IT for Law Firms in Central Oregon
Client files that stay confidential, email that can't be used to steal a settlement, and systems that let you work from the courthouse, home or office. Local IT support for law firms in Redmond, Bend and across Central Oregon.
A local team based in Redmond. Same business day response. A real person answers texts during the business day.
Confidentiality is a technology question now
Most of a law practice now lives in email, a practice management system and a document store. That means the duty of confidentiality depends heavily on how those systems are set up. A firm with five people and no IT department has the same professional obligations as a firm with fifty.
Evolution IT Services is a local team based in Redmond. We set up and run the technology in small firms so that the reasonable steps the rules expect are actually in place, written down and easy to explain if a client, carrier or the bar ever asks.
What the Oregon rules expect
RPC 1.6
Oregon RPC 1.6 requires reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or access to, client information. In practice that means multi-factor sign-in, encryption, access controls and staff training.
RPC 5.3
Lawyers must make reasonable efforts to ensure that nonlawyers working with the firm, including outside vendors such as your IT provider, act in line with the lawyer's obligations.
OSB Formal Op. 2011-188
The Oregon State Bar's opinion says a lawyer may store client materials with a third-party vendor or in the cloud, provided the lawyer takes reasonable steps to make sure the vendor will protect confidentiality.
None of this requires perfect security. It requires reasonable, documented decisions. We help you make those decisions about vendors, settings and policies, and we keep the records. Interpreting the rules for your situation is your call or your ethics counsel's; we handle the technical side.
What we set up for law firms
- Document management. Matter-based folders in SharePoint or your practice management system, with consistent naming, version history and permissions, so files aren't scattered across desktops and personal Dropbox accounts.
- Secure client communication. A client portal (built into most practice management systems) or encrypted Microsoft 365 email for sensitive documents, instead of plain attachments.
- Access by role. Staff see the matters they work on, ethical walls for conflicts can be enforced, and departing employees lose access the same day.
- Trust account access controls. The people who can move money from trust or IOLTA accounts sign in with phishing-resistant methods (passkeys, FIDO2 security keys or Windows Hello for Business), from firm-managed devices, with bank alerts turned on.
- Encrypted devices. Full-disk encryption on every laptop (for example BitLocker or FileVault), and a remote wipe if one is lost at the courthouse or left in a car.
- Remote work done properly. Firm-managed laptops, multi-factor sign-in everywhere and cloud access set up so home offices don't need a VPN held together with tape.
Email security and wire fraud
Business email compromise is the threat that keeps small firms up at night. An attacker gets into one mailbox, often through a convincing fake sign-in page, quietly reads mail for weeks, then sends new wiring instructions for a settlement or a closing from a real address in the middle of a real thread. The money is usually gone before anyone notices.
We defend against it in layers:
- Strong sign-in. Multi-factor on every account, and phishing-resistant methods for partners, bookkeepers and anyone who touches money. Push approvals and texted codes can be phished; passkeys and security keys are built to resist it.
- Domain protection. SPF, DKIM and DMARC set up so attackers can't easily send email that appears to come from your domain.
- Watching for takeover signs. Alerts for unusual sign-ins and for new inbox rules that forward or hide mail, which is a classic sign an account has been taken over.
- A verification rule. Any change to payment instructions is confirmed by phone, using a number you already had, never one in the email. This step is about process rather than technology, and it's the one that stops the loss.
Backups and legal hold
Your practice management vendor backs up its own platform, but that doesn't cover everything you'd need after a mistake or an attack. Microsoft 365's built-in retention is short-term and not an independent backup. We add an independent backup of Microsoft 365 and your document store, keep an encrypted copy off-site and test restores on a schedule.
When litigation is anticipated, preservation matters. Depending on your Microsoft 365 plan, mailboxes and files can be placed on hold so nothing is deleted, even by the user. We set holds up when you ask, document when and how they were applied, and help you pull data for eDiscovery. Deciding what to preserve is your call; making sure the system actually keeps it is ours. More on backup and disaster recovery.
Common questions
Is it OK to keep client files in the cloud?
The Oregon State Bar's Formal Opinion 2011-188 says lawyers may use third-party storage as long as they take reasonable steps to make sure the vendor protects confidentiality. We help you review vendor terms and security settings and document the decision.
Will you sign a confidentiality agreement?
Yes. We expect to, and we limit our access to what's needed to support your systems. That's part of how you meet RPC 5.3 for outside vendors.
Do you work with our practice management software?
We support the systems around it (Microsoft 365, devices, network, backups and sign-in) and work with your vendor's support team when something crosses over. If you're choosing a platform, we can give you an independent view of the IT side.
What should we do if we think an email account was compromised?
Call or text us right away. We reset the password, revoke active sessions, remove any malicious inbox rules and review what the attacker could see. If money moved, call your bank immediately. If you have cyber insurance, notify your insurer before hiring an incident response firm.
Can our attorneys work securely from home?
Yes. Firm-managed, encrypted laptops, multi-factor sign-in and cloud access to documents usually do more for security than an old VPN. Personal computers and personal email accounts stay out of client work.
Keep reading
- Microsoft 365 setup, security and migration
- Cybersecurity services and cyber insurance readiness
- Other industries we support
Looking for general managed IT services in Redmond? That page covers how our monthly plans work.
Talk to a local team about your firm's IT
Book a free 30-minute consultation. We'll look at your email security, document storage, backups and devices, then give you a quote and a one-page, plain-English list of what's fine and what needs fixing. Managed plans are priced per user per month.