Set up identity and access management around each person's role, the systems they need, and the lifecycle of their work. Give each user a named account, require strong authentication, grant only necessary permissions, and review access when responsibilities change. Use a documented onboarding and offboarding process that also covers contractors, remote sessions, shared resources, and matter-related data.
What should a law firm include in its identity and access policy?
Start with a written policy that explains who approves access, who provisions it, how permissions are reviewed, and how access is removed. Make the policy usable by partners, administrators, HR, and IT, not only by the person configuring accounts.
Define the systems in scope. Include email and collaboration, the document management system (DMS), practice management, timekeeping and billing, client portals, remote access, endpoint administration, and any specialized tools that store or transmit client information.
Assign a business owner to each important system. The owner confirms the purpose of access and approves exceptions; IT records and implements the change. This separation helps prevent a technical account from retaining access simply because nobody knows who should authorize its removal.
Document the rules for individual accounts, shared mailboxes, service accounts, emergency access, and external sharing. Shared credentials obscure who performed an action, so use named accounts and delegated access wherever the system supports them. If a shared account cannot be avoided, assign an owner and a documented credential-change process.
Review access at least quarterly for sensitive systems, and after every material role change.
Keep the policy tied to actual workflows, then check that the configured controls match it. A policy that does not describe how access is truly requested and removed will not provide dependable oversight. The policy and the actual process need to match.
How should firms assign permissions to attorneys and staff?
Use role-based access as the starting point, then add matter-specific permissions where the work requires them. A role can describe common duties, such as attorney, paralegal, billing, intake, records, or firm administrator. It should not automatically grant access to every matter or system.
For each role, list the systems and data required to perform the work. Separate permission to read, edit, share, approve, administer, or delete when the platform allows it. Keep administrative privileges limited to designated personnel and use a separate administrative account when supported.
Matter-centric security deserves particular attention. A new attorney may need access to one active matter, not every client folder. A staff member may handle billing without needing access to privileged legal analysis. Confirm conflicts, ethical walls, litigation holds, and client-specific restrictions with the responsible firm stakeholders before changing matter access.
Do not rely on job titles alone. Two attorneys may handle different clients, and a paralegal's permissions may vary by practice group or assignment. Record the business reason for exceptions and set a review date so temporary access does not become permanent by default.
Test permissions with representative accounts. Confirm that an authorized user can complete ordinary work and that an unrelated user cannot open the same matter or shared folder. This catches both over-permission and controls so restrictive that staff create workarounds. Least privilege should support the workflow, not obstruct it.
Which authentication and remote-access controls should be standard?
Require multifactor authentication (MFA) for email, cloud services, remote access, administrative accounts, and other systems that expose client or firm data. Favor authentication methods resistant to phishing where the systems support them. Establish a secure recovery process so a lost phone does not turn into an informal bypass.
Use single sign-on where it is supported and appropriate, but do not treat it as a substitute for reviewing application access. When an account is disabled centrally, confirm which connected applications actually respond to that change. Some systems maintain separate accounts or sessions that need their own action.
Set remote access rules that reflect the sensitivity of the work. Require managed, appropriately protected devices for access to sensitive resources where practical, and define how sessions are protected, monitored, and ended. Avoid leaving remote sessions active on shared or personal devices.
Review sign-in alerts and account recovery events through the firm's security and support processes. Establish a clear route for staff to report unexpected MFA prompts or suspected account misuse. The goal is a response that is easy to follow during a busy workday, not a rule that people work around.
Check both the identity provider and the business applications. Confirm MFA enrollment, administrative role assignments, recovery methods, and inactive accounts. Document exceptions and their owners. Strong authentication reduces exposure from stolen passwords, but it works best alongside sound permissions, endpoint controls, and timely account changes.
How should a firm onboard attorneys, staff, and contractors?
Make access a controlled part of onboarding, with a named sponsor and an approved start date. HR or the hiring manager should confirm the person's role, supervisor, office or remote arrangement, and expected duration. The system owner or authorized approver confirms which applications and data are needed.
- Confirm the person's identity and employment or engagement status through the firm's normal process.
- Assign a unique account and the minimum role-based permissions needed for the initial work.
- Enroll the user in MFA and provide approved sign-in and recovery instructions.
- Grant matter-specific access only after the responsible attorney or matter owner approves it.
- Record the approver, systems, permissions, and any expiration or review date.
- Confirm the person can complete essential work without granting broader access as a shortcut.
Contractors should have individual accounts, a named internal sponsor, a defined scope, and an end date. Avoid sharing an employee's credentials with a vendor. If a vendor needs elevated access, specify the systems, permitted tasks, approval, and duration, then remove or reduce the access when the work is complete.
For lateral hires and urgent matter assignments, distinguish speed from improvisation. Prepare standard role bundles, but have the appropriate owner approve exceptions. This helps the firm get people working without carrying unnecessary permissions forward. A useful access request captures who needs access, what work it supports, who approved it, and when it should be revisited.
Clear ownership makes onboarding faster to verify and easier to repeat.
What should happen when someone changes roles or leaves?
Treat a departure as a sequence of access decisions, not a single account toggle. Coordinate HR, the supervising partner, IT, and relevant system owners around the effective time. For an involuntary or urgent departure, follow the firm's authorized procedure and coordinate timing discreetly.
- Disable sign-in and revoke active sessions, tokens, and remote access where the systems provide those controls.
- Remove access to email, DMS, practice management, client portals, finance tools, and other firm applications.
- Recover firm-owned devices and credentials, and address local or mobile access under the firm's device process.
- Transfer business records, mailbox responsibilities, and matter ownership to an approved colleague.
- Preserve records and data according to the firm's retention, litigation hold, and matter procedures.
- Review shared mailboxes, distribution groups, delegated access, and any credentials the departing person could use.
- Record completion, exceptions, responsible owners, and any follow-up work with an external vendor.
Do not assume that disabling an email account removes access to every connected service. Confirm each critical application directly, including systems managed by a separate vendor. Check for active sessions, alternate accounts, saved credentials, and shared resources that may still provide access.
Role changes need the same discipline in smaller form. Remove permissions that no longer fit, add newly approved access, and review matter assignments. For temporary coverage, set an end date. A documented checklist makes departures more predictable and helps the firm retain access to work product without retaining the former user's access.
A real-world review comment illustrates why follow-through matters: "GDS followed up the next day to make sure the door sensor issue is resolved. That kind of attention shows real customer service." That testimonial from Kawal, a professional services customer, concerns a door sensor, not identity management. The relevant lesson is the value of confirming that a change is actually complete, rather than assuming the request alone finished the work.
Offboarding is complete only when access, records, and ownership have been checked.
How can a law firm verify that access controls work?
Keep an access inventory that connects people to accounts, applications, roles, and business owners. Include contractors, service accounts, administrator accounts, shared resources, and external collaborators. Compare the inventory with current personnel and matter assignments, then investigate accounts with no clear owner.
Run recurring reviews of sensitive systems and higher-risk permissions. Ask managers and matter owners to confirm that users still need their access, rather than simply asking whether an account looks familiar. Record approvals, removals, exceptions, and remediation owners so the firm can show what was checked and what changed.
Test the lifecycle with a sample onboarding, role change, contractor end date, and departure. Verify account provisioning, MFA, application access, session revocation, record transfer, and evidence of completion. Include applications outside the firm's central sign-in environment. The test should reveal delays and unclear ownership before a real departure makes them urgent.
Track practical measures such as completion of access reviews, overdue contractor accounts, unowned applications, and the time between an approved departure and access removal. Set targets that fit the firm's risk and operating needs rather than adopting an unsupported universal benchmark. Investigate exceptions and adjust the process when responsibilities or applications change.
GDS Technology describes its Identity and Access Security work as reviewing account inventory, access, authentication configuration, roles and permissions, lifecycle procedures, and change documentation. A law firm can use those same control areas to identify gaps and document a practical improvement plan. For broader planning, see the IT services and cybersecurity considerations for law firms and cybersecurity services.
GDS Technology serves multi-location organizations nationally, with offices in Norcross, Georgia and Carmel, Indiana. Firms can also review its IT compliance services and managed IT services when assessing who should own ongoing access administration and support. Begin with one sensitive workflow and verify who can access it, from where, and how that access ends.
Frequently Asked Questions
How often should a law firm review user access?
Review access to sensitive systems at least quarterly as a practical baseline, and revisit it whenever someone changes roles, joins a matter, or leaves. Higher-risk permissions may warrant more frequent checks. The firm should document who reviewed access, what was approved or removed, and who owns unresolved exceptions.
Should law firms give contractors separate accounts?
Yes. Give each contractor an individual account tied to a named internal sponsor, an approved scope, and a defined end date. Avoid sharing employee credentials. Limit contractor permissions to the systems and information required for the work, and verify that access is removed or reduced when the engagement ends.
Is disabling a departing employee's email account enough?
No. Email is only one possible route into firm information. Review remote access, cloud applications, document management, practice systems, client portals, active sessions, delegated access, and shared credentials. Transfer business records and responsibilities through approved procedures, and preserve data according to the firm's retention and litigation requirements.
How can a law firm use role-based access without blocking matter work?
Use job roles to grant common baseline permissions, then add matter-specific access through approval by the responsible attorney or matter owner. Test access with representative users and record exceptions with an owner and review date. This keeps routine work moving while limiting access to matters unrelated to a person's responsibilities.
What should an access review record?
Record the systems and accounts reviewed, the reviewer, the business owner's decision, permissions retained or removed, exceptions, and the person responsible for follow-up. Include contractors, administrator accounts, shared resources, and relevant external access. A concise record helps the firm track remediation and answer reasonable client security questions with evidence.
