How to Choose a Legal IT Consultant: What Nobody Tells You

The firm hired someone who’d “handled IT for law offices before.” Eighteen months and one ransomware incident later, they were paying a second consultant to clean up the first one’s mess — and eating a six-figure settlement because a client file had been exposed.

I’ve heard this story more than once. The details change (sometimes it’s a botched Clio migration, sometimes it’s an ethical wall that never actually worked), but the through-line is always the same: the firm picked the wrong consultant because they didn’t know what “right” even looked like.

The Short Version: The only legal IT consultants worth hiring are the ones who understand law firm workflows specifically — matter-centric data structures, DMS permissions, ethical walls, bar ethics compliance — not just general IT. Before you sign anything, ask for law firm references, a sample security audit, and their average ticket resolution time. If they can’t answer all three, keep looking.

Key Takeaways:

• Legal specialization isn’t a nice-to-have — it’s the entire ballgame. Generic IT providers consistently underestimate how different law firm workflows are.
• Bar ethics rules (ABA Model Rules + your state bar) create compliance obligations that a non-legal IT consultant may not even know exist.
• Certifications matter, but references from other law firms matter more. Ask for both.
• Migration risk is the #1 hidden cost. A consultant’s “controlled change” methodology is worth more than their feature list.

---

Why Legal IT Is Different (And Why Most Consultants Aren’t)

General IT consultants see your firm and think: Microsoft 365, endpoint security, a ticketing system. Done.

What they miss is everything underneath — the matter-centric file structure your DMS enforces, the ethical wall configurations that prevent conflicts of interest, the intake and conflict-check integrations, the e-discovery workflows, the bar-mandated data residency rules. These aren’t edge cases. They’re how law firms operate every single day.

Here’s what most people miss: a consultant who can configure iManage or NetDocuments correctly is a fundamentally different hire than one who can set up SharePoint. The permissions model alone — matter-level access controls, client confidentiality hierarchies — requires specific training and hands-on experience with legal DMS platforms.

Reality Check: State bar ethics opinions increasingly require that law firms obtain expert advice when selecting or managing software and hardware. That’s not marketing copy — it’s a compliance obligation. If your IT consultant doesn’t know this, that’s already a red flag.

---

The Questions That Actually Separate Good Consultants from Bad Ones

Skip the vendor brochure. These are the questions that surface what a consultant actually knows:

1. How do you support legal software beyond installation? Ask specifically about matter-blocking escalations, file permission structures, and how they handle DMS conflicts. A real answer takes two minutes. A vague answer takes two minutes and says nothing.
2. What’s your average ticket resolution time, and what’s your tech-to-client ratio? Both numbers should be concrete. “We’re responsive” isn’t a number.
3. Walk me through your migration onboarding plan. You’re listening for “controlled change” language — phased rollouts, rollback protocols, user training schedules, partner communication plans.
4. What does your security audit process look like for legal-specific vulnerabilities? Generic vulnerability scanning isn’t enough. You want someone who knows what a ransomware actor looks for in a law firm specifically (hint: it’s the client matter files).
5. How do you handle ethical walls, and what’s your process when a wall configuration has to change? This is a gotcha question for non-legal consultants. Most won’t know what you’re talking about.
6. Can you give me three references from law firms of similar size? This is non-negotiable. Ask, and then actually call them.
7. What’s your exit documentation process? If things go sideways, you need to be able to hand off to a new provider cleanly. Consultants who make exit hard are protecting their recurring revenue, not your firm.

---

Certifications: What Counts and What Doesn’t

Not all credentials are equal. Here’s a practical breakdown:

Certified vs. uncertified isn’t the whole story, though. A consultant with a CLTP and three law firm references is more valuable than one with a CISSP and zero legal clients. The certifications tell you they took the training. The references tell you they can actually execute.

Pro Tip: Ask specifically for references from firms that went through a cloud migration or DMS implementation under their watch — not just day-to-day managed services clients. That’s where the methodology shows.

---

Red Flags That Should End the Conversation

• They’ve never heard of iManage, NetDocuments, or Relativity. These are industry-standard tools. Not knowing them is disqualifying for mid-size or litigation-heavy firms.
• No 24/7 monitoring offer. Ransomware doesn’t wait for business hours.
• Vague contracts with undefined SLAs. Uptime Legal’s guidance is blunt here: require commercial clarity before you sign anything. No hidden fees, no weasel clauses on response times.
• They pitch you on features, not process. The consultant who leads with “we integrate with 100+ legal apps” without explaining their change management methodology is selling you marketing, not competence.
• No legal-specific compliance knowledge. If they can’t speak to ABA Model Rules or your state bar’s data security guidance, they will eventually create a compliance problem for you.

---

How Boutique Compares to General Managed Services

Firms like Juris Fabrilis and Corsica Tech are built specifically for legal — they lead with IT roadmaps, cyber strategy, and matter-centric workflow integration. They charge premium rates, and for complex or high-stakes environments, it’s usually worth it.

General managed services providers (think Afinety’s model) offer scalable per-firm pricing that makes more sense for smaller firms with straightforward needs — security audits, endpoint management, backup and recovery. The trade-off is strategic depth.

The honest decision framework: if you’re in active litigation with sensitive client matters, going through a merger, or recovering from a security incident, pay for the boutique specialist. If you’re a 3-attorney estate planning firm that needs reliable email and backup, the scalable managed services model works fine — as long as they still know what a DMS is.

---

Practical Bottom Line

Before you talk to a single consultant, get clear on three things: your current pain point (security, migration, workflow inefficiency), your firm size and risk profile, and your budget for both the engagement and ongoing managed services.

Then run every candidate through the seven questions above. Pull their references. Ask specifically about legal DMS and bar ethics compliance. Request a sample security audit or IT roadmap from a previous legal client.

The difference between a good hire and a bad one usually comes down to due diligence you could do in two hours. The firms that skip it are the ones telling the “eighteen months and a ransomware incident” story.

For a broader overview of the legal IT landscape before you start interviewing consultants, the Complete Guide to Legal IT Consultants covers what these engagements typically look like from end to end — worth reading before your first call.