Legal
A law firm should own every critical admin account, technology record, and configuration decision in its own name. A managing partner or authorized firm leader owns the business risk, while a named internal administrator or Technology Partner maintains daily access, documentation, and changes under firm-approved controls.
Why should the law firm own its critical technology accounts?
Administrative accounts control systems that store, protect, or move sensitive firm information. That includes email, cloud storage, document management, backups, domains, billing portals, network equipment, security tools, and legal applications.
If a vendor, former employee, or single staff member is the only person with authority to recover an account, the firm has a continuity problem. An urgent change can become delayed while someone tries to locate credentials, approval rights, billing access, or recovery contacts.
Vendor access is often necessary. Vendor ownership is not. The firm should remain the legal account holder and control the recovery methods, billing contacts, and authority to approve material changes.
This is not just an emergency issue. A provider transition, partner departure, office move, application renewal, cyber insurance questionnaire, or client request can expose unclear ownership quickly. Confidential work becomes vulnerable when access depends on one person's memory or one vendor relationship.
Every critical administrative account should have one named firm owner and at least one documented backup owner.
The firm should retain control of its technology even when outside specialists manage it day to day.
Who should own the business decision and the technical work?
Technology ownership works when responsibility is assigned by function rather than assumed from a job title. A managing partner, firm administrator, COO, or another authorized executive should own the business decision for critical systems.
That business owner decides who may approve significant access changes, vendor transitions, major spending, and recovery actions. They also set the level of risk or interruption the firm is willing to accept.
A designated technology custodian should own the operating record. This may be an internal IT leader or an accountable Technology Partner. The custodian maintains the account inventory, verifies access, records configuration changes, coordinates vendors, and keeps documentation aligned with the live environment.
Department leaders should validate the systems that support their work. The person responsible for billing should confirm ownership of billing platforms. Records, litigation support, and practice leaders should confirm dependencies that affect client files, matter workflows, and communications.
| Responsibility | Recommended owner | What must be verified |
|---|---|---|
| Business risk and final approvals | Managing partner, firm administrator, COO, or authorized executive | Who can approve access, major changes, spending, and vendor transitions |
| Administrative account custody | Named firm employee with a documented backup | Recovery contacts, multi-factor authentication, billing authority, and emergency access |
| Technology operations and documentation | Internal IT leader or accountable Technology Partner | Configurations, dependencies, access records, change history, and support procedures |
| Workflow validation | Department or application owner | That matter work, billing, records, and client communication function after changes |
Technical access and business authority should be connected, but they are not the same responsibility.
What technology documentation should the firm control?
A law firm needs enough documentation for an authorized person to understand what the firm relies on, who controls it, and how to recover or change it. That record should not depend on old email threads, a former employee's files, or a provider's private portal.
Useful documentation does not require storing passwords in a spreadsheet. It should identify account custody, system dependencies, approval paths, recovery procedures, current configuration records, and the location of protected credentials.
Start with the systems that affect client work and firm operations: email, document management, practice management, timekeeping, billing, client portals, backups, internet service, phones, domains, endpoint management, firewalls, wireless networks, and line-of-business applications.
- Account name, provider, firm owner, backup owner, and billing or renewal contact.
- Named administrators, delegated vendor access, the reason for access, and the review date.
- Dependencies such as identity services, file storage, email relay, network connections, backups, and integrations.
- Security and configuration records for remote access, retention settings, network equipment, endpoint controls, and recovery procedures.
- Escalation contacts, support agreement details, and the people authorized to approve material changes.
- Offboarding and emergency procedures that identify which access must end and which records must be preserved.
The firm should also identify the source of truth for each category. A password manager, support portal, vendor dashboard, shared drive, and ticket system may all hold part of the answer. The operating record should point to current evidence rather than leave staff searching through disconnected notes.
For firms improving governance, IT compliance services can help organize evidence and identify gaps between written procedures and actual practice.
Documentation is an operating control when it reflects the environment people use today.
How should a law firm manage vendor and employee admin access?
Use named administrative accounts whenever a system allows them. Named accounts make it easier to see who made a change, remove access when roles change, and distinguish approved support work from an unauthorized decision.
Shared administrator credentials create avoidable risk. They make it harder to establish accountability, complete offboarding, or determine whether an action was taken by a current employee, former employee, or outside provider.
Access should match the work being performed. An application vendor may need temporary access to troubleshoot its product, but not ongoing authority over the firm's identity platform. A contractor working on physical infrastructure may need project-specific access, but not access to client data or cloud administration.
Record the access purpose, approving person, scope, and end date. Review administrative access after staff departures, mergers, provider transitions, new practice systems, office changes, security incidents, and major configuration work.
GDS Technology explores the same discipline in its Built, Wired & Secured episode on building system account ownership: inventory access, assign accountability, document dependencies, and review permissions after meaningful changes.
Harold, a media professional, described the value of clear support this way: "Cain responds quickly, knows his stuff, and solves problems fast. He never makes me feel behind on technology." Responsive support works best when authority, access, and documentation are already clear.
Administrative access should be deliberate at the start of a relationship and equally deliberate at the end.
How can a law firm test whether ownership controls are working?
Do not rely only on a provider's assurance or an old inventory. Test one critical workflow. For example, ask the named owners to show how they would reset a departed administrator's account, restore a mailbox, transfer a domain, change a payment approver, or retrieve a client document.
For each critical system, the firm should be able to answer four questions: Who owns the business decision? Who has administrative access today? Where is the current configuration and recovery documentation? What happens if the primary custodian is unavailable?
An uncertain answer is not a reason for blame. It is a governance task that should be assigned, documented, and checked again after the correction is complete.
Backup and recovery deserve the same discipline. A backup product does not solve a continuity problem if nobody can identify the protected data, confirm retention expectations, authorize a restoration, or coordinate business validation afterward. Review the firm's data backup and recovery approach alongside application, account, and documentation ownership.
GDS Technology supports organizations in Georgia and the Indianapolis area, with remote support for clients across the country. For law firms, a practical ownership review should connect managed support, cybersecurity, documentation, and continuity instead of treating them as separate concerns.
A firm should be able to show who owns its environment before it needs to recover it.
Frequently Asked Questions
Should a law firm give its IT provider the primary admin account?
No. The law firm should retain primary business ownership, recovery methods, billing authority, and approval rights for critical accounts. An IT provider can receive delegated administrative access needed to support the environment. This preserves continuity if personnel, vendors, contracts, or technology platforms change.
What happens if a former employee owns a law firm technology account?
The firm should promptly identify the account, transfer ownership to an authorized firm custodian, update recovery contacts, review administrative permissions, and document the change. Review connected services and integrations as well, because a former employee's access may extend beyond one mailbox or application.
How often should a law firm review administrative access and technology documentation?
Review it after material staffing, business, provider, application, or office changes, and on a defined recurring schedule. The goal is not paperwork. The firm should be able to confirm current owners, active administrators, recovery paths, and configuration dependencies before a deadline or disruption tests them.
Should a law firm store administrator passwords in its documentation?
No. Documentation should identify the approved password manager or secure credential process, the responsible account owners, and the recovery path without exposing passwords in ordinary files. Authorized custodians should have controlled access to credentials, while the wider firm can still locate the records needed during a transition or emergency.
