Important note: The firm described below is hypothetical, though the pattern is one we see often across the legal, accounting, and financial services community in Northern Virginia, Maryland, and Washington, D.C. The engagement model described is the one BASE Solutions runs with real clients every day.
It is a Monday morning at a 45-person law firm in Washington, D.C. We will call them Westman & Croft. The managing partner opens his laptop and finds that the document management system is down again. A ticket is logged with the IT provider; things are back up by 11am, but two depositions have slipped, and billable time is lost across the firm. The invoice at month-end will include a remediation line item that nobody can connect to a specific decision.
This is the third time this quarter. It is also the third time in a row that the IT provider has told leadership a particular piece of infrastructure needs attention. The recommendation never quite makes it onto a partner agenda, because nobody at the firm can translate the technical issue into a number, a timeline, or a risk worth voting on.
The cost of running IT as a series of tickets
Westman & Croft is not in a bad position. They have a provider who responds when things go wrong, and most days the technology does what it needs to do. What they do not have is a picture of where their technology is heading, what it is going to cost over the next twelve months, or where the firm sits on the risk register their professional liability insurer keeps asking about. What’s missing is the secured ground a firm needs before it can climb.
This is common for a lot of mid-size professional services firms. 65% of law firms budget for technology, according to the 2024 ABA Practice Management TechReport, but a budget without a roadmap doesn’t tell anyone what’s coming. Without a plan to anchor it, every spend looks tactical, and every cyber question gets answered with a vague reassurance.
Reactive IT is also more expensive than the invoice suggests. ITIC’s 2024 research puts the average cost of an hour of downtime above $300,000 for over 90% of mid-size and large enterprises, and for a firm that runs on the billable hour, the math is even less forgiving because forty lawyers locked out of a case management platform for two hours is lost revenue that cannot be recovered. The risk side is no kinder. The 2023 ABA Cybersecurity TechReport found that 29% of law firms had experienced a security breach, and recovery costs in professional services have been climbing year on year.
What the engagement looks like
In our hypothetical, Westman & Croft brings in a virtual CIO partner. The model is the one we run as part of our vCIO services for professional services clients across the DMV.
The first ninety days are about getting an honest picture of the terrain. That means a documented assessment of infrastructure, security posture, vendor contracts, license utilization, and the way the firm uses its technology day to day. It also means sitting in front of the managing partner, the COO, and the firm administrator to ask what the business is trying to do over the next two years.
From there, three things start to happen on a regular cadence.
A twelve-month technology roadmap goes onto a single page. It lists the projects, what each one costs, when each one is scheduled, and what business outcome each one supports, and it is reviewed at every quarterly business review so that the firm and the finance team can both see what is coming.
A risk and compliance register goes onto another page. Cyber risks, regulatory exposure, insurance requirements, and known weaknesses each have an owner, a status, and a target date, and nothing sits on a private to-do list at the provider’s end.
The relationship moves from helpdesk to partnership. The vCIO sits in the room when the firm is making decisions about office relocation, hiring, new matters that involve client data sharing, or a software contract renewal so that technology is brought into the room before the decision is made, not after.
Twelve months later
A year on, the picture at Westman & Croft looks different in the places that matter to a partner group, not only to the person who handles the IT relationship.
Monthly spend is predictable. The all-in number was agreed upon at the start, projects are scoped and approved before they begin, and the surprise line items on invoices have gone away, which means finance plans IT the way it plans every other operational cost. The firm also has a current picture of where it stands on cybersecurity, what is being done about it, and what residual risk remains, so when the insurer’s renewal questionnaire arrives, the answers and the documentation are already on the register.
The technology decisions made over the year tie back to real business priorities. A lateral hire from a New York firm needed secure remote access on day one, a second office required a network design without a six-week wait, and a new matter involving sensitive financial data triggered a controls review before the engagement letter was signed. The partners can talk through their technology direction without reaching for jargon, because someone whose job is to think about that direction has been showing up every quarter and explaining it in terms they can use.
Buying IT services, or having an IT partner
The distinction at the heart of all of this is straightforward. A firm can buy IT services and get tickets resolved, which is a transaction. A firm can also have an IT partner who runs the strategy, owns the roadmap, and stays accountable for the risk picture, which is a relationship. The cost difference between the two is smaller than most managing partners expect, and the difference in what gets delivered is much larger.
For professional services firms operating in the DMV, the shift from the first model to the second tends to be the moment technology stops being a line item to defend at partner meetings and starts being something the firm uses to compete.
A 30-minute call with Atul Bhagat, our CEO, will give you an honest read on how your firm looks today, what is working, and the two or three areas worth looking at first.
