An IT support agreement for a small law firm should spell out 9 things in writing: what's covered, what isn't, response times, security standards on both sides, backup and restore testing, who owns your data and documentation, confidentiality, insurance, and how either side can exit. If any of those live only in a sales conversation, they aren't part of your agreement.
For context on cost: fully managed IT from Tomorrow's Technology Today runs $200 to $350 per user per month, with our Gold plan starting at $200. That's $1,000 to $1,750 a month for a 5-person firm, $2,400 to $4,200 for 12 people, and $5,000 to $8,750 for 25. Here's what an agreement at that price should actually say.
"Comprehensive IT support" is a red flag in a contract, not a description. The agreement, or the proposal attached to it, should list services by name. Ours include live phone support from 7am to 5pm on business days, security monitoring by a human-staffed security operations center, security awareness training, Microsoft 365 backup, automated patching, technology planning reviews, and Great Start onboarding with a dedicated project manager. For the full price breakdown, see what managed IT costs for a small law firm.
Exclusions are where surprise invoices come from. Ours are spelled out: home and personal devices we didn't set up, software with a lapsed vendor maintenance agreement, damage from misuse, theft, fire, water, or power events, training classes, and writing your own procedures. Projects, such as moving off an office server, are quoted at a flat rate before work begins.
A guaranteed response time only matters if it's written down for the service level you're paying for. Ours appears on the managed services proposal you accept: 120 minutes for critical issues on Gold, and 60 minutes on Platinum and Titanium, during business hours. If a filing deadline depends on your systems, this is the clause to read twice.
A good agreement doesn't just describe what the provider does. It also states the minimum standards the firm agrees to keep. Ours lists them: multi-factor authentication, supported operating systems, endpoint detection and response, email security, administrative account controls, and security awareness training. It also says what happens when a firm declines a recommended security control: the decision is documented, and the firm accepts that risk. Clear expectations on both sides protect everyone.
"We back you up" isn't enough. The agreement should say what's backed up, how long copies are kept, and whether restores are tested. A backup that completes isn't the same as a backup that restores. We run a full restore test of every backup every other week, with a screenshot of the restored system as proof. Make sure whatever your provider promises here is written into your agreement or order. Here's why restore testing matters.
Your client files are yours, and so is the map of your systems. Our agreement states that the firm owns its data and the documentation we create for its environment: network diagrams, configuration records, asset inventories, and credential records. If you ever leave, those come back to you.
Under Ohio Rule of Professional Conduct 1.6(c), lawyers must make reasonable efforts to prevent unauthorized access to client information. Your IT agreement should support that duty. Ours explicitly covers attorney-client privileged materials and client information, limits our use of your data to delivering services, requires subcontractors with access to follow terms at least as protective, and commits to notifying you within 72 hours of a confirmed security incident involving your data.
The agreement should state what insurance the provider carries, and what it expects from you. We carry professional liability and cyber liability coverage of at least $2 million, and our agreement requires clients to carry at least $2 million in cyber liability coverage as well.
Before you sign anything, work through the 16 questions to ask before signing a managed IT contract.
George E. Moore of the George E. Moore Law Office in Celina, Ohio, put it this way: our team makes his office feel like a priority, whether the issue is major or minor, and "never makes us feel foolish for asking." He also pointed to our organization, attention to detail, and quick response time.
See how we support law firms across Ohio and Indiana.
Want to read our agreement before you sign anything? Book a 10-minute discovery call. Call us at (419) 678-2083 or visit www.TomTechToday.com/discoverycall to schedule yours.