Firm administrators are often handed a monthly IT report that is long, technical and unreadable, or no report at all. Either way, it is hard to know whether the provider is performing well. The solution is not more data; it is a short set of meaningful measures reviewed consistently.
Here are metrics that matter, what they tell you, and what to ask when numbers move in the wrong direction. Targets are illustrations to discuss with your provider, not universal standards.
Service Responsiveness
Time to first response
How long between a staff member submitting a request and a human responding? Your agreement should state targets, often by priority level. Review average and worst-case times, not just the average. A few very slow responses hide inside a good average.
Time to resolution
How long until the issue is solved? Look at the average by category and priority, and ask about tickets open for a long time.
First-contact resolution
What share of issues are solved on the first interaction? A high rate suggests knowledgeable technicians and good documentation. A low rate may point to escalation bottlenecks.
Ticket volume and trends
Rising ticket counts for the same issue, such as printers, slow laptops or login problems, signal an underlying cause that should be fixed rather than patched repeatedly. Ask for the top five recurring issues and a plan for each.
User satisfaction
Many providers send a short survey after ticket closure. Read the comments, especially the negative ones. Attorneys' feedback about disruption during court prep is valuable.
Security and Maintenance Health
Patch compliance
What percentage of devices have current security updates, and how old is the oldest missing update? Ask about devices that are consistently behind. Specific numbers matter less than the trend and the explanations for outliers.
Endpoint protection coverage
Are all devices running the protection tools, and are all reporting? A device missing from the console is a blind spot.
MFA coverage
How many accounts have MFA enforced, and which do not? The goal is every account, with documented exceptions that have an owner and an end date.
Backup success and restore tests
Review backup job success rates, failures and how quickly they were resolved. Ask for the date and result of the last restore test.
Security alerts and incidents
How many alerts were investigated, how many were real, and what was done? A report of "zero incidents" is only reassuring if monitoring is genuinely working.
Account hygiene
How many accounts belong to departed staff? How many administrators exist? Compare to last month.
Lifecycle and Planning
- Hardware age and warranty status: Which devices are approaching end of life?
- Software support dates: Which operating systems or applications will lose vendor support soon?
- Licensing: Are you paying for licenses nobody uses, or missing licenses you need?
- Project status: Are planned improvements on schedule?
Questions to Ask Every Month
- What went wrong this month, and what did you change as a result?
- Which risks are open, and who owns each?
- What could cause an outage or breach in the next quarter?
- Are any commitments in our agreement not being met?
- What do you recommend we budget for in the next year?
Present the Results to Leadership
Keep a one-page dashboard with five to eight numbers and a short narrative. Review it with the managing partner quarterly. This supports the supervisory responsibilities reflected in ABA Model Rules 5.1 and 5.3, and it gives you evidence for insurance renewals and client questionnaires.
Warning Signs
- Reports are late, vague or missing
- The provider cannot explain a number
- Metrics are consistently perfect but staff complain
- Security reports are absent
- Surprises keep arriving without prior notice
What Good Looks Like
A strong provider welcomes scrutiny. It brings the report, highlights problems before you ask, and ties each recommendation to business risk.
Counsel Cyber Reporting
Counsel Cyber provides law firm administrators with a plain-English monthly report covering responsiveness, security health and upcoming needs, and meets with firm leadership regularly. If your current report does not tell you what you need, we can show you what a useful one looks like.