An IT support agreement for a small law firm should spell out 9 things in writing: what's covered, what isn't, response times, security standards on both sides, backup and restore testing, who owns your data and documentation, confidentiality, insurance, and how either side can exit. If any of those live only in a sales conversation, they aren't part of your agreement.
For context on cost: fully managed IT from Tomorrow's Technology Today runs $200 to $350 per user per month, with our Gold plan starting at $200. That's $1,000 to $1,750 a month for a 5-person firm, $2,400 to $4,200 for 12 people, and $5,000 to $8,750 for 25. Here's what an agreement at that price should actually say.
1. A Specific List of What's Covered
"Comprehensive IT support" is a red flag in a contract, not a description. The agreement, or the proposal attached to it, should list services by name. Ours include live phone support from 7am to 5pm on business days, security monitoring by a human-staffed security operations center, security awareness training, Microsoft 365 backup, automated patching, technology planning reviews, and Great Start onboarding with a dedicated project manager. For the full price breakdown, see what managed IT costs for a small law firm.
2. A Written List of What Isn't
Exclusions are where surprise invoices come from. Ours are spelled out: home and personal devices we didn't set up, software with a lapsed vendor maintenance agreement, damage from misuse, theft, fire, water, or power events, training classes, and writing your own procedures. Projects, such as moving off an office server, are quoted at a flat rate before work begins.
3. Response Times You Can Point To
A guaranteed response time only matters if it's written down for the service level you're paying for. Ours appears on the managed services proposal you accept: 120 minutes for critical issues on Gold, and 60 minutes on Platinum and Titanium, during business hours. If a filing deadline depends on your systems, this is the clause to read twice.
4. Security Standards for Both Sides
A good agreement doesn't just describe what the provider does. It also states the minimum standards the firm agrees to keep. Ours lists them: multi-factor authentication, supported operating systems, endpoint detection and response, email security, administrative account controls, and security awareness training. It also says what happens when a firm declines a recommended security control: the decision is documented, and the firm accepts that risk. Clear expectations on both sides protect everyone.
5. Backup Terms, Including Restore Testing
"We back you up" isn't enough. The agreement should say what's backed up, how long copies are kept, and whether restores are tested. A backup that completes isn't the same as a backup that restores. We run a full restore test of every backup every other week, with a screenshot of the restored system as proof. Make sure whatever your provider promises here is written into your agreement or order. Here's why restore testing matters.
6. Who Owns Your Data and Documentation
Your client files are yours, and so is the map of your systems. Our agreement states that the firm owns its data and the documentation we create for its environment: network diagrams, configuration records, asset inventories, and credential records. If you ever leave, those come back to you.
7. Confidentiality That Names Privileged Material
Under Ohio Rule of Professional Conduct 1.6(c), lawyers must make reasonable efforts to prevent unauthorized access to client information. Your IT agreement should support that duty. Ours explicitly covers attorney-client privileged materials and client information, limits our use of your data to delivering services, requires subcontractors with access to follow terms at least as protective, and commits to notifying you within 72 hours of a confirmed security incident involving your data.
8. Insurance on Both Sides
The agreement should state what insurance the provider carries, and what it expects from you. We carry professional liability and cyber liability coverage of at least $2 million, and our agreement requires clients to carry at least $2 million in cyber liability coverage as well.
9. Term, Price Changes, and a Clean Exit
- Term: ours is 36 months, renewing for 1-year terms unless either side gives 90 days' notice.
- If we don't perform: you give written notice, we have 30 days to fix the problem, and if we don't, you can leave with no early termination fee.
- Price changes: reviewed at renewal with 60 days' notice, plus documented third-party licensing increases passed through with 30 days' notice.
- Exit: up to 30 days of transition assistance, returning your data, documentation, and credentials and working with your next provider, billed at hourly rates.
Before you sign anything, work through the 16 questions to ask before signing a managed IT contract.
What a Law Firm Client Says
George E. Moore of the George E. Moore Law Office in Celina, Ohio, put it this way: our team makes his office feel like a priority, whether the issue is major or minor, and "never makes us feel foolish for asking." He also pointed to our organization, attention to detail, and quick response time.
Why Law Firms Work With Tomorrow's Technology Today
- More than 20 years in business, headquartered in St. Henry, Ohio, serving firms across Northwest Ohio and Northeast Indiana
- Woman-owned and woman-led
- Every technician is security-trained to CJIS standards and background-checked
- Owner Lisa Niekamp-Urwin wrote Sitting Duck, a #1 Amazon Best Seller, and is a past president of InfraGard Toledo
- Microsoft Partner
See how we support law firms across Ohio and Indiana.
Want to read our agreement before you sign anything? Book a 10-minute discovery call. Call us at (419) 678-2083 or visit www.TomTechToday.com/discoverycall to schedule yours.