance under MR 5.3. Practically, satisfying the rule means the firm can produce a written engagement covering confidentiality of client matter files, scoped least-privilege access, prompt breach-notification duties back to the firm, and evidence that the firm is exercising some form of ongoing supervision — periodic access reviews, SOC 2 or evidence-package requests, documented change coordination. "We have worked with them for years" is not the shape of the record a bar counsel is asking about.

When your legal IT firm passes bar scrutiny on its own

A minority of legal IT firms have built an actual security practice on top of the operations one. Whether the one you use is that firm is a question that can be answered by producing five things:

• Managed EDR they operate, not merely resell — running on every workstation, every laptop, and the document management server if it is on-prem, with a real security operations center behind the escalation.
• Recent audit-control logs, an MFA-coverage report, and identity-anomaly evidence from the last month, produced on the same day the request is made.
• A written incident-response process specific to the firm, with a named after-hours escalation, coordination language for the cyber-insurance carrier, and a documented handoff to ethics counsel when a confidentiality-triggered disclosure obligation surfaces.
• A written engagement between the IT firm and the firm covering confidentiality of client matter files, scoped least-privilege access, prompt breach-notification back to the firm, and cybersecurity and errors-and-omissions coverage carried by the IT firm itself.
• Evidence, on request, of participation in the firm's Formal Opinion 483 breach-response tabletop within the last twelve months.

Any missing item is not automatically a failure. It is an unowned function that will be assigned to someone on the day of an event, which is the wrong day to assign it.

Six questions for the next IT review

Bring these to the next quarterly review with the IT firm. The point is not to catch anyone out; the point is to move implicit assumptions into explicit ownership.

1. "Is there a security operations center reading endpoint and identity alerts from our environment around the clock, and can you name the team?"
2. "If a workstation shows active ransomware behavior at 3 a.m. on a Saturday, what does the automatic response do in the first ninety seconds, and what does a human do next?"
3. "Can you produce today the audit-control logs, MFA coverage across mailboxes and admin accounts, and identity-anomaly evidence a cyber-insurance carrier or a bar inquiry would ask for?"
4. "Under MR 5.3, do we have a written engagement covering confidentiality of client matter files, scoped access, and breach-notification duties back to the firm — and does that engagement obligate you to participate in a Formal Opinion 483 notification analysis when one is triggered?"
5. "Do you operate identity threat detection on our Microsoft 365 or Google Workspace tenant — impossible-travel, malicious inbox rules, OAuth consent, token replay — separately from spam filtering, and can you show a report from last week?"
6. "Do you track and patch against the CISA Known Exploited Vulnerabilities catalog on a documented SLA, and can you show which KEV entries in the last quarter you patched and which you accepted as risk?"

Where the answers are hesitant, the answer to "who owns it going forward" is the useful conversation.

What malpractice and cyber-insurance underwriters actually ask

The bar-side rules are principles-based. The carrier-side questionnaires are not. Malpractice carriers are increasingly attaching cyber-supplemental sections that ask about MFA on the mailbox and the DMS admin, EDR coverage on servers, tested backups with a restore date, an incident-response plan with a carrier-hotline entry, and awareness training with click-rate data. Standalone cyber policies ask a more specific version of the same list. An answer that reads "we assume our IT firm handles it" is what quietly moves a firm from covered to declined, or from paid claim to rescinded policy, after a loss.

The point where these two worlds intersect — bar duty and insurable posture — is the practical case for treating security as a separately scoped function.

Co-managed is what produces the evidence pack

The mental default of "one firm, all of it" is a residue from an era when the firm's technology was a single line item and the risk profile was different. It is not the shape that satisfies MR 5.1, 5.3, and 1.6 in a firm that now runs a cloud DMS, a hosted tenant, an e-discovery vendor, and a court e-filing integration.

Co-managed splits the two functions to the specialists that operate them: the IT firm keeps the firm working; the security firm operates detection, response, identity monitoring, awareness training, evidence production, and Formal Opinion 483 coordination. The two coordinate at the seams. Total spend is closer than partners expect to what a generalist would charge for equivalent depth, because each specialist runs its own layer more efficiently than a generalist runs both.

What Obsidian Ridge operates for law firms

We are a CISSP-led managed security practice. We do not compete with the firm's IT provider — we operate the security layer next to them. The program is managed detection and response, identity threat detection, and security awareness training, with the written information security plan, the Formal Opinion 483-aligned incident-response runbook, the MR 5.3-aware written engagement, and cyber-insurance readiness coordination attached. The vertical deep dive lives on the law firm cybersecurity page.

If the pressure point is a cyber-insurance renewal or an outside-counsel-guideline security response due to a corporate client, the Cyber Insurance Readiness Sprint is the fixed-scope engagement — from $1,500, delivered in seven business days — that turns the questionnaire into a paperwork step.

Next step

If this article named a gap the firm already suspected, the practical starting move is either the free carrier questionnaire to score the firm before an underwriter does, or the Readiness Sprint if a renewal or a client-security response is already on the calendar. For the broader tool-and-service-model taxonomy before the co-managed conversation, the MDR vs EDR vs MSSP vs SOC-as-a-service decision tree is the buyer-side companion piece.