Backup and Business Continuity Planning for Law Firms

Jul 10

11 min read

A law firm holds three things that cannot readily be replaced: the confidential information of its clients, the original documents and instruments entrusted to it, and the record of the deadlines and obligations on which its professional reputation depends. Law firm business continuity planning is the discipline of ensuring that those assets survive an adverse event and that the firm can continue to serve its clients, within an acceptable period, after the event has occurred. The adverse event may be a ransomware attack, a failed laptop, a flood, a hurricane, a prolonged power or telecommunications outage, the sudden incapacity of a sole practitioner, or an administrator's mistaken deletion of a folder.

The professional dimension is as important as the technical one. An attorney-at-law owes duties of competence, diligence and confidentiality, and the loss of a client's file, the failure to meet a limitation date because the diary was unavailable, or the exposure of privileged material through a compromised system may each amount to a breach of those duties. Regulators in many jurisdictions also expect firms to take reasonable steps to safeguard client records and, where personal data is involved, to comply with data protection legislation that may require notification of certain breaches. The detail differs between jurisdictions and the practitioner must consult the rules that bind the firm.

This article is a practical guide for small and mid-sized firms. It explains how to identify what must be protected, how to design a backup arrangement that actually permits recovery, how to write a continuity plan that can be followed under stress, and how to test it. It does not assume a dedicated information technology department. It assumes that a partner or practice manager will own the subject and that outside providers may assist.

Backup and continuity are different things

The terms are often used interchangeably, and the confusion leads to inadequate preparation. A backup is a copy of data held separately from the original so that the data can be restored. Business continuity is the broader capacity to keep working: it includes people, premises, communications, access to systems, client communication and decision-making authority. A firm may have excellent backups and still be unable to function for a week because nobody knows the credentials needed to start the restoration, or because the only person who understands the process is on leave.

Disaster recovery sits between the two. It is the set of technical steps by which systems and data are restored after an incident. A useful way to separate the concepts is by the question each answers. Backup answers: can we get the data back? Disaster recovery answers: how, and in what order, do we restore the systems? Continuity answers: how do we continue to serve clients while that restoration is under way, and who decides what?

Identifying what the firm must protect

Planning begins with an inventory. Without one, the firm will protect what it remembers and overlook what it does not. The inventory should record each category of information, where it lives, who is responsible for it and how quickly the firm needs it back.

Categories of information

Client files and documents: correspondence, pleadings, agreements, research, file notes and scanned originals.
Matter and client records: contact details, identification and verification records, conflict check records, engagement letters and instructions.
Diaries and deadlines: limitation dates, court dates, filing deadlines, undertakings and statutory time limits.
Accounting records: the client account ledger, office account, receipts, bank reconciliations and billing records, which professional rules typically require the firm to keep for a prescribed period.
Email and messaging: often the only record of instructions and agreements.
Precedents and know-how: templates, checklists and procedures.
Administrative records: employment files, insurance policies, leases, licences and registrations.

Physical originals

Many firms hold original wills, title deeds, share certificates, powers of attorney and executed agreements. These cannot be restored from a digital backup. The inventory should record where originals are kept, whether the storage is fire and flood resistant, whether a register of originals exists, and whether scanned copies are held off site. Where a firm is custodian of client originals, the loss of those originals in a fire or hurricane is among the gravest outcomes it can face, and the planning for them deserves separate attention.

Data in the hands of third parties

Cloud providers, email hosts, accounting software suppliers and document storage services hold firm data. The firm remains answerable to its clients for that data. Review each supplier's terms to establish where data is held, what backup and recovery commitments the supplier makes, how quickly the firm can retrieve its data if the relationship ends, and who is responsible if the supplier fails. A provider's assurance that data is replicated is not the same as a backup that the firm controls.

Setting recovery objectives

Two measures give a plan its shape. The recovery point objective is the maximum amount of data, measured in time, that the firm can bear to lose. The recovery time objective is the maximum period for which the firm can bear to be without a given system. The two are set independently and should be set for each category of information rather than for the firm as a whole.

Consider the following illustrative arithmetic, which is an example of method and not market data or a recommendation. Suppose a firm bills time in six-minute units and has five fee earners who each record an average of six billable hours on a working day. If a failure destroyed one full day of unsaved work and the firm had no means of reconstructing it, the loss would be thirty hours of recorded effort, together with the cost of recreating documents and the risk that some instructions were never captured elsewhere. A backup taken only once every twenty-four hours implies a recovery point objective of up to twenty-four hours, which in this example means accepting that loss. If the firm judges that unacceptable, it should increase the frequency of backup, or adopt continuous replication, until the exposure is tolerable. The figures here are invented for the purpose of showing the reasoning and the firm should substitute its own.

Category	Questions for the recovery point objective	Questions for the recovery time objective
Diary and deadlines	How much recent entry can be recreated from email and paper?	Can the firm operate for a day without a diary, and what is the fallback?
Client documents	Is work in progress saved to a location that is backed up continuously?	Which matters have imminent hearings or completions?
Accounting records	Can transactions since the last backup be reconstructed from bank statements?	When is the next payment or reconciliation due?
Email	Does the host retain deleted items, and for how long?	Can the firm use webmail or another route in the interim?
Practice management system	Is the provider's backup separate from the live data, and can the firm export its own copy?	What is the manual workaround?

The discipline of answering these questions exposes dependencies that were not obvious. A firm may discover, for example, that its diary is the single most time-critical system, and that its recovery must therefore be prioritised above the document archive.

Designing a backup arrangement that permits recovery

A well-known guideline is the 3-2-1 approach: keep at least three copies of the data, on at least two different types of storage, with at least one copy held off site. It is a minimum and not a complete design, but it forces the firm to consider the failure of the device, the failure of the storage medium and the loss of the premises.

Protection against ransomware

Ransomware has changed the requirements. Malicious software that encrypts files will also encrypt any backup that is reachable from the infected machine. A backup that sits on a drive permanently attached to the office network, or in a cloud folder synchronised to the user's computer, may be destroyed at the same moment as the original. A resilient design therefore includes at least one copy that cannot be altered or deleted from the compromised environment: an immutable or versioned copy, an offline copy that is physically disconnected after the backup completes, or a copy held under separate credentials that no ordinary user account possesses.

Synchronisation is not backup. A shared folder that mirrors changes will faithfully propagate a deletion or an encryption event. Versioning, which preserves earlier states of a file, and retention periods, which determine how long deleted items remain recoverable, are the features that distinguish a backup from a mirror.

Encryption and access control

A backup contains the same confidential information as the live system and must be protected to the same standard. Encrypt backups in transit and at rest, record who holds the keys, and ensure that the keys are not stored only in the system they protect. Restrict who may delete or alter backup sets. If a third party performs the backup, the contract should address confidentiality, location of data, subcontractors, breach notification and return or destruction of data on termination.

Retention and the professional duty to keep records

Backup retention should reflect the periods for which the firm is obliged to keep client and accounting records and the period within which claims against the firm may be brought, matters on which the rules of the jurisdiction and the firm's insurer should be consulted. Do not equate a long retention period with safety. Retained backups containing personal data should be subject to the firm's data retention policy so that information which should have been destroyed is not preserved indefinitely in a forgotten archive.

Testing restoration

A backup that has never been restored is an assumption. Schedule periodic restoration tests: select a random matter folder, restore it to a separate location, confirm that the documents open and are complete, and record the time taken. A larger test should restore a whole system to confirm the sequence and the time required. The results should be recorded and any failure investigated, because the discovery of a faulty backup during an actual emergency is the worst moment at which to learn of it.

Continuity of operations beyond the data

Data is only part of a firm's operating capacity. The plan must also address people, places and communications.

People and succession

For a sole practitioner, the most significant continuity risk is incapacity or death. Many professional bodies expect, or encourage, a sole practitioner to nominate another attorney who can step in to protect clients' interests, and the firm should consider how that person would obtain access to files, the client account and the diary, subject to the rules of the regulator. A written arrangement, together with sealed access instructions held by a trusted party, can save clients from serious harm. For larger firms, identify the key individuals whose absence would stop an essential function and document a deputy for each.

Premises and remote working

Plan for the loss of the office for a short and a long period. A firm whose staff can work securely from home or an alternative site, using firm-managed devices and cloud-based systems, has a substantial advantage over a firm that depends on a single server in a single room. In regions subject to hurricanes, flooding or earthquakes, the plan should include seasonal preparation: moving paper files off the floor, confirming that offsite backups complete before a forecast storm, and agreeing in advance when staff will be released to secure their own households.

Power and connectivity

Extended power or internet outages are a practical reality in many places. Consider uninterruptible power supplies for essential equipment, a secondary internet connection such as a mobile data service, and a policy on what staff may do when the primary connection fails. Test the secondary arrangement; many firms discover that a mobile hotspot cannot support the volume of work that they assumed.

Communications

Maintain an out-of-band contact list, held outside the firm's own systems, containing the mobile numbers and personal email addresses of partners and key staff, the contact details of the firm's information technology provider, the insurer, the bank and the regulator, and the telephone numbers of principal clients with urgent matters. If the firm's email is compromised, the firm needs another means by which to tell staff what to do and to reach clients without delay.

Incident response: the first hours

When an incident occurs, people act quickly and often make matters worse. A short written procedure that sets out the first steps reduces the risk of well-intentioned but harmful responses.

Contain. Disconnect affected devices from the network, but do not switch them off if forensic evidence may be needed without first taking advice from the firm's technical provider. Change credentials from a clean device.
Appoint an incident lead. One partner takes charge, records decisions and times, and is the single point of contact for external parties.
Assess. Establish what systems and data are affected, whether client information has been accessed or taken, and whether the backups are intact.
Protect deadlines. Identify matters with imminent court dates, completions or filing deadlines and put contingency measures in place for each, including, where necessary, applying to the court or counterparty for an extension and informing the client.
Notify. Consider the firm's obligations to its insurer, which may require prompt notice and may restrict admissions, to its regulator, to the clients affected, and to any data protection authority. The thresholds and periods differ by jurisdiction and are for the firm to determine on proper advice.
Restore and verify. Restore from clean backups in the order of priority set in the plan, and verify integrity before returning to normal operation.
Review. Hold a post-incident review, record the lessons and update the plan.

Communicating with clients

Clients should be told promptly and plainly what has happened, what it may mean for their matter, and what the firm is doing about it. The communication should be accurate, should avoid speculation, and should be reviewed by a partner before it is sent. Where a duty to inform a client of a material error or loss arises under the rules of conduct, delay compounds the problem. A firm that has prepared a short template for incident communications will find the task less daunting at the critical moment.

Insurance, contracts and governance

Review the firm's professional indemnity policy and any cyber insurance for the events covered, the conditions attached, the requirements for notification and the exclusions. Some policies require specified security controls as a condition of cover. Confirm whether the policy covers the costs of restoration, regulatory proceedings, notification of clients and business interruption.

Governance matters because continuity is not a one-off project. Assign ownership to a named partner, set a regular review date, perhaps twice a year, and put continuity on the agenda of the partners' meeting. The plan should record the date of its last review and the name of the person who approved it. Staff should receive short training on their part in the plan, with particular emphasis on recognising phishing attempts and on reporting suspected incidents without delay, since many incidents begin with a single mistaken click.

Common weaknesses in small firm plans

Backups that are scheduled but never monitored, so that failures go unnoticed for months.
Backup copies stored on a device permanently connected to the same network as the live data.
Reliance on a single individual who holds all the passwords and all the knowledge.
A plan kept only on the systems that the plan is designed to restore.
No fallback for the diary, so that a systems failure coincides with an unmanaged deadline.
No consideration of originals held for clients.
Assuming that a cloud provider's availability commitments equal a backup under the firm's control.
No testing, and therefore no knowledge of how long recovery actually takes.

Practical next steps

A firm can make meaningful progress in a few weeks without large expenditure. The following sequence is suggested.

Compile the inventory of information, systems, suppliers and physical originals, with an owner for each.
Set a recovery point objective and recovery time objective for each category, starting with the diary and client files.
Review the current backup arrangement against the 3-2-1 approach and confirm that at least one copy is immutable or offline.
Perform and record a restoration test of a sample of matters.
Write a short incident response procedure and an out-of-band contact list, and print copies for the partners.
Nominate a successor or deputy and record the access arrangements for each critical function.
Review the insurance policies and the supplier contracts against the plan.
Diarise a twice-yearly review and a restoration test.

How practice management software supports continuity

A cloud practice management platform can reduce the number of systems the firm must protect by keeping matters, documents, diaries and billing records in one managed environment that is accessible from any location and exportable on demand, although the firm remains responsible for confirming the provider's backup and recovery arrangements and for holding its own independent copy. Legalytech offers such a platform to law firms, and its export and permission features can form one component of a wider continuity plan.

This article is provided for general information only and does not constitute legal advice. Practitioners should consult the rules of their own jurisdiction and regulator.