Question 1

How much does managed IT cost for a small law firm in Toronto?

Accepted Answer

Managed IT for a Toronto-area law firm is almost always billed as a per-user, per-month fee that scales with the size of the firm. The price depends on what is included: whether cybersecurity tools like MDR are bundled or separate, whether Microsoft 365 licensing is passed through or wrapped in, whether after-hours coverage is included, and how sensitive the firm's data is (litigation firms with trust-accounting responsibilities usually need more coverage than a solo real estate practice). At ellwood Technology we typically build a fixed-fee monthly plan after a short discovery — we do not quote a single per-user number without understanding the environment, because the honest answer depends on it. Firms should be wary of any provider who quotes a flat number in the first phone call.

Question 2

Do law firms in Ontario need MFA on Microsoft 365?

Accepted Answer

Yes. Multi-factor authentication is the baseline expectation for any professional services firm handling client information, and Microsoft 365 is the most common entry point for account compromise. The Law Society of Ontario's technology guidance treats reasonable safeguards for client data as part of a lawyer's competence obligation, and cyber-insurance questionnaires now routinely ask whether MFA is enforced on all user accounts. MFA alone is not enough — modern phishing kits can bypass traditional MFA — but a firm without MFA has no meaningful protection against the most common account attacks.

Question 3

What are the Law Society of Ontario's expectations for technology and cybersecurity?

Accepted Answer

The Law Society of Ontario does not publish a prescriptive checklist, but its Rules of Professional Conduct and technology practice guidance make clear that lawyers must maintain the technological competence needed to protect client confidentiality, keep client property secure, and preserve records reliably. In practice this means using current, supported systems, applying reasonable security controls such as MFA and encrypted storage, having tested backups, and having a plan for what to do if client information is exposed. This is guidance, not legal advice — firms should review the LSO's current technology and practice management resources with their own counsel or practice-management advisor.

Question 4

What should a law firm do in the first hour after a phishing incident?

Accepted Answer

Do not delete anything. Preserve the phishing email, any suspicious sign-in notifications, and the recipient's browser session. In parallel, reset the user's Microsoft 365 password, revoke active sessions, and check the mailbox for newly-created inbox rules that forward or hide mail. Look at the tenant's enterprise applications and remove any recently-added third-party OAuth apps that request mailbox or file access — attackers commonly use this path to survive a password reset. Then check Message Trace in Exchange Online for any outbound mail sent from the account. If any of this feels uncertain, call your IT provider before touching anything else — evidence is easy to destroy by clicking around.

Question 5

Can you support our practice-management software (Clio, PCLaw, CosmoLex)?

Accepted Answer

Yes. We support the common practice-management platforms used by GTA firms — Clio, PCLaw, CosmoLex — and the document-management systems that firms typically pair with them, including iManage, NetDocuments and Worldox. We are not resellers or exclusive partners for any of these products; we describe our role as making them work reliably and securely alongside Microsoft 365, endpoint security, and backup. If a firm is choosing between platforms we can share what we see working well in comparable firms, but the final choice belongs to the firm.

Question 6

Do you work with firms outside Toronto?

Accepted Answer

Yes. Our office is in Maple, in the City of Vaughan, and most of our clients are in Toronto and the surrounding GTA — Vaughan, Markham, Richmond Hill, Mississauga and the neighbouring municipalities. Remote support and on-site visits scale naturally across the GTA, and we work with firms further afield in Ontario where the engagement makes sense. If you are outside the GTA and considering us, tell us where you are and how many users you have and we will be candid about whether we are the right fit.

Question 7

What's the difference between antivirus and MDR?

Accepted Answer

Antivirus is a piece of software running on each computer that tries to block known-bad files. It works well against commodity malware and does not require anyone to be watching. Managed Detection and Response — MDR — is antivirus plus a 24/7 team of analysts who investigate suspicious activity and respond in real time, including outside business hours. The difference matters because most serious incidents at professional services firms today are not caught by antivirus alone: they involve stolen credentials, malicious sign-ins, or attacker activity that looks legitimate to a piece of software but is obviously wrong to a human analyst. For law firms handling client funds or confidential information, MDR is the current expectation for a defensible security baseline.

Question 8

How do we switch IT providers without disrupting the firm?

Accepted Answer

A clean provider switch takes 30 to 60 days for most small and mid-sized firms and is done in the background of normal work. The first two weeks are discovery: we document what you have, who owns what accounts, where credentials are stored, and how backups run. The next two weeks are transition: we take over administrative access, roll out our monitoring and endpoint tools, and address any obvious risks (missing MFA, unsupported systems, unpatched servers). By the final phase we are the primary point of contact and the previous provider is out of the environment. Firms should insist on a written offboarding process from the outgoing provider — access transfers, credential handovers, and confirmation that they have no residual access — and we help clients hold that conversation.

IT Support and Cybersecurity for Law Firms in Toronto and the GTA

Why law firms choose ellwood

Focused on law firms

Sophos and Microsoft Partner

Identity-first security

Practice-management aware

Incident response experience

Fixed-fee or block-of-hours

Services for law firms

Managed IT support & helpdesk

Microsoft 365 & Entra ID security hardening

Endpoint protection & MDR (Sophos)

Phishing & business-email-compromise incident response

Backup, business continuity & disaster recovery

Server, virtualization & network

Secure remote access & work-from-anywhere

Compliance & cybersecurity baseline

Case studies (anonymized)

28-user litigation firm, Toronto

Multi-practice law firm, GTA

Law firm with on-prem workloads

Frequently asked questions

Talk to us