At some point nearly every growing firm asks the same question: should we hire someone for IT, or hire a company? Both can work. Both can fail. The right answer depends on size, complexity and what you need that person or company to protect.
This comparison avoids price tags, since costs vary widely by market and scope. Instead it focuses on the tradeoffs that tend to decide the question.
The In-House Model
What you get
- Someone who knows your people, your quirks and your workflows
- Fast, in-person help for walk-up problems
- Direct control over priorities during the workday
What to watch
- Coverage gaps. One person has vacations, illnesses and sleep. When that person is out, who answers a down server?
- Breadth of skill. Network engineering, cloud administration, security monitoring and help-desk support are different specialties. One person rarely excels at all of them.
- Security depth. Round-the-clock monitoring, threat response and compliance documentation are hard for one person to deliver.
- Key-person risk. If they leave, institutional knowledge often leaves with them, including passwords and undocumented setups.
- Isolation. A single administrator has no peer review. Mistakes and shortcuts can persist unnoticed.
When it fits
Larger firms with complex environments and steady workloads often benefit from at least one in-house technologist, ideally supported by outside specialists.
The Managed Provider Model
What you get
- A team with varied skills, such as help desk, engineering and security
- Monitoring and tools that would be costly to build alone
- Coverage when individuals are out
- Documented processes and consistent reporting
- Predictable monthly costs, typically
What to watch
- Responsiveness and familiarity. Ask about named contacts and typical response times. A provider that treats you as a ticket number will frustrate you.
- Fit for law. Does the provider understand legal workflows, confidentiality duties and tools like Clio, NetDocuments and iManage?
- Scope clarity. Read what is covered and what is billed separately.
- Lock-in. Make sure you own your accounts, domain and documentation.
When it fits
Firms from a few attorneys to a couple of hundred often find a managed provider provides broader expertise than a single hire could.
The Hybrid Model
Many mid-size firms combine an in-house administrator with an outside provider. The employee handles daily needs, relationships and vendor coordination. The provider supplies security monitoring, advanced engineering, after-hours coverage and backup support.
This arrangement can offer the best of both, provided responsibilities are divided clearly. Without that, tasks fall into a gap that each side assumes the other covers.
Questions to Settle the Decision
- Who is on call at 2 a.m. on a Sunday? If the answer is "nobody," think about how long your firm could survive an outage.
- Who monitors security alerts? Is anyone watching for suspicious sign-ins and malware?
- What happens if our IT person quits tomorrow? Could someone else get in and run things?
- Who keeps the documentation? Is it complete and stored somewhere the firm controls?
- Who stays current on threats and software changes? ABA Model Rule 1.1, Comment 8 speaks of keeping abreast of the benefits and risks of relevant technology.
- How will we show clients and insurers what we do? Reporting and documentation matter.
Supervision Does Not Go Away
Whichever model you choose, lawyers retain supervisory responsibility for nonlawyer assistance under Model Rule 5.3, which includes outside providers. You cannot hand off IT and stop paying attention. Set up regular check-ins, ask for reports and know who has administrative access to your systems.
Cost Is More Than the Invoice
When comparing, include everything: salary, benefits, training, tools, security software, after-hours coverage, turnover and recruiting costs versus the provider's fee and any extras. Include the cost of an outage, too, even if it is hard to estimate.
A Simple Decision Guide
- Very small firm, simple environment: A managed provider is usually more practical.
- Mid-size firm, growing complexity: Consider hybrid.
- Large firm with custom systems: In-house team supported by specialists.
These are generalizations. Your own priorities may point differently.
Revisit Periodically
Firms change. A model that suited you at ten people may not at forty. Review the arrangement annually.
Counsel Cyber serves as a full managed provider and as a supplement to in-house staff at law firms. If you are weighing the options, we can talk through your situation honestly, even if the answer turns out to be hiring.