A law firm I knew lost $90,000 in a single afternoon. A paralegal received what appeared to be a routine email from opposing counsel during a real-estate closing, asking for the wire instructions to be updated. The email had been spoofed from a domain one character off the real one. The wire went out. The funds were gone within ninety minutes. The cyber-liability insurer paid most of it back. The premium more than doubled at renewal.
That is the modern threat profile for a law firm. Not a hooded figure penetrating a server. A convincing email at exactly the wrong moment.
Below is what a law firm should expect from a managed IT provider in 2026. It is also the framework I would use if I were choosing one.
The Ethical Floor: ABA 477R, Oregon RPC 1.6, and the Reasonable-Effort Standard
The American Bar Association's Formal Opinion 477R, issued in 2017 and never seriously narrowed since, sets the baseline. Lawyers have a duty under Model Rule 1.1 (competence) and Model Rule 1.6 (confidentiality) to take reasonable measures to protect client information against unauthorized access.
The word that does the work is "reasonable." 477R explicitly declines to mandate specific technologies. Instead it requires lawyers to:
In Oregon the framework runs through Oregon Rule of Professional Conduct 1.6 and the Oregon State Bar's published guidance, which mirrors the ABA position with the additional weight of bar-discipline jurisdiction. Under-protecting client information is not just a business problem; it is a discipline problem.
Practically speaking the floor in 2026 means at minimum: enforced multi-factor authentication on every account that touches client data, full-disk encryption on every device, encrypted backup with documented restore testing, an email security stack that catches business-email-compromise attempts, written incident response procedures, and documented vendor due diligence on every cloud service the firm uses.
A managed IT provider that does not get the firm to that floor is not yet meeting the standard of care, regardless of what the engagement letter says.
What "Managed IT for a Law Firm" Actually Includes in 2026
The general scope of managed services applies to law firms the same as any other small business: helpdesk, monitoring, patch management, endpoint security, backup, and Microsoft 365 administration. We covered the pricing models and what is in versus out of scope in a separate guide. The legal vertical adds about a dozen specific items on top.
Identity hardening tuned for legal workflows. Phishing-resistant MFA on every user account. Conditional Access policies that block sign-ins from anomalous locations. Privileged-account separation so that no one who reads email is also signing into the practice management database with admin rights. The 2024 ABA TechReport again found that account compromise is the dominant breach vector; identity is where the money should go first.
Encrypted email and secure communication channels. S/MIME or third-party encryption providers (Egress, Virtru, Microsoft Purview Message Encryption) for sensitive client communications. Secure file transfer that does not depend on email attachments. A documented policy for what gets encrypted and when.
Document management aligned to the firm's practice areas. Most US small firms in 2026 run on Microsoft 365 with a structured SharePoint or OneDrive taxonomy, often layered with a practice-management tool like Clio, MyCase, PracticePanther, or Smokeball that handles matter-centric file organization. Mid-size firms move to NetDocuments or iManage. The MSP should handle the integration work, the matter-folder provisioning automation, and the access-control inheritance so that paralegals see what they need and nothing else.
Practice management integration. Clio and similar tools connect to email, calendar, billing, document automation, and e-signature. The MSP is responsible for the SSO configuration, the LawPay or similar payment integration, and the data-flow review that makes sure client information is not leaking between cloud services.
Email security stack. Microsoft Defender for Office 365 or Mimecast or Proofpoint, configured for the legal-industry threat pattern. Aggressive impersonation protection (display-name spoofing of partners is the BEC pattern). Banner injection on external email so a "Hi, can you change the wire details" lands with a visible warning before it lands in the inbox.
Backup with separation and tested restore. Microsoft 365 native retention is not backup. The MSP should run a third-party backup of mail, OneDrive, SharePoint, and Teams, kept in a separate cloud or region from the production tenant, with quarterly restore tests documented in writing. When a partner accidentally deletes a matter folder eighteen months in and only notices three days later, the restore-test paper trail is what saves the firm.
E-discovery readiness. When a matter goes into litigation hold, the MSP should be able to suspend retention policies on specific custodians, preserve in place, and export when needed. Smaller firms hand off to outside e-discovery vendors (Relativity, Logikcull, Everlaw); the MSP should support the export workflow.
Cyber-liability attestation support. Annual renewal questionnaires from carriers like CNA, Beazley, AIG, and Travelers ask specific operational questions: is MFA enforced everywhere, what EDR is deployed, what is the patch cadence, what is the backup RPO and RTO, what is the incident response procedure. The MSP fills in those answers because the MSP runs those controls. A firm whose MSP cannot speak fluent insurance-attestation language pays for it at renewal.
The Five Threats Specific to Small Law Firms
These are the threat categories I see most consistently when assessing a small-firm IT environment.
Our cybersecurity scope covers the technical controls. The procedural side (training, intake, vendor management) is just as important and is where most firms have the biggest gap.
Local Considerations for Portland-Area Firms
Most of the above applies regardless of geography, but there are a few PNW-specific items worth knowing if your firm is in the Portland metro.
How to Vet a Managed IT Provider for Your Firm
Ten questions, in roughly the order I would ask them.
A real answer to question 10 is the single best signal of whether the MSP knows the vertical. There is no good way to fake the answer.
How Cascade Data Approaches Legal IT
Cascade Data is veteran-owned and based in Sherwood, Oregon. Adam Messick spent twenty years in three different MSPs before founding Cascade Data, with direct experience supporting firms across the Portland metro. Our managed-services scope for law firms includes the items above by default, not as upsells: enforced MFA, EDR, encrypted email tooling for sensitive matters, separated backup with tested restore, cyber-insurance attestation support, and incident response procedures specifically tuned for the BEC pattern. We work with practice-management platforms including Clio, MyCase, PracticePanther, and Smokeball.
If you are weighing whether your current arrangement is meeting the standard of care, we offer a 60-minute assessment call that produces a one-page gap assessment against ABA 477R, Oregon RPC 1.6, and the typical cyber-liability attestation. No commitment, no upsell.
The short version of this article, with the specific scope inclusions and a direct CTA, lives at our Managed IT for Oregon Law Firms page.
Frequently Asked Questions
What does ABA Formal Opinion 477R require for cybersecurity? ABA 477R holds that lawyers have a duty under Rules 1.1 (competence) and 1.6 (confidentiality) to use reasonable efforts to prevent unauthorized access to client information. The opinion does not mandate specific tools but requires a reasonable evaluation of technology, consideration of information sensitivity, and proportionate safeguards.
Are law firms required to use encrypted email? There is no flat federal mandate, but the combination of ABA 477R, state bar opinions, client engagement letters, and cyber-insurance policy conditions effectively makes encryption the standard of care for sensitive communications in 2026.
What is the most common cybersecurity incident affecting law firms? Business email compromise and phishing-driven account takeover. The 2024 ABA TechReport found that compromised user accounts are the leading breach vector, often used to redirect wire-transfer funds during a real-estate or settlement transaction.
What practice management software do most small firms use? Clio, MyCase, PracticePanther, and Smokeball dominate at the small-firm level in 2026. NetDocuments and iManage are more common at mid-size and larger firms.
How does cyber insurance affect a law firm IT decision? Significantly. Carriers in 2026 require attestations on MFA, endpoint detection, backup separation, email filtering, and incident response. A firm that cannot truthfully answer "yes" either cannot get coverage or pays substantially more.
Sources & Further Reading
Need help with your IT?
We're here to answer questions and help your business make smart technology decisions.
Get in TouchGet the Cascade Data Letter
Periodic notes on small-business IT, security, and AI from the work we do. No spam.