Internet, phones & IT for professional offices

The utility bill is small — the continuity exposure is not

For most professional offices the electricity and gas lines are the least interesting part of the cost base, and the exposure runs the other way. EIA publishes commercial building energy use by end use, and in an office that use is concentrated in space cooling, lighting, ventilation and office equipment — a profile that is stable month to month and largely indifferent to how much client work the firm produces. What is not stable is the cost of an interruption during client hours. The arithmetic that matters is not the utility spend but the number of fee-earning people multiplied by the hours they cannot work, restricted to the hours that would have been billable. That product is what decides how much redundancy is worth buying, and it is why two firms of the same size in the same building can reasonably reach opposite conclusions. Start with the utility account itself: where competitive supply exists at all, it is decided by the service address, the meter and the utility territory, and municipal utilities, cooperatives and some jurisdictions offer no choice.

• Count fee-earning people, not headcount, and multiply by the working hours an outage consumes.
• Separate interruptions that stop client work from those that only slow internal work.
• Check the utility account: where choice exists, eligibility follows the service address, the meter and the territory.
• List the contracts whose renewal dates cluster — the utility account is rarely the only one expiring.

Client-data duties follow the workflow, not the letterhead

Which rule reaches a professional practice depends on what the practice does, not what it calls itself. The FTC's Safeguards Rule, 16 CFR Part 314, applies to the financial institutions over which the FTC has rulemaking authority under the Gramm-Leach-Bliley Act, and the scope text is unusually concrete about who that includes beyond banks: tax preparation firms, credit counsellors and other financial advisors, investment advisors not required to register with the SEC, mortgage brokers, collection agencies and entities acting as finders are all named. A general law firm does not appear in that list, but the duty to protect client information still reaches it through professional-conduct guidance, which asks lawyers to make reasonable efforts to prevent unauthorised access to client information in electronic communication and to weigh the confidentiality risk of the method before choosing it — the ABA's Formal Opinion 477R is the best-known statement of that standard. Where the Safeguards Rule does apply, it requires a written information security programme built on a documented risk assessment, a qualified individual responsible for it, and safeguards covering access control, encryption, secure disposal, monitoring and testing, incident response, and oversight of service providers.

• Confirm whether the practice is a covered financial institution under 16 CFR 314 rather than assuming either way.
• Identify every system that holds client information and everyone with access, including remote and contract staff.
• Treat the risk assessment as the document the rest hangs from — controls are chosen out of it, not bolted onto it.
• Keep the client-communication judgement with the professional responsible, not with the IT vendor.

Vendor oversight is where the risk actually moves

The Safeguards Rule is explicit that a covered institution must select service providers capable of maintaining appropriate safeguards, require them contractually to do so, and reassess them periodically. That turns a vendor question into a contract question, and it is the section most professional offices have never read. The terms worth negotiating are a breach-notification clock with a named contact, a defined list of subcontractors with notice before any change, an obligation to return and then delete data at the end of the relationship, an access-control commitment tied to the individuals who will hold administrative credentials, and evidence of the vendor's own testing. Two thresholds matter to smaller practices. Notification to the FTC is required for an event involving the information of at least 500 consumers, due as soon as possible and no later than 30 days after discovery, and that provision took effect on 13 May 2024. Separately, §314.6 relieves institutions that maintain customer information on fewer than 5,000 consumers from four specific provisions — §314.4(b)(1), (d)(2), (h) and (i) — while the rest of the rule continues to apply, so a small practice is narrower in scope but not exempt.

• Get the breach-notification clause, the named contact and the clock in writing before signing.
• Require subcontractor disclosure; client data usually travels further than the contract implies.
• Settle data return and deletion at exit while you still have leverage.
• Keep the vendor's own assessment evidence on file — the oversight duty is the practice's, not theirs.

Uptime is a contract term — read the remedy, not the percentage

Service agreements for business internet are written around an uptime percentage, and the percentage is the least informative part of them. Two terms decide what the commitment is worth: the measurement period, because a monthly figure can hide a working day lost, and the remedy, because a service credit is not the same thing as a right to terminate. Check the exclusions as carefully — scheduled maintenance, customer-owned equipment and events outside the provider's control are commonly carved out, and that is where most lost hours actually live. Diversity deserves its own question: two circuits that enter the building through the same conduit, or that terminate on the same provider's equipment, are not diverse, and one failure takes both. For document-heavy practices upload capacity matters as much as download, because cloud storage and remote case management are upstream workloads. If telephony rides the same circuit then a single failure is two failures, and the failover path — whether an LTE or 5G backup, and whether it carries voice as well as data — should be a deliberate decision rather than a discovery.

• Ask for the measurement period and the remedy, not just the uptime target.
• Read the exclusions: maintenance windows and customer-equipment faults are the usual carve-outs.
• Prove diversity on a diagram before paying for a second circuit.
• Confirm the failover path carries voice as well as data if telephony shares the circuit.

What grew by accident: seats, numbers and licences

Professional offices accumulate services one hire at a time, so the reconciliation that pays is administrative rather than technical. Count licences against the current staff list — including people who have left and contractors who were never meant to hold a seat — and ask which editions are role-based rather than per-seat, because the answer changes the arithmetic. Reconcile published numbers and directory listings against the numbers actually in service; duplicated listings and abandoned lines are the residue of earlier switches. Then build the renewal map, because software subscriptions, the internet circuit, telephony, support and the utility account rarely end in the same month, and a provider that knows your dates has an advantage you can remove by knowing them first. Where numbers are to be kept, settle the portability process with both the losing and the gaining provider before signing, since it is the order of operations rather than the technical possibility that goes wrong. Consolidation is not automatically cheaper: the test is whether the same requirement is currently being met twice.

• Reconcile seats to staff and contractors; unused seats are the most common quiet cost.
• Ask whether each product is priced per seat or by role — the two scale differently.
• Put every renewal date on one page before the first proposal arrives.
• Confirm the number-portability process in writing before signing anything that touches telephony.

What to send first: one engagement, end to end

The most efficient brief a professional practice can write is a walkthrough of a single client engagement: where the documents are created, where they are stored, who can open them, how they reach the client, and which parts happen remotely. Add the headcount and the locations, the systems and their renewal dates, and the client-facing numbers that must survive a change of provider. On continuity, name the components the standard contingency-planning guidance uses — a business impact analysis that ranks which functions come back first, a recovery strategy for each, a written plan, and testing that happens rather than testing that is planned. NIST's Cybersecurity Framework offers the same shape from the control side, organising outcomes under functions that include Identify, Protect, Detect, Respond and Recover, which makes it a serviceable checklist for a risk assessment even though it is voluntary. Naming the workflow rather than the products is what makes the proposals comparable, and it is usually where an overlapping platform or a duplicated line item finally becomes visible.

What the office meter is actually measuring

An office is the least volatile commercial load there is, and its shape is stable enough to describe. EIA's 2018 CBECS estimates put space heating at about 30 per cent of office-building energy use, ventilation at about 20 per cent, lighting at about 12 per cent and each remaining category at 8 per cent or less. Office buildings consumed about 1,093 trillion Btu in the survey, split into roughly 775 trillion Btu of electricity and 250 trillion Btu of natural gas, at a mean intensity of about 65.6 thousand Btu per square foot. EIA also finds that office buildings carry the largest share of commercial-building computing and office-equipment consumption, which is the part of the load a professional practice controls most directly. The consequence for the bill is that demand tracks occupancy, operating hours and how much equipment stays energised after hours, and a commercial tariff prices the highest measured interval separately — so a practice that leaves its systems running around the clock pays for that choice twice.

• 2018 CBECS: office energy is about 30 per cent space heating, 20 per cent ventilation and 12 per cent lighting.
• Office buildings used about 1,093 trillion Btu — roughly 775 electricity and 250 natural gas.
• Mean office intensity is about 65.6 thousand Btu per square foot.
• Office buildings carry the largest share of commercial computing and office-equipment consumption.
• Demand is priced on the highest measured interval, so always-on operation costs twice.

The lease decides who actually buys the energy

Before a practice can compare anything it has to establish whether it even holds the utility account. Under a direct meter the utility measures the leased premises and the tenant contracts with and pays the utility directly — that is the case in which competitive supply, where the territory offers it, is the tenant's decision. Under a landlord master meter with a private submeter the landlord holds the account and bills the tenant for measured use, and that bill need not equal what the utility's own retail tariff would have produced, because the landlord may fold in demand, service charges, taxes and an administrative fee under the lease. Where premises are not separately metered, utilities are allocated by rentable area, by a pro-rata share, through an operating-expense reconciliation or as a fixed charge inside gross rent. The pattern runs across the common structures — full-service gross, modified gross and net or triple-net — and the lease, not the label on it, is what governs. The practical consequence is that a firm without the account cannot shop the supply, and a firm with the account should not assume what it pays through the landlord matches a tariff.

• Direct meter: the tenant holds the account and can shop supply where choice exists.
• Master meter with submeter: the landlord holds the account and bills measured use.
• A submeter bill need not equal the utility's retail tariff bill — demand, taxes and fees may be folded in.
• No tenant meter: utilities are allocated by area, share, reconciliation or a fixed charge.
• The lease, not the words gross or net, controls the allocation.
• Read the utility clause before shopping: a firm without the account cannot switch supply.

What a growing practice usually bundles next

The services a professional practice buys rarely turn over one at a time, and the trigger is usually growth or a move: a new office, a hire, a merger or a lease renewal. The bundle is predictable — connectivity and a failover path, telephony and the numbers clients dial, the document and practice-management platform, the cyber controls that reach client data, and the support arrangement that holds administrative credentials. Treating them as one decision is what makes the proposals comparable, because the same headcount, the same workflow and the same renewal dates drive all of them, and a capability that solves one need may already be paid for under another vendor. For a firm with more than one office the extra questions are consistency — one numbering and directory standard, one document platform, one place where credentials live — and the same caution applies as anywhere: an inquiry places no order and switches no supplier.

• The trigger is usually growth or a move: a new office, a hire, a merger, a lease renewal.
• The bundle is predictable: connectivity and failover, telephony, the document platform, cyber controls, support.
• One decision, because the same headcount, workflow and renewal dates drive all of them.
• Watch for a capability already paid for under another vendor.
• For more than one office, standardise numbering, the document platform and where credentials live.
• An inquiry places no order and switches no supplier.

PUT THE OPTIONS SIDE BY SIDE

Your comparison checklist

Common questions