Before hiring a managed service provider, a law firm should ask questions that reveal much more than whether the company can fix computers. For a law firm with 5–50 employees, the evaluation should cover at least 10 areas: experience with law firms, cybersecurity, support and response expectations, proactive maintenance, backup and recovery, Microsoft 365, employee access, technology planning, pricing transparency, and accountability.
The reason for asking these questions before signing an agreement is simple.
Most managed service providers can make a strong first impression.
Their proposals may contain similar services, their websites may use similar language, and almost every provider will describe itself as proactive, responsive, security-focused, and committed to customer service.
Those qualities matter, but they are difficult to evaluate until the law firm asks for specifics.
Instead of asking an MSP whether it provides good support, ask how support is measured.
Instead of asking whether it provides cybersecurity, ask what happens if an employee’s Microsoft 365 password is stolen.
Instead of asking whether backups are included, ask when recovery was last tested.
And instead of asking whether the provider offers strategic guidance, ask to see what a 12–24 month technology roadmap actually looks like.
The objective is not to make the MSP interview unnecessarily complicated.
It is to turn promises into information the firm’s leadership can actually evaluate.
1. How Much Experience Do You Have Supporting Law Firms?
A good first question is not simply, “Do you work with law firms?”
Ask the provider to explain that experience.
A law firm operates differently from many other businesses because attorneys and staff may depend on practice-management applications, document systems, Microsoft 365, legal research platforms, billing applications, remote access, and other specialized technology throughout the workday.
The MSP does not necessarily need to be an expert in every legal application the firm uses.
It should understand how important those applications are to the firm’s operations and be comfortable coordinating with specialized vendors when problems occur.
Imagine a 25-person law firm suddenly cannot access its practice-management application.
The software vendor believes the problem is related to the network, while the internet provider says its service is functioning correctly.
Who owns the problem?
A strong MSP should be willing to help coordinate the investigation rather than telling the law firm to call another vendor and ending the conversation.
When interviewing a provider, ask how many law firms or legal-industry users it supports, what types of legal technology it regularly encounters, and whether it can provide a relevant client example.
If the MSP claims significant legal-industry expertise, it should be able to support that statement with specifics.
2. What Exactly Is Included in Your Cybersecurity Strategy?
Almost every modern MSP offers cybersecurity.
That statement alone tells a law firm very little.
The more useful question is what protections are actually included and how those protections work together.
Cybersecurity should be approached as a layered system that considers employee identities, multi-factor authentication, computers, email, Microsoft 365, permissions, software updates, backups, security awareness, monitoring, and incident response.
The provider should be able to explain its approach without hiding behind technical terminology.
One useful scenario is to ask:
“If one of our attorneys entered a Microsoft 365 password into a phishing website tonight, what protections would stand between that stolen password and our client information?”
That question forces the provider to explain what happens in a real situation.
Perhaps multi-factor authentication creates another barrier. Perhaps suspicious login activity is monitored. Perhaps identity protections detect unusual behavior. Perhaps an incident-response process begins when suspicious activity is identified.
Whatever the answer, leadership should understand it.
Cybersecurity is too important to be represented by a single line on a proposal that simply says “Security Included.”
3. What Happens When One of Our Employees Needs Help?
Most law firms will interact with their MSP most frequently through technical support.
That makes the support experience important.
Ask what happens from the moment an employee reports a problem.
How are requests submitted? Who receives them? How are urgent problems prioritized? How are issues escalated when the first technician cannot resolve them? What happens when multiple employees are affected? What support is available outside normal business hours?
The firm should also understand the difference between response time and resolution time.
Receiving an acknowledgment within 15 minutes may sound impressive, but that metric matters much less if the employee remains unable to work for several hours.
Not every problem can be resolved immediately, and an MSP should not make unrealistic promises.
What it should have is a clear process for prioritization, communication, escalation, and ownership.
Consider a 25-person law firm experiencing a two-hour interruption that prevents everyone from performing normal work.
That represents as much as 50 employee-hours of disrupted productivity.
A four-hour interruption could represent 100 employee-hours.
At that point, IT support is no longer simply a technical service.
It directly affects the firm’s ability to operate.
4. What Do You Do Proactively When We Are Not Calling the Help Desk?
This may be one of the most revealing questions a law firm can ask.
A managed service provider should do more than wait for employees to report problems.
During an ordinary month, the provider may be monitoring systems, managing software updates, reviewing security alerts, checking backups, identifying recurring support problems, monitoring equipment health, reviewing Microsoft 365, tracking aging technology, and preparing recommendations for leadership.
Ask the MSP to describe those activities specifically.
If the answer focuses almost entirely on responding quickly when something breaks, the service may still be largely reactive even if it is sold as managed IT.
A proactive relationship should attempt to reduce the number of preventable emergencies.
For example, suppose an MSP identifies that six laptops are reaching the end of their useful business life.
A reactive provider may continue supporting them until employees begin experiencing failures.
A proactive provider can discuss those devices with leadership, determine which ones should be replaced first, and spread the investment across upcoming quarters.
The equipment may ultimately cost approximately the same amount.
The difference is whether the firm controls the timing or the failures do.
5. How Do You Manage Backup and Disaster Recovery?
Law firms should avoid treating backup as a checkbox.
The existence of a backup does not automatically mean the firm can recover its information quickly or successfully after a serious problem.
Ask the MSP what is backed up, how frequently backups are monitored, where copies are maintained, and how recovery is tested.
Then ask the more important question:
“When was the last time you verified that a client could actually recover from its backups?”
A commonly used starting point is the 3-2-1 backup framework, which calls for maintaining three copies of important information, using two different storage methods, with at least one copy separated from the primary environment.
But the framework is only useful when the recovery process works.
The law firm should also understand what would happen during a serious outage.
Which systems would be restored first?
Who determines priorities?
How would employees continue working?
How would leadership receive updates?
An MSP should be able to walk the firm through that scenario before an emergency occurs.
6. How Will You Manage Microsoft 365?
For many law firms, Microsoft 365 is not simply email software.
It may be central to communication, documents, collaboration, meetings, file sharing, employee identities, and daily operations.
That makes Microsoft 365 management an important part of the MSP evaluation.
Ask whether the provider simply sells or administers licenses, or whether it actively manages the environment.
A stronger conversation should include identity protection, multi-factor authentication, administrative permissions, employee onboarding and offboarding, file-sharing practices, security configuration, and suspicious account activity.
The firm should also understand who has administrative privileges and why.
One particularly useful question is:
“If one of our Microsoft 365 accounts were compromised tomorrow, how would you know, and what would you do?”
The answer should describe a process rather than simply naming another security product.
7. What Happens When an Employee Joins, Changes Roles, or Leaves?
Employee access is easy to overlook until something goes wrong.
A new attorney may need a computer, email, Microsoft 365, practice-management software, file access, printers, phone services, remote access, and permissions to other firm systems.
If onboarding is informal, something will eventually be forgotten.
Offboarding can create an even greater concern.
When someone leaves the firm, accounts may need to be disabled, devices recovered, information retained or transferred, permissions changed, and access to third-party applications removed.
The MSP should have a repeatable process for these situations.
Law firms should ask how much notice the provider needs for a new employee, what information is required from the firm, how account access is documented, and what happens when an employee needs to be terminated immediately.
For a growing 25- or 50-person firm, these processes become increasingly important because leadership can no longer rely on one person remembering every account an employee might have used.
8. How Will You Help Us Plan for Technology Over the Next 12–24 Months?
One of the strongest indicators of a strategic MSP relationship is whether the provider can discuss the future.
Technology planning should extend beyond next week’s support tickets.
Ask whether the provider conducts regular technology reviews and whether it develops a 12–24 month roadmap.
That roadmap might identify computers approaching replacement, cybersecurity improvements, Microsoft 365 projects, backup changes, network investments, software decisions, or other technology needs.
The benefit is not that every recommendation gets approved.
The benefit is visibility.
Suppose a 30-person law firm learns that ten computers should probably be replaced during the next year.
Leadership can decide whether to replace them simultaneously, spread replacements across several quarters, or prioritize employees with the oldest or least reliable devices.
That is much easier to manage than discovering one Monday morning that several critical computers are failing and need immediate replacement.
Strategic planning turns technology from an unpredictable expense into something the firm can budget for and prioritize.
9. How Does Your Pricing Work, and What Is Not Included?
A law firm should understand the MSP’s pricing model before signing an agreement.
Titan’s current planning range for comprehensive managed IT is approximately $150–$300 per user per month, depending on what is included.
Using that range, a 10-person firm might budget approximately $1,500–$3,000 per month, while a 25-person firm could be approximately $3,750–$7,500 per month.
Those figures should not be treated as a universal market rate.
They are a useful starting point for understanding the scale of Titan’s managed IT pricing.
More important than the headline number is the scope.
Ask what is included in the monthly fee and what could create additional charges.
Are projects included?
What about new computers?
Microsoft licensing?
After-hours support?
Cybersecurity products?
Backup services?
On-site visits?
Employee onboarding?
Vendor coordination?
A proposal that costs less per employee is not necessarily less expensive if significant services are billed separately.
Similarly, a higher-priced provider should be able to explain what additional responsibility the law firm is receiving for the difference.
Compare scope before price.
10. How Will You Prove That Our Technology Is Improving?
This question moves the conversation from promises to accountability.
After six or twelve months with the MSP, how will the law firm know whether the relationship is working?
The answer should involve more than asking whether employees seem happy.
The provider may track support trends, recurring problems, response metrics, aging devices, backup status, cybersecurity improvements, projects completed, technology risks identified, or progress against the firm’s roadmap.
The exact metrics will vary.
What matters is that the MSP has a way to demonstrate progress.
For example, imagine a law firm begins the relationship with 15 aging computers, inconsistent multi-factor authentication, no documented employee offboarding process, and recurring support problems involving several devices.
Twelve months later, leadership should be able to see what changed.
Perhaps aging equipment has been replaced according to a planned schedule. Multi-factor authentication has been standardized. Onboarding and offboarding follow a documented process. Recurring technical problems have been addressed. Backup recovery has been tested. Leadership now has a roadmap for the next year.
Those are meaningful outcomes.
Without some form of accountability, the relationship can slowly become another monthly invoice that nobody closely evaluates.
A Practical Example: Comparing Three MSPs for a 25-Person Law Firm
Imagine a 25-person Central New Jersey law firm evaluating three managed service providers.
All three companies have professional websites.
All three promise responsive support.
All three provide cybersecurity.
And all three say they take a proactive approach.
At first glance, the proposals appear remarkably similar.
Leadership therefore asks each provider the same ten questions.
The differences begin to emerge.
One provider offers an attractive price but charges separately for several important projects and security services.
Another has a comprehensive technical offering but provides little evidence of strategic planning.
The third explains its support escalation process, demonstrates how cybersecurity is layered, describes its backup testing process, walks leadership through Microsoft 365 management, explains employee onboarding and offboarding, and provides an example of the 12–24 month technology roadmap it develops for clients.
The purpose of this exercise is not to automatically choose the third provider.
It is to expose differences that the original proposals did not make obvious.
The firm can now evaluate price, responsibility, process, evidence, and fit rather than relying on sales presentations.
That creates a much stronger purchasing decision.
Ask for Proof When an MSP Makes an Important Claim
The MSP industry uses words such as proactive, strategic, responsive, and secure frequently.
Those words become useful only when the provider can demonstrate what they mean.
If the MSP says it responds quickly, ask for actual response metrics.
If it says it has experience supporting law firms, ask how many legal organizations or users it supports.
If it says it provides strategic technology planning, ask to see an example of the planning process.
If it says backups are monitored and tested, ask how testing works.
If it says cybersecurity is comprehensive, ask someone to explain the security layers in plain English.
This is especially important because the law firm is not simply purchasing technology.
It is delegating responsibility for technology that employees depend on every day.
Trust matters.
Evidence helps create that trust.
What Should a Law Firm Expect During the First 90 Days With a New MSP?
The evaluation should not stop once the contract is signed.
The first 30–90 days can reveal a great deal about how the provider operates.
A strong onboarding process should help the MSP understand the firm’s users, computers, network, Microsoft 365 environment, applications, vendors, security controls, backups, and existing technology problems.
The provider should also begin documenting the environment and identifying priorities.
Not every issue needs to be corrected during the first month.
In fact, trying to change everything simultaneously can create unnecessary disruption.
A better approach is usually to determine what is urgent, what should happen next, and what can become part of the longer-term roadmap.
By approximately the end of the first 90 days, leadership should have a much clearer understanding of the firm’s technology than it had before the transition.
That is an important early indicator that the relationship is moving beyond help desk support.
How Titan Approaches the MSP Relationship for Law Firms
For law firms with 5–50 employees, Titan’s approach should be evaluated using the same questions in this article.
A prospective client should understand how Titan handles support, cybersecurity, Microsoft 365, backup and recovery, employee access, proactive maintenance, vendor coordination, and strategic planning.
Titan should also be prepared to explain what happens after onboarding.
How are technology risks identified?
How often does leadership review the environment?
How are aging computers tracked?
How are cybersecurity recommendations prioritized?
What does a 12–24 month technology roadmap look like?
Before publishing this article, this section should be strengthened with Titan’s actual evidence, including years in business, number of law firms or legal-industry users supported, documented response metrics, relevant certifications, client retention information where appropriate, and at least one genuine law firm client result.
For example, instead of simply saying:
“Titan provides proactive IT support for law firms.”
A much stronger statement would be:
“Titan helped a 25-person law firm identify eight aging computers, standardize multi-factor authentication, establish a documented employee offboarding process, and develop a 12-month replacement plan.”
Use that example only if Titan can document that it actually occurred.
Specificity is what transforms a marketing claim into a trust signal.
Final Takeaway: Interview the MSP About Responsibility, Not Just Technology
The best questions to ask an MSP are the ones that reveal what the provider will actually take responsibility for after the agreement is signed.
For a law firm with 5–50 employees, that means evaluating at least 10 areas: legal-industry experience, cybersecurity, support, proactive maintenance, backup and recovery, Microsoft 365, employee access, strategic planning, pricing transparency, and accountability.
Ask for specifics.
Ask for numbers.
Ask for examples.
Ask the provider to walk through realistic situations.
What happens when an attorney cannot work?
What happens when an employee clicks a phishing link?
What happens when a backup needs to be restored?
What happens when an employee leaves unexpectedly?
What happens when ten computers are approaching replacement?
And what happens during a perfectly normal month when nobody calls the help desk?
Those answers can tell a law firm considerably more than another presentation about excellent customer service.
The goal is not simply to find a company capable of supporting the firm’s technology today.
It is to find a technology partner capable of helping the firm become more secure, reliable, predictable, and prepared for what comes next.