Law Firm Disaster Recovery: Backup and Continuity Planning

A solicitors' practice does not stop for a failed server. Deadlines run, completions are booked and clients expect to reach their fee earner. Law firm disaster recovery is the discipline of making sure the firm can restore its data, systems and working routines quickly enough that a failure stays an inconvenience rather than a regulatory and financial problem.

This guide is written for managing partners, COLPs, COFAs and practice managers. It explains what recovery objectives mean in plain terms, where backups commonly fall short, how to handle ransomware, and how to build and test a plan. It sits alongside our legal sector page, which covers the wider technology picture for solicitors.

Why downtime makes law firm disaster recovery a priority

Most businesses lose revenue during an outage. A legal practice also risks missing dates that cannot be moved. The cost is not only the hours billed to nothing, it is the exposure that builds while systems are unavailable.

• Court and limitation deadlines. Filing dates, service deadlines and limitation periods do not pause because the document management system is offline. A missed date can become a professional negligence matter.
• Completions and exchanges. Conveyancing teams work to tight timelines, often in chains. An outage on completion day can delay several linked transactions, not just yours.
• Client money. Fee earners and the accounts team need the accounting system to process payments, reconcile ledgers and evidence compliance with the SRA Accounts Rules.
• Case management reliance. Matter files, diaries, tasks, precedents and time recording often sit in one platform. If it is down, fee earners lose both their records and their prompts.
• Client confidence. Clients instruct a solicitor to be reliable. A firm that cannot say when it will be back working damages that trust quickly.

Our guide to case management software and Microsoft 365 covers why the platform choice shapes recovery options.

What the SRA expects of SRA-regulated firms

The SRA does not publish a single business continuity rule, so it is worth being precise about what it does require. Under the SRA Code of Conduct for Firms, paragraph 2.1 requires effective governance structures, arrangements, systems and controls. Paragraph 2.5 requires the firm to identify, monitor and manage all material risks to its business. Paragraph 2.2 requires records that demonstrate compliance, and paragraph 5.2 requires firms to safeguard money and assets entrusted to them by clients.

Read together, these make loss of systems a risk the firm is expected to have thought about, with controls to match. An unrecoverable case management system or accounts ledger is hard to reconcile with those duties.

The SRA's guidance on closing down your practice also says larger firms should have a contingency plan for closure, merger or sale if serious difficulties arise. That is a different scenario from an IT outage, but it shows the regulator expects firms to plan for adverse events.

Data protection adds a further point. The ICO lists loss of availability of personal data as a type of personal data breach. Where a breach is notifiable, it must be reported to the ICO within 72 hours of becoming aware of it. A ransomware incident that locks client files can therefore trigger obligations on top of the operational disruption.

For the security side of the same obligations, see our SRA-focused cyber security guide for solicitors.

RTO and RPO explained plainly

Two terms drive every recovery decision. Neither is complicated once you put them in the context of a working day.

• Recovery Time Objective (RTO) is how long the firm can tolerate a system being unavailable. If the case management system has an RTO of four hours, the aim is to have fee earners working in it again within four hours of the failure.
• Recovery Point Objective (RPO) is how much recent work the firm can afford to lose. An RPO of one hour means the latest usable backup should be no more than an hour old when disaster strikes.

The useful exercise is to set them per system, not per firm. The accounts ledger and the case management platform usually need tighter targets than the intranet or the marketing website. Partners should agree the targets, because they are business decisions about acceptable risk and cost, not technical settings.

Tighter objectives cost more. A four-hour RTO with a fifteen-minute RPO needs replicated systems and frequent backups. A next-day RTO with a daily RPO can be met with much simpler arrangements. The table later in this guide sets out typical tiers.

The 3-2-1 backup rule and why it is not enough alone

The 3-2-1 rule is the common starting point: keep at least three copies of your data, on two different types of storage, with one copy held offsite. The National Cyber Security Centre (NCSC) describes this approach and notes that cloud storage can serve as the offsite copy.

The NCSC also points out that 3-2-1 does not require any copy to be offline. Ransomware can encrypt connected drives and cloud storage that hold backups, so it recommends keeping at least one backup disconnected, or protected by access controls that allow new writes but block overwriting. For a practice, that usually means:

• One copy on the primary system, one on separate local or network storage, one offsite.
• At least one copy that ransomware on a user's laptop or a compromised admin account cannot reach or alter (immutable or offline).
• Backup credentials held separately from everyday administrator accounts, protected by multi-factor authentication.
• Retention long enough to recover from damage that is only noticed weeks later.

Include everything fee earners depend on: file servers, the case management database, the accounting system, email, SharePoint and OneDrive content, and any scanned post or e-signature records.

The Microsoft 365 backup gap

Many practices assume that because their email and documents are in Microsoft 365, they are backed up. Microsoft operates a shared responsibility model, and its Services Agreement says so. Section 6 on service availability explains that online services can suffer outages and recommends that customers regularly back up the content and data they store on them. Other sections make a similar point about content when an account or service is closed.

In practice, Microsoft is responsible for running the platform. The firm remains responsible for its own data, including protecting it from accidental deletion, malicious deletion, a compromised account or ransomware syncing through OneDrive. Built-in recycle bins and version history help with minor mistakes, but they are not a substitute for an independent backup with its own retention and access controls.

A third-party backup of Exchange Online, SharePoint, OneDrive and Teams content is a sensible addition for most practices. Our Microsoft 365 support team can review what protection your tenant has today. If you are weighing where documents should live, our Teams and SharePoint comparison is a useful companion.

Ransomware recovery for a solicitors' practice

Ransomware is the scenario that tests every other part of the plan. Client files are encrypted, the firm cannot work, and there is pressure to decide quickly. Recovery works best when the first hour has already been rehearsed.

1. Isolate. Disconnect affected devices and servers from the network. Do not simply switch everything off without advice, as volatile evidence can be lost.
2. Escalate. Call the incident lead and your IT partner. Notify your cyber insurer promptly, as many policies require it and offer a response panel.
3. Assess scope. Establish which systems, matters and personal data are affected, and whether data was copied out as well as encrypted.
4. Decide on notifications. The COLP and data protection lead consider the SRA, the ICO (72 hours for notifiable breaches), clients and the insurer.
5. Restore from clean backups. Confirm the backup pre-dates the intrusion, rebuild affected systems and reset credentials before reconnecting.
6. Review. Close the entry route, whether a phishing email, an unpatched system or a supplier compromise, and record the lessons.

Phishing remains a common entry route, so our guide to phishing types and prevention is worth sharing with fee earners. Supplier compromise matters too, as covered in our article on supply chain risks and recent breaches.

Testing restores: the step most firms skip

A backup that has never been restored is an assumption. The NCSC advises testing restores regularly to confirm backups work as expected. Jobs can report success while capturing the wrong folders, missing a database or writing files that cannot be read.

A sensible testing routine includes:

• Monthly file-level restores of a random sample, including a matter folder and a mailbox item.
• Quarterly application restores of the case management database and accounting system into a test environment, with a fee earner confirming the data is usable.
• Annual full scenario exercise with partners present, timing the work against your RTO and recording the actual figure.
• A written result each time: what was restored, how long it took, what failed and who fixed it.

Those records also help show compliance with the risk management duty under the SRA Code for Firms.

What a continuity plan should contain

A plan that sits in a shared drive nobody can open during an outage is not much use. Keep a printed copy and an offline copy with key people. A workable plan covers:

• A register of critical systems, with an owner, RTO and RPO for each.
• Supplier and vendor contacts, including case management, accounts, telephony, broadband and your IT partner, with account references and escalation routes.
• Alternative ways of working: remote access, mobile data, a fallback phone number and paper procedures for diary and deadline checks.
• A deadlines process, so urgent court and limitation dates can be identified from a recent export or from the diary on another device.
• Client money procedures for when the accounts system is unavailable.
• Communication templates for staff, clients, the insurer, the SRA and the ICO.
• A review date, and a trigger to update the plan after staff, system or office changes.

Incident roles

Name people, with deputies, before anything happens. At minimum:

• Incident lead: usually a partner or practice manager, who makes the calls.
• Technical lead: your internal IT contact or external provider.
• COLP and COFA: responsible for regulatory reporting and client money.
• Communications lead: handles client and staff updates.
• Scribe: keeps a timed log of decisions, which helps later with insurers and regulators.

An out-of-hours route matters as much as the roles. A 24/7 IT helpdesk is the sort of cover that lets the technical lead be reached when an incident starts on a Friday evening.

Cloud versus on-premises recovery

Neither model is automatically safer. They fail differently, and the recovery plan should reflect that.

On-premises servers put hardware, power, cooling and physical security in the firm's hands. Recovery after fire, flood or theft depends on offsite copies and on having somewhere to rebuild. Cloud-hosted systems remove much of the hardware risk, but the firm still depends on internet connectivity, identity security and the supplier's own resilience.

Azure-based and hosted environments can replicate workloads to a second location, which makes faster recovery tiers affordable for firms that could not justify a second site. Our Azure cloud services, managed cloud services and cloud migration services pages explain how this works in practice.

Whichever model you use, ask your case management and accounts suppliers for their own recovery commitments in writing, and check what happens to your data if you leave them.

Building your law firm disaster recovery plan step by step

Not every system deserves the same investment. Grouping systems into tiers lets partners decide where spend delivers the most protection. The figures below are illustrative starting points to adapt, not industry standards.

Review the tiers whenever the firm adopts a new system or changes how it works, for example by adding a new office or moving to hybrid working.

Building your plan: a step-by-step guide

An independent review can help here. A cyber security audit will show weaknesses a recovery plan must account for, and Cyber Essentials certification provides a recognised baseline of technical controls.

Conclusion: plan the recovery before you need it

Law firm disaster recovery comes down to a few decisions: which systems matter most, how quickly they must return, how much recent work you can lose, and whether you have proved your backups work. Those decisions belong with the partners, supported by technical evidence.

If you want a view of where your firm stands, our specialist technology partner for legal practices can review backups, Microsoft 365 protection and recovery times with you. You can also see day-to-day support through managed IT support, or contact us to arrange a conversation.

Frequently asked questions