For most law firms, it’s the minimum level that supports a properly secured environment. The difference isn’t obvious upfront, but it matters over time.