How do you transition a law firm to a new IT provider when the current provider is uncooperative?
Transition the firm by securing decision-making authority, documenting the systems and access you can verify, and planning a controlled handoff around attorney workflows. Request records and credentials in writing, but do not let a slow response delay independent review of backups, identity controls, email, and critical applications. Set priorities, preserve evidence, and communicate a clear escalation path.
What should the firm do before giving notice?
Start with the engagement documents, not an argument. Review the current provider agreement for notice requirements, termination dates, data-return terms, access responsibilities, and any stated transition assistance. Have the firm's designated decision-maker or counsel review contractual questions. Keep the transition operational and factual.
Identify who can authorize the change and who owns each business decision. Include a managing partner or administrator, finance, the person responsible for records, and any internal IT lead. Agree on who may approve access changes, vendor communications, emergency work, and transition costs.
List the workflows that cannot pause: document management, email and calendars, practice management, timekeeping and billing, remote access, client portals, and matter-related file exchange. Note which applications have separate vendors and support contacts. A provider change should not accidentally become an application migration.
Before the announcement, preserve existing records the firm is authorized to access, including invoices, account inventories, network diagrams, backup reports, and support history. Do not circumvent controls or access accounts without proper authorization. Keep a dated log of requests, responses, and decisions.
Prioritize four transition areas: identity, data, recovery, and critical applications.
Those four areas give the firm a practical starting point for continuity and risk review.
How can the firm obtain access and documentation?
Send one concise, written request through the contract's designated channel. Ask for a current inventory of systems, administrator accounts, domain and DNS control, cloud tenants, endpoints, network equipment, backups, licenses, vendor contacts, and open support issues. Request the information in a usable format and propose a reasonable delivery date based on the agreement and transition schedule.
Separate items the provider controls from those owned by the firm or another vendor. For each system, record the business owner, technical administrator, billing owner, recovery method, and known dependencies. Mark information as verified, reported but unverified, or unknown. This prevents assumptions from becoming cutover decisions.
Use the provider's normal process for credential transfer, but make the firm's own authorized account owners part of the handoff. Verify administrative access through the relevant vendor portals, then plan changes to passwords, MFA methods, recovery addresses, and delegated access. Do not exchange sensitive credentials through ordinary email.
If cooperation is limited, make requests specific, time-bound, and traceable. Ask the provider to identify any withheld item and the reason. Keep the new provider focused on independent discovery and safe continuity measures rather than waiting indefinitely for a perfect set of records.
Reliable transition records distinguish known access from assumed access.
How should the incoming provider assess risk without disrupting legal work?
Begin with a discovery phase that does not alter production systems unnecessarily. Review identity and administrative access, endpoint protection, email security, remote access, network dependencies, backup coverage, and the systems attorneys use to access matter files. Confirm who supports each application before changing settings.
Rank systems by the consequence of interruption and the time sensitivity of the work they support. A filing deadline, closing, hearing, or client commitment may make a particular workflow the first continuity priority even if its technology appears ordinary. Identify workarounds that are approved by the firm, not improvised during an outage.
Check recovery evidence rather than relying on a statement that backups exist. Determine what data is covered, where recovery copies are held, who can initiate restoration, and whether the process has been tested. Preserve litigation holds and retention requirements when reviewing data movement or deletion. Coordinate decisions with the firm's records and legal leadership.
Keep the assessment focused on observable evidence: account lists, configuration exports, backup logs, support documentation, vendor confirmation, and controlled tests. Record gaps and their business effect. A missing diagram is a documentation issue; an unknown administrator account is an access-control issue. The response should match the finding.
Discovery should reduce uncertainty before it changes the firm's environment.
What does a controlled transition plan include?
Build a sequence with owners, dependencies, decision points, and rollback options. The precise calendar depends on contract terms, system complexity, and the access available; avoid promising a fixed cutover date before discovery. Keep critical legal workflows stable while administrative ownership moves in a deliberate order.
- Confirm authority and scope. Record the firm's decision-maker, approved work, system owners, and the outgoing provider's notice and cooperation obligations.
- Inventory and validate. Map domains, cloud services, applications, devices, network components, backups, licenses, and outside vendors. Mark unknowns clearly.
- Secure control. Establish or verify firm-controlled administrator access, MFA and recovery options, billing ownership, and approved vendor contacts.
- Protect continuity. Validate backups and recovery responsibilities, define support escalation, and document a workaround for essential attorney and staff workflows.
- Schedule changes. Coordinate any account, endpoint, email, network, or security changes with affected users and application vendors. Test with a small, representative group where practical.
- Close the handoff. Revoke access that is no longer authorized, confirm license and billing ownership, preserve records, and document unresolved items with an owner and next action.
For each change, define what success looks like and what would trigger a pause or rollback. Communicate the timing, expected user impact, and support route in plain language. Attorneys and staff should know where to report a problem without having to decide which vendor owns it.
GDS Technology's client feedback offers a small example of the value of clear follow-up. A professional-services client said, "GDS followed up the next day to make sure the door sensor issue is resolved. That kind of attention shows real customer service." A provider transition needs that same basic discipline: confirm the change worked, then close the loop.
A transition is controlled when every change has an owner, a check, and a fallback.
What if the current provider refuses to cooperate?
Do not make the outgoing provider the sole gatekeeper for the firm's continuity. Escalate requests through the contract's named contacts and keep a record of what was requested, when, and how the provider responded. Where ownership or access is disputed, involve the firm's leadership and legal counsel rather than attempting a technical workaround.
Use independent channels to verify what the firm controls. Contact software, cloud, domain, internet, backup, and telecommunications vendors using authorized billing or ownership contacts. Ask each vendor what evidence it requires to confirm account authority and how to transfer administrative responsibility. Keep a list of open cases and reference numbers.
Protect the current environment while uncertainty remains. Avoid broad changes that could interrupt email, file access, or remote work before the replacement access path is tested. If there is an active security concern, have the firm's authorized decision-makers coordinate an appropriate response with qualified incident-response support and preserve relevant records.
Some access or data questions may require contractual or legal resolution. Technical teams can document dependencies and available evidence, but they should not decide ownership disputes. A calm escalation path helps the firm keep business operations separate from the disagreement.
Escalate the dispute through authorized channels while independently protecting continuity.
Frequently Asked Questions
How long does it take to switch IT providers when the current provider is uncooperative?
There is no reliable universal timeline. The schedule depends on contract notice terms, system complexity, access ownership, application vendors, and whether the firm can verify backups and administrative control. Set dates only after discovery identifies dependencies and risks. If access is blocked, separate urgent continuity work from items that need contractual or legal resolution.
Can a law firm switch IT providers without receiving all its documentation?
A firm can begin independent discovery without a complete handoff, but it should not treat missing documentation as proof that systems are safe or understood. Identify what is known, unknown, and controlled by third parties. Request records in writing, verify ownership with vendors, and defer risky changes until dependencies and recovery options are clear.
What should a law firm secure first during an IT provider transition?
Start by confirming authorized control of identity and administrator accounts, access to critical data and applications, backup coverage and recovery authority, and support contacts for essential workflows. The order may vary with the firm's situation. Preserve records and coordinate changes with application owners so a security improvement does not interrupt matter work.
Should the firm change all passwords before the new provider takes over?
Not as an uncoordinated blanket step. First identify authorized account owners, dependencies, recovery methods, and any shared service accounts. Plan credential and MFA changes so the firm retains access and does not disrupt email, document management, or vendor integrations. Use approved secure methods, and document which accounts were changed and verified.
What should the incoming IT provider do if the former provider withholds access?
The incoming provider should document the missing access, continue authorized discovery, and help the firm verify ownership directly with relevant vendors. It should avoid bypassing controls or making unsupported changes to production systems. The firm's leadership and counsel should handle contractual or ownership disputes, while the technical team prioritizes continuity and evidence.
