Managed IT for New York law firms.
Eight firms. One named engineer who knows yours. Our fee at risk on your cyber insurance renewal.
No demo. No pricing call. A document first.
The dispatch board problem
Your current provider answers tickets. Nobody there knows the firm is in trial the second week of March, which laptop belongs to the managing partner, or why the server cannot reboot at 4 p.m. on a filing day. That is not a failure of effort — it is what a dispatch board produces, and every provider past a certain size runs one.
Eight firms. There is no ninth.
Most providers scale by adding technicians and a board to dispatch them. The board is why you re-explain your environment to someone new every time you call. We removed it the only way it can be removed: the practice is capped at eight firms. The ninth would mean the existing eight stop getting the thing they hired us for — so the ninth does not exist.
A named engineer, not a rotation
Your firm gets a specific person. They know your people, your systems, and your court calendar. When you call, you reach someone who already knows the environment — not a tier-one queue working from notes, not a pool, not whoever is free. There is nobody else to route you to, which is the point.
Our fee at risk on your cyber renewal
Cyber insurance renewal is where security claims meet underwriting. That is where we put our fee.
(a) If, because of a control deficiency inside our documented scope, your firm takes a material rate increase at its cyber insurance renewal — or fails renewal and has to buy replacement coverage — we cover the difference in premium.
(b) Our exposure is capped at three months of fees.
(c) The deficiency must fall inside the scope we documented and the firm approved. That scope is defined in the service agreement.
Full terms are in the service agreement, available before signing.
Work we decline
Declined:Everything that is not a law firm.
We know privilege, trust accounting, and court deadlines. We do not know dental practices.
Declined:Firms below 10 or above 40 seats.
Below ten, the economics fail — yours as much as ours. Above forty, you need a department, not a practice.
Declined:Any stack but ours.
Standardization is what the guarantee is priced on.
Declined:Engagements without MFA on every account.
The exception you want is the exception that gets firms breached.
Declined:Nursing the 2015 server nobody will replace.
If the hardware is the risk, replacing it is the work.
Every refusal is the same sentence read five ways: we can only guarantee an outcome if we control the environment.
What the fee covers
One monthly fee, per seat. Everything below is inside it — including the item other providers sell back to you as a product.
- Endpoint management
- Every laptop and desktop enrolled, encrypted, patched, and inventoried. We know which machine is the managing partner's.
- Microsoft 365 administration
- Identity, email, and documents — including the sign-in and consent logs most firms have never read.
- Backup and verified restore
- A backup that has never been restored is a hope. We test restores on a schedule and keep the results.
- Email security
- Filtering, authentication, and controls aimed at the way firms actually get robbed: altered payment instructions.
- Helpdesk
- Answered by your named engineer. There is no tier one.
- Managed detection and response
- Every endpoint monitored, alerts investigated rather than forwarded.
- AI governance
- Nobel & Co. is not an AI company, and AI is not the product. But firm staff have already connected AI tools to firm credentials — the Microsoft 365 sign-in and OAuth consent logs will show who and what within a week. So the contract includes discovery, a sharing audit across SharePoint and OneDrive, a written AI use policy, one sanctioned tool with real contractual data protection, and the rest blocked at the DNS filter. This is confidentiality work, not a productivity program, and we do not resell what we recommend.N.Y. R. Prof. Conduct 1.6 · ABA Formal Op. 512 (2024)
Who this is for. Who it is not.
This is for
- Private-client firms in New York: trusts and estates, family, personal injury, small business.
- 10 to 40 attorneys, with the staff to match.
- Partners who want one accountable person, not a portal.
- Firms willing to standardize: one stack, MFA everywhere, no exceptions.
- Firms that read the service agreement before signing it.
This is not for
- Firms under 10 seats. The minimum is structural, not negotiable.
- Firms unwilling to enforce MFA. We will decline the engagement.
- Firms that need the cheapest option. Cheaper exists; take it.
- Insurance defense and bank-panel work governed by outside counsel guidelines. Those guidelines dictate controls we do not choose, and we will not split accountability for an environment.
How an engagement starts
- 1.
A 30-minute exposure snapshot
Thirty minutes in your Microsoft 365 environment: sign-in logs, OAuth consents, sharing links, MFA coverage. You see what we see.
- 2.
A written assessment
What we found, ranked by exposure, in writing.
- 3.
Onboarding as a scoped project
A defined scope, an agreed calendar, and your named engineer from the first day.
Questions
What does it cost?
Per seat, per month, with a ten-seat minimum. Expect roughly double what a general-practice MSP charges — the cap is why: eight firms carry the whole practice. A firm shopping on price will find cheaper, and should take it. The exact rate is in the proposal.
Why won’t you take more than eight firms?
Because the service is a person who knows your firm, and that does not survive scale. Growing past eight means hiring, rotating, and dispatching — the model whose failures brought you here. The cap is not a marketing number; it is the mechanism.
What happens when you’re full?
We say so, and we take your details for the next opening. What we will not do is take the engagement anyway. A squeezed-in ninth firm would be the quiet end of the thing the other eight are paying for.
We already have an IT provider. What does switching involve?
A scoped onboarding project: the exposure snapshot, documentation of your environment, then transfer of administrative control in an agreed sequence. Your current provider’s cooperation makes it faster, but it is not required — the tenant, the domain, and the data are the firm’s property, not the provider’s.
What exactly does the guarantee cover, and what does it exclude?
It covers the premium difference when a control deficiency inside our documented scope causes a material rate increase at renewal, or forces the firm into costlier replacement coverage after a failed renewal. It excludes deficiencies outside that scope, controls the firm declined in writing, and market-wide premium movement. It is capped at three months of fees. The scope and the full terms are in the service agreement, available before signing.
Do you require multi-factor authentication?
Yes. Everywhere, without exception — and the exception is the point. Attackers do not defeat the enforced control; they log in through the account excused from it, and the account most often excused is a senior partner’s, which is also the one most worth phishing. New York’s SHIELD Act already expects reasonable safeguards from any business holding New Yorkers’ private information. An MFA carve-out for the firm’s most privileged account is not one.
N.Y. Gen. Bus. Law § 899-bb (reasonable safeguards)
Who has access to our data, and where does it sit?
A fair question that deserves specifics, not reassurance. The answer — which accounts can touch what, where administrative access lives, and where your data physically sits — is the same one that will appear in your agreement: [DATA RESIDENCY ANSWER — SEE README]
Are you a law firm, or do you give legal advice?
No. Nobel & Co. is an IT and security practice. We read the rules that bind New York firms — the SHIELD Act’s reasonable-safeguards requirement, ABA Formal Opinion 512 on generative AI, the cybersecurity credit New York now requires in CLE — because your obligations shape our work. Reading is not advising. When a question is legal rather than technical, we say so, and you take it to counsel.
Start with the snapshot
Thirty minutes, your Microsoft 365 tenant, and a written assessment of where the firm stands. If we are full, we will say so. If we are not the right fit, we will say that too.
No demo. No pricing call. A document first.