Four law firms to an engineer.

When something breaks at 8:40 on a filing morning, you already know who is answering. Not a queue. Not a case number. One engineer who knows your firm, your matters, your partners’ machines, and which deadline this week cannot move.

The monitoring, the backups, the security stack, the insurance renewal you’d rather not think about — all of it runs underneath, quietly, the way it always should have.

Ask whether we have room

Thirty minutes inside your own tenant. A written assessment of what is wrong. No demo, no pricing call.

$325 per seat, per month · ten-seat minimum · four firms to an engineer

The dispatch board problem

The failure is structural.

Your current provider answers tickets. Nobody there knows the firm is in trial the second week of March, which laptop belongs to the managing partner, or why the server cannot reboot at 4 p.m. on a filing day. A dispatch board produces exactly this.

We hire before we take a fifth firm.

That is the entire constraint, and everything else on this page depends on it.

A forty-person IT company cannot know your firm. That isn’t a criticism — it’s arithmetic. They keep a dispatch board because they have to. We don’t, and the only way that stays true is a hard number: four firms to an engineer. A fifth firm waits for a second engineer. When there is no engineer with room, there is no room.

The work that eats a partner’s Saturday

When a bank or an institutional client sends your firm a security questionnaire, someone has to answer it. It is usually a partner, usually on a weekend, and usually guessing. These are not short. The Shared Assessments SIG Lite is the short form; the full SIG runs to hundreds of questions. Financial-institution outside counsel guidelines increasingly require specific controls — a stated encryption standard, a 24×7 security contact reachable within hours, defined breach-notification timelines — and hold the firm to them.

Shared Assessments SIG Lite (2025 release): 128 control questions

We complete these in your name, on your letterhead, inside the retainer: client security questionnaires, cyber-insurance applications, and bank vendor-diligence forms. We answer them because we built and run the environment they ask about, so the answers are true and we can show the evidence behind each one. This is the work you cannot delegate to a provider who doesn’t know your systems, and the reason firms pay for a named engineer instead of a queue.

What you can hand a client unedited

Every quarter we produce a short posture report: MFA coverage, backup-restore test results with dates, endpoint detection status, and any control gaps and what we did about them. It is written so you can forward it to an underwriter or an institutional client without editing it, because it is true and dated. This is the same evidence that makes our renewal guarantee collectible — controls underwriters now price to the dollar — and the same evidence a client’s security questionnaire asks you to produce. You do not have to ask for it or assemble it. It arrives.

Where your data sits: On United States soil, guaranteed in the agreement. Nothing leaves it: no offshore storage, no offshore backup, no client data at rest on any engineer’s own machine. We state access rather than wait to be asked. No engineer works from outside the United States except through a hardened gateway on US soil, screen access only, with nothing copied down. Any such arrangement is named in your agreement before it begins. Which named accounts can touch your environment, from where, and where administrative credentials live is set out in writing before signature.

What you stop thinking about

The retainer buys one thing: you stop carrying the firm’s technology in your head. The carrying moves to someone whose name you know. What follows is not a menu. It is the list of things that stop being your problem.

The operational floor, included and not itemized: endpoint management, Microsoft 365 administration, backup with verified restores, email security, a password manager for every user, a helpdesk answered by your named engineer, and managed detection and response. A generalist provider sells these too. The difference is who answers, how few firms he carries, and what we put at risk on your renewal.

The AI your staff already use: Your staff have already connected AI tools to firm credentials — the consent logs will show who and when. Under N.Y. Rule of Professional Conduct 1.6 and ABA Formal Opinion 512, that is now the firm's problem, not the vendor's. We sanction one tool with contractual data protection and block the rest at the DNS filter, and we document the control so it survives a client's question about it. Most general IT providers do not offer this at all; we treat it as part of confidentiality, because that is what the rules now call it.N.Y. R. Prof. Conduct 1.6 · ABA Formal Op. 512 (2024)

Our retainer is at risk on your cyber renewal.

Cyber renewal is where security claims meet underwriting. That is where we put our own money. Ask the other providers on your shortlist whether they will match it.

(a) If, because of a control deficiency inside our documented scope, your firm takes a material rate increase at its cyber insurance renewal, we cover the increase above 15%. If the deficiency forces a failed renewal and the firm has to buy replacement coverage, we cover the excess over the expiring premium.

(b) Our exposure is capped at three months of the retainer.

(c) The deficiency must fall inside the scope we documented and the firm approved. That scope is defined in the service agreement.

(d) It does not cover market-wide rate movement, the firm’s own risk-profile changes, controls the firm declined in writing, changes made to the environment without our advice, anything outside documented scope, a first cyber policy with no expiring premium, or a renewal the firm starts too late for us to work.

Full terms are in the service agreement, available before signing.

A named engineer, not a rotation

Your firm is assigned one engineer. Not a pod, not a queue, not whoever is on shift. He carries three other firms besides yours, which is why he knows your people, your systems, and what your court calendar looks like in March.

He is not doing all of it alone, and you shouldn’t want him to be. Behind him is the engineering that patches, monitors, and backs up your environment around the clock. What he owns is your firm — the decisions, the relationship, and the answer when you call. He directs the work; he doesn’t disappear into it.

And when your engineer is away.

One person owning your firm is the point of all of this. It is also the question your committee will ask first: what happens when that person is on a plane, in surgery, or gone for good. Four answers, all of them in the agreement rather than in good faith.

(a) Nothing operational waits for him. Monitoring, patching, backup and detection run continuously behind your engineer, on a calendar that is not his.

(b) As the practice takes its first firms, I commit a named alternate in your agreement before onboarding begins; I will not sign a firm I cannot cover. Not a queue. One more person who has read your file.

(c) Your environment is documented so a competent stranger could run it: asset inventory, where credentials live, the restore procedure, the escalation order. Your firm holds a current copy, and planned absence reaches your calendar before it reaches ours.

(d) If the practice ends for any reason, the firm keeps its tenant, its domain, its data, and its documentation. There is nothing to pry loose, because none of it was ever held.

Your engineer

I’m Barret. Nobel & Co. is my practice, and right now I’m the engineer your firm is assigned to. I enroll the laptops, read the sign-in logs, test the restores, and sit on your side of the table at renewal.

When you call, the person who answers is the person who knows the environment — because I set it up, I decide what changes on it, and I documented what changed last month. As the practice adds engineers, that stays true for your firm: the number of firms per engineer is fixed, so the person you know does not become the person you used to have.

The software your firm actually runs on

A general IT company supports Microsoft 365 and stops. A firm runs on more than that: a document management system, a practice-management platform, time and billing, and the court’s e-filing portal on a deadline.

We support the systems private-client firms in New York actually use — the document-management, practice-management, and billing systems — as the environment they sit inside, not as software we resell. We do not migrate you to our preferred platform; we keep yours running, patched, backed up, and restorable, and we document which one holds the privileged file before we change anything. E-filing is scoped as a supported workflow rather than a ticket: on a filing morning it has an owner, not a position in a queue.

The standardization we require runs underneath all of that: one infrastructure stack, configured the same way at every firm, which is what the guarantee is priced on. The practice software sitting on top of it stays yours.

Trial weeks are not normal weeks

A generalist’s dispatch board treats the second week of March like any other. Your engineer knows it’s a trial. Before a trial, we run a pre-trial environment check: the matter’s files verified and restorable, remote access to the matter tested from where the team will actually be, a spare laptop staged and imaged, and the partner’s machine checked before it matters instead of after. This is on the calendar because your court dates are, not because a ticket came in.

What your committee will ask for

What a partner needs before he can put this in front of anyone else. None of it requires a call.

The price: $325 per seat, per month, with a ten-seat minimum. Roughly double a general-practice provider; four firms to an engineer is why. The retainer covers all the work — no per-ticket, per-call, or after-hours charges — and licenses pass through separately at our actual cost, itemized, no markup, about $40 per seat at today's vendor pricing. The retainer is our only compensation, and the rate is set by your seat count, not by how often you call.
Who else you can call: No client of this practice yet, and we will not manufacture one. What stands behind it: ten years of infrastructure and security engineering, including the Azure environment that carried Canon U.S.A. through FedRAMP authorization against the federal control baseline. Named employers, named dates, verifiable on request.
The firm that goes first: Protected by the terms, not trust: the exit terms below apply from the first day, and the renewal guarantee covers your first renewal that falls at least 90 days after go-live. What the first firm gets that no later firm will: the emptiest board this engineer will ever have, and a practice whose reference for the next decade is whatever that firm says it was.
How it ends: Thirty days’ notice, either direction, no exit fee. You keep the tenant, the domain, the data, and the documentation, because they were always the firm’s property.

Work we decline

01
Everything that is not a law firm.
We know privilege, trust accounting, and court deadlines. We do not know dental practices.
02
Firms below 10 or above 40 seats.
Below ten, the economics fail for you as much as for us. Above forty, you need an IT department of your own.
03
Any stack but ours.
Standardization is what the guarantee is priced on.
04
Engagements without MFA on every account.
The exception you want is the exception that gets firms breached.
05
Nursing the 2015 server nobody will replace.
If the hardware is the risk, replacing it is the work.

We can only put the retainer at risk on an environment we control. Each engagement above would break that control.

Who this is for. Who it is not.

This is for

Private-client firms in New York: trusts and estates, family, personal injury, small business.
10 to 40 seats. A seat is any active user account — attorneys, paralegals, and staff.
You’d rather call a person who knows the firm than file a ticket.
You’re willing to standardize: one stack, MFA everywhere, no exceptions.
You read the service agreement before signing it.

This is not for

You want an MFA carve-out.
You need the cheapest option. Cheaper exists; take it.
Insurance defense and bank-panel work governed by outside counsel guidelines. Those guidelines dictate controls we do not choose, and we will not split accountability for an environment.

How an engagement starts

1.
A 30-minute exposure snapshot
Thirty minutes in your Microsoft 365 environment: sign-in logs, OAuth consents, sharing links, MFA coverage. You see what we see.
2.
A written assessment
What we found, ranked by exposure.
3.
Onboarding as a scoped project
A defined scope, an agreed calendar, and your named engineer from the first day.

Questions

What does it cost?

$325 per seat, per month, with a ten-seat minimum. Roughly double what a general-practice MSP charges. The cap is why: four firms to an engineer, and the retainer has to work at that number. We also do not resell what we recommend, so nothing in it is a markup on someone else’s license. The rate in your proposal matches this page.

What happens when our engineer is unavailable?

Before onboarding begins, a named alternate is committed in your agreement — one more person who has read your file, reachable at the same number, with scoped access and current documentation. Monitoring, patching and backup never depended on one man’s calendar in the first place. The mechanism is set out above, under “And when your engineer is away.”

Why won’t you take more clients?

Because the service is a person who knows your firm, and that doesn’t survive being spread thin. So the limit is per engineer rather than per practice: four firms each. Growing means hiring an engineer and giving him his own four — not handing a fifth to someone who already has four, which is where rotating and dispatching start. The cap is not a marketing number; it is the mechanism.

What happens when you’re full?

Full means no engineer has room, not that a list somewhere is closed. We say so on the first call rather than after it, we don’t take the engagement anyway, and we tell you what we are waiting on — a firm leaving, or an engineer joining — and when we expect it. A firm squeezed in past the limit is the quiet end of the thing the others are paying for.

We already have an IT provider. What does switching involve?

A scoped onboarding project: the exposure snapshot, documentation of your environment, then transfer of administrative control in an agreed sequence. Your current provider’s cooperation makes it faster, but the transfer goes through without it. The tenant, the domain, and the data are the firm’s property.

What exactly does the guarantee cover, and what does it exclude?

It covers the increase above 15% when a control deficiency inside our documented scope causes a material rate increase at renewal, or forces the firm into costlier replacement coverage after a failed renewal. It excludes market-wide rate movement, the firm’s own risk-profile changes, controls the firm declined in writing, changes made to the environment without our advice, anything outside documented scope, a first cyber policy with no expiring premium, and a renewal the firm starts too late for us to work. It is capped at three months of the retainer. The scope and the full terms are in the service agreement, available before signing.

Do you require multi-factor authentication?

Yes. Everywhere, without exception. Attackers log in through the account excused from it, and the account most often excused is a senior partner’s, which is also the one most worth phishing. New York’s SHIELD Act already expects reasonable safeguards from any business holding New Yorkers’ private information. An MFA carve-out for the firm’s most privileged account is not one.

N.Y. Gen. Bus. Law § 899-bb (reasonable safeguards)

Who else has access to our systems?

Your named engineer, and the technical staff who run monitoring, patching, and backup. Everyone with access holds an individual named account with scoped permissions and multi-factor authentication, and all administrative sessions are logged. No client data is stored at rest on any engineer’s own machine. We will give you the full written list of everyone who can reach your environment, and where that work is performed, before the agreement is signed — because your firm’s vendor diligence obligation does not end at us.

Are you a law firm, or do you give legal advice?

No. Nobel & Co. is an IT and security practice. We read the rules that bind New York firms: the SHIELD Act’s reasonable-safeguards requirement, ABA Formal Opinion 512 on generative AI, the cybersecurity credit New York now requires in CLE. Your obligations shape our work. When a question is legal rather than technical, we say so, and you take it to counsel.

Start with the snapshot

Thirty minutes, your Microsoft 365 tenant, and a written assessment of where the firm stands. If we are full, we will say so. If we are not the right fit, we will say that too.