Checklist
Law firm IT checklist: 15 risk points
A law firm IT checklist for firms that want the technical basics covered.
It is not legal advice.
- Serving Los Angeles
- Business IT since 1998
- Remote first, on-site when needed
The checklist
Fifteen points in five groups.
Access and identity
- Unique logins for every user (no shared passwords)
- Least-privilege access for staff and contractors
- Multi-factor authentication on email and remote access
- Offboarding checklist when someone leaves the firm
Devices and network
- Workstation encryption and automatic lock
- Firewall and a network that does not leave matter data on an open path
- Secure Wi-Fi separated from guest access where practical
- Patching for workstations and servers on a schedule
Microsoft 365 and practice software
- Microsoft 365 hardened with MFA and sensible admin rights
- Practice systems (Clio, MyCase, PracticePanther, NetDocuments) backed by a working network and backups
- Clear ownership of who administers each system
Backups and recovery
- Encrypted backups of critical firm data
- A restore test in the last 90 days (not only a backup job that “succeeded”)
- A written path for ransomware or a full outage
Who answers
- A technician you can call or text, not only a ticket portal
How to use this law firm IT checklist
Use this law firm IT checklist as a quick health check. Walk each line against your office. Any line you cannot check off is a gap, and the gaps near the top are usually the most urgent.
What’s included
Beyond the 15 points, a full review also looks at:
- Who can reach which client matters, and why
- Where client files sit outside the main system
- Old accounts for people who left the firm
- Vendors with remote access to firm systems
- Whether the breach plan is written down
- Wire-transfer and payment requests by email
How we start
- Print the law firm IT checklist and mark each point
- Circle anything nobody can answer
- Start with MFA and a restore test
- Schedule an IT assessment for the rest
Why this list matters
The State Bar’s Formal Opinion 2020-203 says lawyers should assess the risks of storing client data on electronic systems and take reasonable steps to secure them. After a breach, it calls for a reasonable inquiry and notice to clients who may be affected. A law firm IT checklist is a simple way to start. This is an IT view, not legal advice.
Re-check after changes
New staff, a new office, or new software can undo good settings. Run the list again after any big change.
FAQ
How often should we run the law firm IT checklist?
At least once a year, and after a move, a new system, or staff changes.
Can you walk the checklist with us?
Yes. That is what the IT assessment covers.
Is this checklist legal advice?
No. It covers the technical basics. Ask ethics counsel what the rules require.
More for law firms
Clio, MyCase, and NetDocuments support
Keep the IT under your practice software working.
Microsoft 365 security for law firms
MFA, access, and hardening for client communication.
Law firm backups and ransomware recovery
Encrypted backups and tested restores.
IT support for solo and small law firms
For practices with 2–25 attorneys.
Law office moves, cabling, and cameras
Open the new space with a working floor.
IT support for Mac-based law offices
Mac and mixed environments.
Cyber insurance readiness for law firms
Technical controls insurers ask about.