Choosing an IT provider means considering more than services and response times. If the provider can access systems containing client information, your firm should understand what that access includes, how it is controlled, and what happens if something goes wrong. These cybersecurity questions to ask an IT provider can help Florida law firms make that discussion concrete.
The Florida Bar has highlighted cybersecurity and supply-chain risk for attorneys. Its materials can help frame a vendor conversation, but a provider’s assurances do not replace your firm’s own review or professional judgment. You can read the Florida Bar’s discussion of attorney cybersecurity and supply-chain risk as background.
Use the questions below in a vendor meeting, and ask for written answers where appropriate. The right level of detail will depend on your firm’s systems, the provider’s role, and the sensitivity of the information involved.
Clarify what the provider can access
Start by mapping the provider’s potential reach. “IT access” can cover remote administration, cloud platforms, case management systems, email, backups, and client portals. Ask the provider to explain which systems it can reach and why each type of access is needed.
- Which employees and subcontractors can access our systems or client data, and how is that access approved? Ask who authorizes access on your firm’s side, how the provider records the approval, and whether access is limited to specific duties or periods.
- Which third-party vendors support your services, and can they access or store our data? Ask for a description of each relevant subcontractor’s role, what information it may handle, and how the provider oversees its access.
- How do you screen, train, and supervise staff who may handle our information? Ask for a clear explanation of the provider’s processes and how staff are instructed to handle confidential legal information.
A provider should be able to explain the access path in language your firm can understand. If the answer is only that access is secure, ask what that means in practice and what your firm can review.
Ask how access is controlled and monitored
Remote administrative access deserves specific attention because it can provide a route into important systems. Ask how the provider prevents shared or unnecessary access, how it verifies users, and how it records activity.
- Do you use individual accounts, multifactor authentication, least-privilege permissions, and logs for remote administrative access? Ask how individual accounts are assigned, how permissions are limited to job needs, and whether your firm can review relevant access logs.
- How quickly is access changed or removed when a staff member changes roles or leaves? Ask who is responsible for notifying your firm and confirming that access is no longer active.
- Can our firm approve, review, or revoke provider access? Clarify what your staff can control directly and what requests must go through the provider.
These questions make the provider’s access model easier to assess than a general statement about security. For related considerations around protecting confidential communications, see this guide to attorney-client privilege and cybersecurity.
Include AI and other data-handling features
AI features may be part of a standalone tool or built into services the firm already uses. Ask about them even if the provider does not market itself as an AI company. The key is to understand what happens to information entered into a feature, processed by it, or made available to its operators.
- If your services use AI, are our prompts, files, or other data retained, shared, or used to train models? Ask about retention periods, model training, and whether data may be shared with other vendors.
- Can provider staff review client inputs or AI outputs? Ask when that might happen, who can do it, and whether the activity is logged or limited.
- How can data be deleted from the AI service, including copies held by supporting vendors? Ask what deletion means in practice and whether you can receive confirmation.
Do not rely on a broad claim that a service is private or secure. Request clear explanations for the particular tools your firm may use. The Florida Bar’s Opinion 24-1 is a relevant reference for firms considering technology and AI use; consult the opinion directly and seek appropriate guidance for questions about your own professional responsibilities.
Agree on incident response before an incident
An incident can involve the provider’s systems, the firm’s environment, or a connection between them. Your agreement and working procedures should make clear how the provider will notify your firm and cooperate if suspicious activity affects systems or client information.
- How quickly will you notify us of a suspected incident affecting our systems or client information, and what details will you provide? Ask what starts the notification process, who receives notice, and what information will be shared as it becomes available.
- What incident-response, forensic, and recovery support is included in our agreement? Clarify responsibilities, points of contact, and any work that falls outside the agreed scope.
- How will evidence be preserved, and how will your team coordinate with ours? Discuss who leads communications, who makes decisions, and how the provider will help preserve relevant records.
Make sure the provider’s process fits with the firm’s own incident plan rather than assuming each organization will know what to do. For planning details, review this Florida law firm cyber incident response plan guide. This is a practical preparedness discussion, not a substitute for legal advice.
Test recovery and plan for the end of the relationship
Backups matter only if the firm can recover usable information and systems when needed. Ask how backups are protected from unauthorized access or alteration, and how restoration is tested. Discuss the systems most important to legal work, including case management, email, document access, and e-discovery workflows.
- How are backups protected, and how often do you test restoring systems and data? Ask what gets tested, how results are documented, and how your firm would be involved in a recovery exercise.
- What happens to our information when the relationship ends? Ask how your firm can retrieve its data, in what usable form, and how the provider handles remaining copies and backups.
- Can you verify that your copies and backups have been deleted? Ask what confirmation the provider can provide, and how it addresses data held by subcontractors.
Plan data return and deletion before a transition is underway. A clear exit process can help prevent uncertainty about access, records, and copies of firm information.
Request evidence that fits your firm
Ask what documentation the provider can share to support its answers, such as written control descriptions, independent security assessment materials, or cyber insurance documentation. Also ask whether the information covers the services your firm will actually use. A document about a different service or environment may not answer the question at hand.
A solo practice may begin with a focused conversation and written descriptions of access, incident notification, and data handling. A larger firm may also want a more formal review of subcontractors, assessments, service agreements, and recovery responsibilities. In either case, look for specific, consistent answers, and note any points that need clarification before granting access.
For firms comparing providers, a law firm cybersecurity audit checklist can help identify related controls to discuss. A provider’s documentation is useful input, but it does not by itself establish that every risk is addressed or that the firm meets every applicable requirement.
Conclusion
Strong vendor due diligence starts with clear questions about access, oversight, data use, incident readiness, recovery, and offboarding. Ask for answers that describe how the provider works, then compare those answers with your firm’s systems and needs. A practical next step is to request a written walkthrough of the provider’s access and incident-response processes before authorizing access to client data.