Why law firms need more than a backup
Most firms have some kind of backup. Fewer know what it covers, how long a restore would take or whether an attacker could delete it. Ransomware groups now look for backups first and destroy them before encrypting anything else. A backup that sits on the same network, under the same administrator account, may not survive.
There's also a professional angle. ABA Formal Opinion 483 notes that a breach includes an event that significantly impairs a lawyer's ability to perform legal services. If the firm can't open files, calendars or email, deadlines still run. A recovery plan is part of protecting clients, not just protecting computers.
What we back up
- Microsoft 365. Email, OneDrive, SharePoint and Teams. Microsoft keeps the service running, but recovering from accidental deletion, a malicious insider or ransomware that syncs to the cloud is your responsibility. A separate backup closes that gap.
- Servers and on-premises systems. File servers and any practice management, document or accounting system that still runs in your office.
- Cloud legal applications. Where a vendor allows data exports or offers backup options, we help you set them up and check that they run, so you're not relying on a single provider.
- Key workstations. Where it makes sense, such as a docketing or accounting PC with local data.
How we protect the backups
- Separate credentials, so a stolen firm administrator password can't reach the backups.
- Immutable or offline copies that can't be changed or deleted for a set period, even by someone with access.
- Off-site storage in a different location from your office, so a fire, flood or theft doesn't take the backups with it.
- Encryption in transit and at rest, because backups contain the same client information as the live systems.
- Monitoring of every backup job. Failures are flagged to our team, not left in a log nobody reads.
Disaster recovery and business continuity
Backups are about data. Business continuity is about keeping the firm working. We help you answer the practical questions ahead of time:
- What matters most? Usually email, calendars and docketing, the current matter files and the ability to bill and handle trust accounts.
- How quickly do you need it back? Some systems need to return within hours. Others can wait a day or two. That choice drives the design and the cost.
- How much data could you afford to lose? A day's worth of work, or an hour's? More frequent backups reduce the gap.
- Where would people work? If the office is unavailable, attorneys need secure access from home or another location. We plan for that in advance.
- Who does what? A short written plan with names, phone numbers and the first steps, kept somewhere that doesn't depend on the systems that might be down.
Ransomware recovery
If ransomware hits, the first priority is to contain it and preserve evidence. Your cyber insurer may also need to be notified before certain steps are taken. Then systems are rebuilt clean and data is restored from backups taken before the attack. Having a tested plan, protected backups and a clear list of priorities is what turns weeks of downtime into days. We run that process with you, while the firm's leadership and counsel handle client communication and legal obligations.
Reviewed, not forgotten
Firms change. New systems get added, attorneys join and leave, and practice areas grow. We review your backup coverage and recovery plan with firm leadership at least once a year, and whenever a major system changes, so the plan still matches how the firm works.
Questions about backup & recovery
Doesn't Microsoft already back up our email?
Microsoft keeps its service available and has limited retention for deleted items. It isn't designed to be your long-term backup against ransomware, malicious deletion or mistakes found months later. A separate backup covers those cases.
How long would it take to recover?
It depends on what failed and how the backups are designed. During our review we estimate recovery time for your key systems, and test restores tell you the real answer instead of a guess.
