A new attorney starting Monday should be productive by Tuesday. In many firms the first week is a patchwork: a borrowed laptop, a shared password for the document system, a temporary email forwarding rule that nobody remembers to remove. Each shortcut feels harmless. Together they create unmanaged access and security gaps that last for years.
A written onboarding checklist fixes this. The same list works for paralegals, assistants, lateral hires and summer clerks, with adjustments for role.
Before the First Day
Start at least a week ahead.
Accounts
- Create the user in your identity system, typically Microsoft 365, with a unique account. No shared logins.
- Assign a license and groups matching the role.
- Set up the practice-management account with role-appropriate permissions.
- Grant document-system access only to the matters and practice groups they need. Lateral hires may require ethical screens, so involve the ethics partner before granting access.
Device
- Prepare a firm-managed laptop with disk encryption, endpoint protection, current updates and the firm's standard software.
- Enroll it in device management so it can be updated, located and wiped if lost.
- Avoid letting new hires start on personal computers "just for now."
Authentication
- Plan MFA enrollment for day one. Have the person set it up during their first login session with IT present or on a call.
- Provide a password manager and show how to use it.
Day One
- Welcome and expectations. A brief meeting covering acceptable use, confidentiality and who to call for help.
- Sign-in and MFA setup. Confirm each system works before leaving them alone.
- Phone and mobile. If they will access email on a phone, install the required management profile and require a passcode.
- Printing, scanning and phone system. The small details that create frustration when missed.
- Policies to acknowledge. Acceptable use, remote work, AI use and incident reporting.
Show Them How to Report Problems
Make sure the new person knows exactly how to report a suspicious email or a lost device. Emphasize that reporting quickly is encouraged and no one will be blamed for an honest mistake.
First Week
- Provide short security awareness training, including phishing and wire fraud examples relevant to the role.
- Walk through how the firm files documents and email to matters, so the record is complete from the start.
- Explain how to share files securely with clients and outside parties, and which methods are not allowed.
- Review time entry and billing practices with the practice-management system.
- Confirm they know the firm's rules on personal devices and cloud storage.
For Lateral Attorneys
Lateral moves raise special issues.
- Do not import files, contacts or client data from the prior firm without ethics and conflicts review. Many professional-conduct rules and employment agreements limit what a departing lawyer may bring.
- Treat any request to "just forward my files" with caution and send it to the appropriate partner.
- Document conflict checks and screens before system access is granted.
Check your state bar's guidance and consult counsel on specifics.
Contractors and Temporary Staff
Model Rule 5.3 concerns responsibility for nonlawyer assistance, which includes outside personnel with system access. Give contractors separate accounts with limited access and a defined end date, and remove access when the work ends.
Offboarding Is the Other Half
Build the departure checklist at the same time.
- Disable accounts the day the person leaves, or earlier for involuntary separations.
- Reset shared credentials they may have known.
- Recover and wipe devices, and remove firm email from personal phones.
- Transfer ownership of files, calendars and mailboxes.
- Review forwarding rules and connected apps for the account.
- Update the list of who has access to what.
Track It
Use a simple ticket or form so each onboarding is recorded, with dates and who completed each step. That record is useful for audits, insurance questions and your own consistency.
Counsel Cyber helps law firms build onboarding and offboarding processes into their managed IT, so accounts, devices and training are handled the same way every time. If your current process lives in someone's head, we can help you write it down.