Quick answer: A law firm should assign access by matter and role, enable multi-factor authentication for supported accounts, restrict external sharing to the intended recipient and duration, and revoke access when staff change roles or leave. IT can support accounts, devices, email, networks and storage within an approved scope; the lawyer or matter owner decides who may access case materials and how they are handled. Do not put client files, passwords or authentication codes in an unapproved ticket or channel.
Law offices share documents with clients, co-counsel, vendors and experts on a matter-by-matter basis. The risk is not limited to malware: an overly broad folder, a former worker’s active account, a shared workstation or a link with no expiry can expose information to the wrong audience. This guide focuses on IT operations and access controls. It is not legal advice, a compliance assessment or a recommendation for a particular case-management product.
Inventory the digital assets first
Record the systems in use and their owners before changing permissions. Depending on the firm, the inventory may include Microsoft 365 or Google Workspace accounts, email, matter folders, internal storage, work laptops and phones, printers/scanners, VPN, backups, digital-signature tools, practice-management software and vendor accounts. Do not assume every system is owned by IT; identify the business owner and provider before making changes.
| Asset group | Questions to answer | Decision owner |
|---|---|---|
| Matter files, folders and email | Who may read, edit, download or share? When should access end? | Matter lawyer or authorized delegate |
| Staff accounts | Is MFA enabled, is recovery assigned and who approves access? | Office manager/HR and system owner |
| Laptops, phones and removable media | Who owns the device, is it locked/encrypted, what data may it hold? | Firm and device owner |
| Client or vendor sharing | Is the right person receiving the right folder for the right duration? | Matter owner |
| Backup and recovery | What is covered, who can request a restore and has recovery been tested? | Data and system owners |
Organize access around matters and roles
A successful sign-in should not automatically open every document repository. Define groups by work: matter lawyer, assigned associate, assistant, finance/operations, IT administrator and external guest. Least privilege is a useful starting point: grant only access needed for a task, avoid shared user identities and review administrator rights on a schedule. It is an operational principle, not a substitute for a firm-specific risk assessment.
Organize access around individual matters rather than one shared “Clients” folder for everyone. For example, the assigned team can access Matter A; a client receives only the approved document set; IT can troubleshoot a device without deciding who should read the matter file. Use consistent group names and approval steps so a backup owner can understand the setup during an incident.
Account and endpoint checklist
- Enable MFA for email, administrator accounts, VPN and storage where supported; consider phishing-resistant methods when the platform and workflow allow them.
- Give each person an individual account. Limit administrative accounts and separate routine work from privileged work where practical.
- Assign an approver for matter access and record the request date, purpose, scope and review date.
- Apply screen locks, supported updates, endpoint protection and device encryption under the firm’s chosen policy.
- Never store passwords, one-time codes, recovery keys or tokens in a shared file or ordinary ticket.
- Decide whether personal devices may access matter files; if allowed, define lock, work-data removal and lost-device reporting procedures.
NIST recommends that small businesses use MFA on accounts that offer it. MFA adds a layer against password compromise; it does not prevent every form of intrusion. NIST: Cybersecurity Basics.
Share documents with clients and outside parties carefully
Before sharing, the matter owner should confirm the recipient, content, permissions and duration. Where the platform supports it, share with named people and require authentication rather than using public links for sensitive material. Limit download or edit rights to the task and review guest access when work ends. Microsoft documents external-sharing options in SharePoint and OneDrive, including specific-person sharing and guest-access controls; the actual configuration depends on the firm’s tenant and policy. Microsoft Learn: External sharing in SharePoint and OneDrive.
Do not move client files to personal email, messaging apps or personal storage just because the approved workflow is inconvenient. Use a firm-approved channel, verify the recipient and access, and know how to revoke it. IT can configure platform controls, but an authorized firm owner must approve what information may be shared.
Joiners, role changes and leavers
| Event | Action | Minimum evidence |
|---|---|---|
| New staff member | Create an individual account after approval; grant only required groups/matters; configure MFA and device | Approver, date, systems and groups |
| Role or matter change | Confirm whether prior access remains necessary; do not copy a colleague’s entire permission set | Matter-owner decision and completed changes |
| Departure or end of engagement | Revoke sessions, VPN, accounts and external shares; recover devices; transfer data ownership under firm policy | Revocation time, operator and reviewed access list |
| Vendor support ends | Remove technician accounts, tokens, VPN and guest rights; confirm handover | Owner, revoked scope and closure confirmation |
Do not automatically delete mail or matter records when disabling an account. Retention and handover should follow firm policy. IT performs approved actions and records them; the data owner decides what must be preserved, transferred or otherwise handled.
If a file was shared by mistake or an account looks suspicious
- Notify the designated incident owner and matter owner through the approved internal route.
- Record the time, account, device, relevant link/folder and known scope. Do not copy sensitive matter content to a personal channel as a workaround for evidence collection.
- The authorized owner decides whether to suspend a link, revoke sessions or disable an account; IT acts within its assigned authority and preserves appropriate logs.
- Work with the email/storage provider if access activity needs to be checked; distinguish confirmed facts from unknowns.
- External or client notification should follow a decision by the authorized firm owner and the firm’s process. IT should not make legal conclusions.
- After containment, review similar permissions, update the procedure and test sharing/revocation again.
No single technical setting guarantees absolute file security. The practical aim is to reduce excess access, detect issues, preserve suitable evidence and make clear who approves, acts and communicates.
Monthly or event-driven review
- Administrator, shared, former-staff and vendor accounts that may still exist.
- Guest access and share links nearing expiry or lacking an owner.
- MFA, recovery methods, approved devices and unusual sessions.
- Lost laptops, shared devices, local copies and removable media under firm policy.
- Backup status and an approved restore test; a green backup job alone does not prove the data is usable.
- Permission-change records: requester, approver, operator, time and result.
What can IT Support handle?
An outsourced IT team can help inventory accounts and devices, configure endpoints and MFA within assigned permissions, troubleshoot email/network/VPN, guide staff through the chosen sharing workflow, revoke rights after approval, check backup evidence and coordinate with vendors. Scope, support hours, remote-access rights, approvers and data handling should be written into the agreement. General IT Support is not automatically legal counsel, a matter-file owner, a forensic investigator or a certification assessor.
IT Systems supports business users, accounts, devices and networks within an assessed scope and agreed SLA. View IT Support for businesses or contact IT Systems.
Frequently asked questions
Should a matter team use one shared account?
Avoid shared sign-in identities because it is difficult to attribute access and revoke an individual’s rights after a role change. Use named accounts and appropriate groups; the details depend on the platform and firm policy.
Can we send clients a public link to avoid sign-in issues?
Use a public link only for material the firm has approved for public access. For client matter files, prefer the intended recipient, authentication and an expiry; the matter owner should approve the share.
Should IT be able to read matter files while fixing an issue?
Not by default. Scope IT access to its task, record access where appropriate, and open file content only when authorized, necessary and consistent with firm policy.
When someone leaves, should IT lock the account or back up data first?
The firm should approve the sequence and designate the records owner. IT can revoke sessions and access at the authorized time; the owner should confirm what must be retained or transferred before deletion or ownership changes.
Does backup replace access control?
No. Backups may help recover data in certain situations; access controls govern who can reach it. Each requires an owner, scope, procedure and separate verification.
