Files get deleted, devices fail, accounts are locked and software changes data it should not touch. A backup is what lets the firm keep working.
This article describes what a firm should have in place and how to test it. It names no tools.
The problem
Many firms believe they have backups because a tool says so. Few have ever restored a file to check.
A backup that cannot be restored, or that sits in the same place as the original, fails in exactly the situation it was made for.
What is known
We cite no figure on data loss or on how many firms have working backups, because we have not verified one from a primary source.
What is certain is how backups fail: they do not cover all the data, they stop running without notice, they are stored next to the original, or nobody has tried to restore them.
What to do
- List what must be backed up: the case management system, documents, email, the calendar, accounting data and shared drives
- Keep more than one copy, on more than one kind of storage, with at least one copy away from the firm's main systems
- Protect backups with the same access limits as the original, since they hold the same client information
- Decide how much recent work the firm can afford to lose and how long it can wait to be working again, and write both down
- Set a schedule that matches that decision, and have someone check that it ran
- Check that each tool keeps what the firm thinks it keeps, since some services keep deleted items only briefly
- Write a short recovery procedure: who decides, who restores, in what order and who tells the clients
An illustrative example
Illustrative example, not a client case. Each quarter, a firm picks one matter at random, restores its documents and email from backup to a test location, and checks that a person can open and read them. It notes the date, who did it and what was missing.
A person reviews anything that leaves the firm, and nothing here replaces your attorney's advice.
What to look for when you implement it
- Whether the restore was tried on real data, not only on a test file
- Whether the person who knows the procedure is not the only one who does
- Whether the backup alerts someone when it fails
- Whether the provider can say where backups are stored and how long they are kept
- Whether old backups are deleted when the firm's retention rules, confirmed by your attorney, say so
- Whether a copy survives the loss of the main account, for example if it is locked