A law firm IT onboarding and offboarding checklist should do more than create an account or disable a login. It should help your firm give each person the access needed for their role, protect confidential client information, and keep matters moving during staff changes.
For a small firm, the process can be manageable without a dedicated IT department. Assign each task to a named partner, office manager, or IT provider, and record who completed it. Adapt the steps to your firm’s policies, client commitments, and any applicable preservation needs.
Before a new employee’s first day
Start with the person’s role and expected work, not a default bundle of permissions. An attorney, paralegal, intake employee, billing staff member, and system administrator may need different access. Identify a supervisor or matter owner who can confirm what is appropriate.
- Confirm role and matter access. List the client matters and systems the employee needs. Review conflicts-related restrictions and ethical walls before granting matter access. Do not assume that everyone at the firm should see every file.
- Prepare the device. Select a firm-managed laptop or other approved device, apply the firm’s security settings, and install the required software. Confirm the employee knows how to lock the device and report a lost or compromised device.
- Set up accounts and sign-in security. Prepare the employee’s work email, identity account, and approved authentication method. Establish a secure way to handle recovery if a device or MFA method is unavailable.
- List legal and business systems. Consider practice and document management, e-filing and court portals, client portals, billing and trust accounting, e-discovery tools, shared calendars, phone services, and remote access. Grant only the permissions needed for the role.
- Check shared access and delegation. Decide whether the employee needs access to shared mailboxes, calendars, document libraries, or administrative functions. Keep shared credentials out of informal notes and identify who is responsible for delegated administration.
- Document the setup. Record the systems provisioned, access approver, device assigned, and any role-specific restrictions. Keep the record in a firm-approved location.
On the first day and during the first weeks
Walk the employee through the systems they will use and how to get help. Explain the firm’s approved ways to handle client documents, communicate with clients, and work away from the office. If personal devices are permitted, make sure the employee understands the firm’s BYOD policy before using one for firm work.
- Have the employee sign in and confirm they can reach only the matters and resources approved for their role.
- Show them how to use approved secure communications and client portals, and where to save matter documents.
- Explain how to recognize and report suspicious messages, unexpected access requests, or a lost device.
- Check that shared calendars, matter assignments, and relevant client communications are visible to the right people.
- Review access after the employee’s responsibilities or matter assignments change. Remove permissions that are no longer needed.
Legal practice systems may have their own permissions, workflows, and support needs. For help thinking through those systems, see legal practice management software support.
When a departure is planned
Plan the transition with the departing employee’s supervisor and the person responsible for IT. Coordinate timing with the circumstances of the departure and the firm’s policies. Before closing accounts, identify the work and information that must remain available to the firm.
- Assign matter ownership. Name a new responsible attorney or staff member for each active matter. Review deadlines, calendars, upcoming court activity, client communications, and open tasks.
- Plan for client-file continuity. Locate matter documents, email, notes, and other work stored in individual accounts or local folders. Transfer needed material to the firm’s approved systems and confirm it is accessible to the appropriate matter team.
- Review preservation needs. Check whether a legal hold, e-discovery workflow, retention policy, or other preservation instruction applies before deleting, altering, or repurposing data. Escalate questions to the appropriate firm decision-maker.
- Prepare the access inventory. Include email, practice and document management, e-filing and court portals, client portals, billing and trust accounting, remote access, cloud services, phone systems, shared files, and administrative accounts.
- Plan device and property return. List firm-owned laptops, phones, keys, access cards, and other equipment. Arrange their return and decide how firm devices will be secured, reviewed, and reassigned under firm procedures.
- Address personal devices carefully. If firm data was accessed on a personal device, follow the documented BYOD process for removing firm data or access. Do not treat a personal device as firm-owned; account for the employee’s privacy and any preservation needs.
Firms that want to check broader access and security practices can also use this law firm cybersecurity audit checklist as a related review.
On separation day
Use a coordinated checklist rather than relying on a single account change. The responsible person should confirm the approved timing, make the access changes, and record what was completed. If there is a concern about unauthorized access or a security incident, follow the firm’s incident-response process.
- Disable or adjust the employee’s access to email, legal systems, cloud services, remote access, and business accounts according to the firm’s plan.
- Remove access to shared files and administrative functions, and review delegated permissions or recovery methods associated with the departing employee.
- Route business communications and calendar responsibilities to an appropriate colleague so client messages and matter events are not overlooked.
- Collect firm-owned devices, keys, and access cards, and record any items that remain outstanding.
- Confirm that matter files and other identified work are retained in approved firm locations before accounts or devices are repurposed.
After separation: verify and close the loop
After access changes, verify that the accounts in the inventory are no longer available to the former employee and that authorized colleagues can reach the files and information they need. Check for overlooked accounts, active sessions, connected applications, or recovery arrangements. Keep a record of the review and any follow-up items.
Continuity is especially important when work involves e-discovery or litigation holds. Zevonix supports e-discovery workflows and litigation hold management, and helps firms keep case management systems running during trial preparation. Its IT services are designed for Florida law firms, with a focus on protecting client data and supporting legal compliance. Learn more about managed IT for small law firms.
Frequently asked questions
What technology and accounts should be ready before a new employee starts?
Prepare the approved device, work email, sign-in security, and role-appropriate access to legal and business systems. Include practice and document management, e-filing, client portals, billing, calendars, and remote access when needed for the role.
When should a law firm disable a departing employee’s accounts?
Coordinate timing with the departure circumstances and the firm’s plan. Make the changes at the approved time, and verify the accounts and access paths listed in the inventory. Do not overlook matter continuity or preservation needs.
How can a firm preserve a departing employee’s email and documents?
Identify the matters and work that must remain available, transfer needed material to approved firm systems, and confirm the responsible colleagues can access it. Review retention and legal-hold needs before deleting or changing data.
How can a solo or small firm manage this without dedicated IT staff?
Assign each task to a named partner, office manager, or IT provider. Use a single checklist, keep an access inventory, and require a completion review so that important steps do not depend on memory.
Make every transition accountable
A consistent, role-based checklist helps a small law firm prepare access thoughtfully, preserve client work, and verify that departing staff no longer have access they should not retain. Start by assigning an owner to each step and reviewing your current process. If your firm wants support with IT operations and legal systems, learn about managed IT services for small law firms.