Moving a Law Firm to the Cloud: Privilege, Compliance, and the 12 Questions to Ask Your IT Provider

We work with a lot of law firms — small partnerships, mid-market commercial litigators, and a few boutiques that bill at rates which make our heads hurt. The firms that moved to the cloud thoughtfully look back on the decision and shrug; the ones that delayed it spent the savings on overtime and an emergency disaster-recovery audit. Both groups had identical starting positions five years ago.

The good news is that “move to the cloud” in 2026 is no longer a risky decision; it’s a sequencing decision. The bad news is that sequencing is where the privilege, residency, and bar-rule traps live.

Why the holdouts are running out of room

Three things have gentle but real-world weight on the “not yet” position:

• Younger associates expect cloud-native workflows. Recruiting against a firm that runs on file shares and an on-prem Exchange is increasingly a tax on the firm’s growth ceiling.
• Clients expect collaborative document review. Sending a 200-page draft as an email attachment and reconciling eight redlines is no longer impressive; it’s a quaint inefficiency.
• Cyber insurance carriers are hardening underwriting. Renewal questionnaires now ask, in plain terms, whether email and documents have modern identity, conditional access, and immutable backup. “On-prem since 2008” rarely passes.

None of those is an argument that the cloud is “safer.” They’re arguments that the on-prem path is becoming more expensive and more rigid than it needs to be.

What cloud actually buys a law firm

Set aside the marketing. Here’s what we observe operationally inside firms that’ve moved well:

• Granular access at the document level — ethical walls become enforced policies, not Outlook rules and good intentions.
• Real DR — not the kind based on a tape that goes home with the office manager on Fridays.
• Defensible auditability — when a partner has to attest to access controls in a malpractice carrier’s questionnaire, the evidence is a report, not a recollection.
• Predictable cost — license-per-seat with known escalators beats “the on-prem Exchange server is dying and the next one is $42K.”
• Mobility without VPN gymnastics — partners working from a cabin in July aren’t a security exception.

The compliance maze

For most firms, the compliance picture has three layers, and they overlap unhelpfully:

1. Bar rules of professional conduct. Most state bars have published opinions on cloud storage of client data — typically requiring “reasonable” encryption, access control, vendor due diligence, and a duty to understand where data resides. The standard is reasonable, not perfect.
2. Client engagement letters. Increasingly, clients dictate where their data may live (US-only is common, sometimes a specific state). Your tooling must respect that per matter, not just per firm.
3. Regulatory exposure inherited from clients. Healthcare, financial-services, defense, and government clients drag HIPAA, GLBA, ITAR, and FedRAMP-adjacent obligations with them. The firm doesn’t get to opt out.

iManage, NetDocuments, and the document-management decision

Most firms over ~30 attorneys end up in a meaningful conversation about a dedicated document management system. The honest framing:

• SharePoint Online is fine for many firms under 50 attorneys with disciplined matter-folder hygiene. It is not a DMS and shouldn’t be sold as one. We tell prospective clients this even when it costs us license revenue.
• iManage Cloud is the strongest fit when the firm has deep matter taxonomy, version control needs, and partners who’ve used it before. Migration is real work; budget for the metadata mapping more than for the file copy.
• NetDocuments tends to be the easier on-ramp for firms coming from a pure-Microsoft stack. The Outlook integration is what most attorneys care about most days.

Whichever you pick, the migration is a chance to fix the ten-years-of-accumulated-folder-naming-conventions problem. Don’t skip that work; you won’t get this window again for a long time.

Hybrid as a feature, not a fallback

We’re happy to help firms move 100% to the cloud. We’re also comfortable telling firms that hybrid is the right answer when:

• A specific client engagement requires data to remain on-prem under contract.
• A small subset of practice areas (say, IP discovery sets) lives in workflow tools that aren’t cloud-mature yet.
• The firm has a recently amortized investment in an iManage on-prem deployment that’s working well; cloud comes with the next refresh.

Hybrid done right is a deliberate boundary, not a procrastination strategy.

The 12 questions to ask your IT provider

Before you sign with anyone — including us — make them answer these in writing. The answers will tell you more about the firm-fit than the proposal will.

1. Where, exactly, will our data reside? Get the cloud region, not the data center metaphor. If the answer is “the cloud,” that’s your answer.
2. What encryption is in place at rest, and who holds the keys? Bring-your-own-key (BYOK) is increasingly table stakes for firms with sensitive client data.
3. How are ethical walls enforced technically? Group membership and matter-level entitlements, not Outlook delegation tricks.
4. How are former-employee accounts deprovisioned? Walk through the actual sequence: same day, including third-party SaaS, including the partner’s mobile device.
5. What does the immutable backup actually look like? Retention, locality, who can defeat it, restore time tested when.
6. How is e-discovery handled when we receive a litigation hold? Native legal-hold tooling vs. eDiscovery search vs. exporting to Relativity.
7. Show me a sample SOC 2 report and a sample BAA. Not a marketing summary. The actual documents.
8. Who is on the named team supporting our firm? Real humans, with bios, with a maximum tickets-per-engineer ratio in writing.
9. What’s your policy if a partner’s account is compromised at 11 PM? Specific runbook, specific phone numbers, specific time-to-first-action.
10. How do you handle a client’s “US-only” residency requirement? Tenant configuration, conditional access, network egress controls.
11. What is your recommended document management strategy for our size, and why is it different from your last firm of our size? The answer reveals whether you’re getting opinions or templates.
12. What does the off-boarding plan look like if we leave you in three years? A provider that won’t hand you a clean export plan in writing isn’t a partner.

After migration: governance discipline

The migration is the easy part. The discipline that follows is what separates firms that benefit from cloud from firms that just move their chaos somewhere new:

• Quarterly access reviews — partners certify access lists for active matters, signed.
• Onboarding/off-boarding playbooks — same-day, scripted, audited.
• Matter-mobility process — when a matter team changes, access changes the same week.
• Annual tabletop — a 90-minute simulated incident, with the managing partner in the room.

If you’d like a free, written readout of where your firm sits today — including a draft answer to all twelve questions above for your current provider — tell us about your firm and we’ll come back with a memo within the week.