Data Backup & Disaster Recovery for Small Law Firms: A 30-Day Audit Checklist

TL;DR

Small law firms must maintain redundant, tested backups of all client data—it's an ABA ethical requirement, not optional. The 3-2-1 backup rule (three copies, two media types, one off-site) is the proven standard. Most firms should outsource backup management to an MSP rather than DIY; the cost ($100–300/month) is tiny compared to ransomware recovery ($50K–150K+) or downtime. This article includes a 30-day audit checklist to assess your current backups and identify gaps.

Why Backup & Disaster Recovery Matters to Your Law Firm

You're juggling client deadlines, case files, financial records, and confidential information. A single hardware failure, ransomware attack, or accidental deletion could halt your entire practice—and expose clients to harm. That's not a theoretical risk; it's happening to law firms right now.

The ABA's Requirement

ABA Model Rule 1.6(c) requires that "a lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client." Courts and bar associations interpret this to include having a documented, tested backup and disaster recovery plan. This is an ethical obligation, not a recommendation. Failure to have adequate backups could result in disciplinary action, malpractice claims, and damaged client relationships.

The Real-World Cost of Failure

A 29-attorney law firm experienced a ransomware attack and was offline for 24 days. The ransom demand: $600,000+. Even after paying, attackers leaked the firm's data online anyway. A smaller 12-person Ontario law firm (MBC Law) took 4 weeks to fully recover from a cyberattack; during that time, attorneys appeared in court on cell phones without access to case files and missed critical deadlines. A London family law firm with 10 employees paid a ransom to regain access to encrypted files—costs that could have been avoided with an offline backup.

These stories are common. What separates firms that recover quickly from those that don't? Redundant, off-site, tested backups.

The 3-2-1 Backup Rule: Why It Works

The 3-2-1 rule is simple but powerful: maintain three copies of your data on two different types of media, with one copy stored off-site.

What This Looks Like in Practice

Copy 1: Production Data (your live systems)

Case management system
Email server
Document repositories
Accounting system

Copy 2: Local Backup (on-premises, different media)

Automated backup to NAS (network-attached storage) or SAN
Runs nightly
Accessible for fast recovery (RTO: 1–4 hours)
Protects against: Hardware failure, accidental deletion, data corruption

Copy 3: Off-Site Backup (cloud or air-gapped)

Cloud backup (immutable—can't be deleted or encrypted remotely)
Or: Backup to removable drive, stored off-site
Runs weekly or daily
Protects against: Fire, flood, theft, ransomware, site-wide disaster

Two Different Media Types:

Local NAS (fast but on-site vulnerability)
Cloud storage (slower but immutable and off-site)
Different technologies = a flaw in one doesn't destroy both

Why This Prevents Catastrophe

Scenario 1: Ransomware Attack

Attackers encrypt your production files and your local backup. But your off-site cloud backup remains inaccessible to them—it's immutable (can't be modified or deleted remotely). You restore from the cloud backup in hours, not weeks. You don't pay the ransom.

Real case: A law firm in a UK insurance case had offline backups on a USB drive. When ransomware hit, they recovered in 72 hours without paying ransom. The attackers later threatened to release stolen data—but the firm's cyber insurance covered the forensic investigation cost (£27,450) and legal assistance (£33,705).

Scenario 2: Hardware Failure

Your primary case management server dies. Local backup is also on the same network segment and gets corrupted. Your off-site cloud backup is pristine. You're back online with a 4-hour RTO.

Scenario 3: Data Corruption

A software bug silently corrupts files across your network. You have three point-in-time backups (daily snapshots). You restore from yesterday's backup—clean data, minimal loss.

RTO & RPO: What Your Firm Actually Needs

Two terms define your recovery requirements:

RTO (Recovery Time Objective): How long can you afford to be without a system? (e.g., "1 hour for email, 24 hours for archives")
RPO (Recovery Point Objective): How much recent data can you afford to lose? (e.g., "15 minutes of data, up to 1 hour")

For most law firms, these look like this:

System	RTO	RPO	Why
Email	1–2 hours	15–30 min	Client communications can't wait; court deadlines are unforgiving
Case Management	2–4 hours	1 hour	Active case data changes constantly; courts expect quick recovery
Document Repository	4–8 hours	4 hours	Historical docs less urgent than active litigation
Billing/Accounting	8–24 hours	12 hours	End-of-day reconciliation acceptable; less critical than client data

Your firm's specific RTOs depend on your practice areas. A litigation firm needs faster recovery than an estate planning firm. Set these targets with your leadership, document them, and ensure your backup system meets them. This is the bridge between "we have backups" and "we can actually recover."

The Hidden Problem: Most Law Firms Don't Know Their Backup Status

You have three common scenarios at small law firms:

Scenario A: "We backup, but nobody tested it"

Backups run nightly (you assume)
No one has ever attempted a restore
If disaster strikes, you discover the backups don't work
Real case: A retailer's backups had been failing for months; discovered only during the ransomware attack

Scenario B: "We have ONE backup on-site"

Files backup to a NAS on the same network
If ransomware or fire hits, that backup is also encrypted or destroyed
No off-site copy
Violates the 3-2-1 rule entirely

Scenario C: "Cloud backup only"

You backup to the cloud (good)
But you don't test restore procedures
Cloud provider outage = you don't know if you can recover
No local copy for fast RTO
RPO might be 24 hours (too slow for email)

The Fix: A tested, redundant 3-2-1 backup strategy with documented RTO/RPO targets.

The 30-Day Audit Checklist: Where You Stand Today

This checklist takes 30 minutes per week (4 weeks total) and reveals exactly what you have, what you're missing, and what to fix.

Week 1: Inventory (30 Minutes)

Answer these questions:

Email system: What do you use? (Microsoft 365, Google Workspace, hosted Exchange, on-premises?)
Case management: Software name, location (cloud or on-premises?)
Document storage: Where are client files kept? (Shared drives, cloud drive, document management system?)
Accounting/billing: Software, location?
Other critical systems: What else would halt your practice if it went down?
Current backups: Do you have any backups running now? (Ask your IT person or MSP)
Backup schedule: How often? (Daily? Weekly? As needed?)
Backup location: Where are they stored? (On-site only? Off-site? Cloud?)
Who owns it: Who is responsible for backups? (In-house IT? MSP? Cloud provider?)

Outcome: A spreadsheet listing all systems and current backup status.

Week 2: RTO/RPO Target-Setting (30 Minutes)

For each critical system, answer:

Email: "If email went down right now, could we operate? For how long?" (RTO)
Email data loss: "Would losing the last 2 hours of emails be acceptable? 30 minutes?" (RPO)
Case management: "How long without access to case files?" (RTO)
Case file data loss: "Acceptable to lose the last 4 hours of work?" (RPO)
Document repository: "How long without access to archived documents?" (RTO—usually longer)

Suggested Targets:

Email: RTO 1 hour, RPO 15 minutes
Case management: RTO 4 hours, RPO 1 hour
Documents: RTO 24 hours, RPO 12 hours

Outcome: A documented table of RTO/RPO targets. Get your managing partner or office manager to sign off—this is their operational decision.

Week 3: Backup Verification (1–2 Hours)

Pick ONE system and test it:

Check backup logs: Ask your IT person or MSP to show you the last 7 days of backup completion
- Are they running? (Status = "Completed" or "Completed with warnings"?)
- Any failures?
Verify backup size: Is the backup growing or stagnant?
- Growing = new data is being backed up
- Stagnant = backups may not be running
Test a restore: Pick a non-critical email mailbox or folder and attempt to restore it to a test location
- Does it work?
- How long does it take? (Measure actual RTO)
- Is the data intact?
Check off-site copy: Do you have an off-site backup?
- Is it truly off-site? (Different location, different provider?)
- Is it immutable? (Can't be deleted or encrypted remotely?)

Outcome: Actual data on whether your backups work and what your real RTO/RPO is (vs. what you hope it is).

Week 4: Testing Schedule & Documentation (30 Minutes)

Schedule quarterly restore tests: Set calendar reminders (3 months apart) to test another system
Document your backup strategy:
- Systems backed up
- Backup schedule & locations
- RTO/RPO targets
- Who is responsible
- Tested procedures
Create a recovery runbook: Step-by-step guide to restore each critical system (so you don't panic during an actual disaster)
Share with leadership & key personnel: Email the plan, brief the managing partner

Outcome: Documented, scheduled backup verification. Proof that you're meeting ABA Rule 1.6(c).

When to DIY vs. When to Hire an MSP

You Can DIY If:

You have a dedicated part-time IT person (or in-house team)
You're willing to set up and monitor NAS backup
You're comfortable with cloud backup subscriptions (Backblaze, Carbonite, etc.)
You commit to monthly restore testing
You have a small firm (under 15 people) with relatively simple systems

What DIY looks like:

Local NAS backup (software: NAS-native, Veeam, Nakivo)
Cloud backup subscription ($10–50/month per user)
Manual quarterly restore testing
Spreadsheet-based documentation

The risk: You miss immutable backup configuration, advanced ransomware protection, and incident response coordination. When something goes wrong, you're on your own.

You Should Hire an MSP If:

You want redundancy without managing it yourself
You need immutable, ransomware-resistant backups
You want professional incident response support
You have 15+ people or complex systems
You can't afford downtime (litigation, deadline-driven practices)
You want cyber insurance compliance proof

What MSP-managed backup includes:

3-2-1 infrastructure design & implementation
Automated backup + cloud replication
Immutable, air-gapped off-site copy
Weekly/monthly automated restore testing
RTO/RPO optimization
24/7 monitoring
Incident response coordination
Cyber insurance documentation

Cost: $100–$300/month (depending on data size and firm size). One ransomware recovery costs $50K–$150K. Do the math.

The Inflection Point

For most small law firms (10–50 attorneys), the inflection point is clear: The cost of an MSP backup service is negligible compared to the cost of recovery or downtime. Even a small firm can't afford 24 days offline (like the 29-attorney firm that paid $600K+).

Real-World Recovery: What Actually Happens

Understanding what a disaster recovery looks like helps you plan realistically.

Hours 0–2: Discovery & Containment

Your staff notices emails aren't working or a ransom message appears on screens. What happens:

IT isolates infected systems from the network (stops ransomware from spreading)
IT preserves evidence (forensics will need this)
Leadership is notified
Cyber insurance carrier is contacted
Law enforcement may be notified (FBI for ransomware)

Your firm's status: Email down; case management inaccessible; chaos.

Hours 2–4: Backup Validation

If you have good backups:

IT verifies off-site backups were NOT encrypted
IT assesses data loss (how much changed since last backup?)
IT plans recovery strategy
Leadership makes decision: "Pay ransom or restore from backup?"

If you DON'T have good backups:

Panic sets in
Ransom negotiation discussions begin
Forensic investigators are called (cost: $25K–$50K+)

Your firm's status: Waiting for recovery plan.

Hours 4–12: Critical System Restoration

IT priorities: Restore email first (most disruptive), then case management.

Email restored from backup
Staff can send/receive again (clients can reach you)
Case management system restored
Data integrity checks performed
Limited operations resume (some files still unavailable)

Your firm's status: Partial operations; urgent work proceeding.

Hours 12–24: Full Recovery

Document repositories restored
Accounting/billing systems restored
Final validation of all restored data
Forensic investigation continues

Your firm's status: Normal operations resuming.

Days 2–30: Post-Recovery Actions

This is where costs add up if you're not insured:

Comprehensive forensic investigation: $25K–$50K
Legal review of breach obligations (did data actually leak?)
Client notification (if personal information exposed)
Notification to state attorney general
Notification to bar association
Credit monitoring for affected clients (if applicable)
Cyber insurance claims

Your firm's status: Dealing with aftermath; managing client concerns.

FAQ: Questions Your Team Is Already Asking

"What if a backup fails?"

The 3-2-1 rule protects you. You have three copies; one failure leaves two. That said, regular testing (monthly) catches failures early. One real case: A retailer's backup had been failing silently for months; discovered only during ransomware. Better to test now than find out during a crisis.

Action: Add "monthly backup testing" to someone's calendar.

"How often should we test backups?"

Minimum: Once per quarter (NIST/CIS best practice)
Better: Monthly
Best: Automated weekly testing (if you use managed backup)

Each test should:

Restore to a test system (not production)
Verify data integrity
Measure actual RTO
Document results

"Do we need to test ALL systems, or can we rotate?"

Rotate. Test email one month, case management the next, document repository the third. This spreads the work and builds confidence over time.

"What about cloud backups for confidentiality?"

Cloud backups are HIPAA-compliant if the provider is BAA-compliant (signed Business Associate Agreement). For GDPR, ensure the provider handles data in EU-compliant locations. For general client confidentiality, encryption in transit and at rest is standard. MSPs ensure this compliance; verify with your provider.

"Can we recover individual case files, not just full systems?"

Yes, if your backup system supports granular recovery (most modern systems do: Veeam, Veritas, Datto, managed backup services). You can restore a single email, a specific case file, or a document folder without restoring the entire system. This is important for lawyers who need to recover a accidentally deleted trial exhibit.

Action: Ask your IT person or MSP: "Can we do file-level restore?" If they say "no," it's a gap to fix.

"How much does this cost?"

DIY approach: NAS ($2K–$5K hardware) + cloud backup ($10–50/user/month) + your time
Managed backup MSP: $100–$300/month (all-inclusive)
One ransomware recovery: $50K–$150K
24 days offline costs (at $200/hour billable rate, 5 attorneys): $48K in lost revenue alone

The MSP usually pays for itself in avoided downtime.

"What if the ransomware encrypts both our backup AND our production data?"

This happens if:

Backup is on the same network (attackers delete it)
Backup is NOT immutable (attackers encrypt it)
Backup is not air-gapped (attackers access it)

The 3-2-1 rule prevents this: Off-site immutable backup is inaccessible to attackers. Even if production + local backup are encrypted, you still have the off-site copy.

"Do we need cyber insurance?"

Recommended. Covers:

Ransom negotiation services
Forensic investigation
Legal assistance
Client notification costs
Regulatory penalties (sometimes)

Cost: $300–$1,500/year for small law firms. Worth it.

What This Looks Like When Done Right

A 20-attorney law firm in Central Florida did their backup audit:

Week 1: Inventoried systems

Email (Microsoft 365)
Case management (Clio)
Document repository (OneDrive)
Accounting (QuickBooks)

Week 2: Set RTO/RPO targets

Email: 1 hour, 15 min
Case mgmt: 4 hours, 1 hour
Documents: 24 hours, 4 hours

Week 3: Tested backups

Found M365 backup gaps (cloud-native, but no automated off-site copy)
Tested restore from OneDrive—worked but took 6 hours (didn't meet 24-hour target)
Realized they had NO immutable backup

Week 4 & Beyond: Implemented fix

Hired MSP for managed backup
MSP added immutable cloud backup (off-site)
MSP configured 3-2-1 strategy
Scheduled monthly restore testing
Cost: $200/month

The payoff: 6 months later, ransomware hit a vendor. But the firm's backup was ready. They restored email in 1 hour, case management in 4 hours. No ransom paid. No downtime for clients.

The MSP Difference

We've worked with law firms who tried the DIY approach and regretted it. The difference between "we have backups" and "we can recover" is professionalism.

An MSP brings:

Expertise: They know what works because they do it 50 times per year
Monitoring: Automated alerts if backups fail; you don't learn about problems during a disaster
Immutability: Off-site backups configured to be ransomware-proof
Testing: Automated or managed testing on a schedule
Incident response: When disaster strikes, you have a plan AND a team to execute it
Compliance proof: Documentation for cyber insurance, bar audits, client questions

For a small law firm, this peace of mind is worth far more than the cost.

Next Steps

This week:

Forward this article to your managing partner
Start the Week 1 inventory (30 minutes)
Email your IT person or current MSP: "Can we review our backup strategy?"

This month: 4. Complete the 4-week audit 5. Identify gaps 6. Schedule quarterly restore tests

This quarter: 7. If you find gaps, get quotes from an MSP (managed backup service) 8. Implement the fix 9. Document your RTO/RPO strategy and get leadership sign-off

Your law firm's ability to recover from a disaster is not a technical problem—it's a business continuity problem. And you can't afford to fail.

Go Deeper

Want to learn more about the specific threats targeting law firms and how to build a complete security posture?

Phishing in 2025: How AI-Powered Attacks Outsmart Your Team — Understand why email is the #1 attack vector for law firms and how to protect your team.
SMB Threat Alert: FOG Ransomware & Why Passwords Are the Open Door — Ransomware often starts with a weak password. Learn how to audit and strengthen yours.
What is a Managed SOC Service: A Practical Guide for SMB Leaders — Disaster recovery is one piece of security. A managed SOC provides 24/7 monitoring to catch threats before they become disasters.

Schedule a Free Backup Audit

Unsure if your firm's backups are audit-ready and compliant with ABA Rule 1.6?

We offer a free 15-minute backup posture review for Tampa-area law firms. We'll assess your current strategy, identify gaps, and explain what a 3-2-1 backup looks like in practice—no pressure, just peace of mind.

[Schedule your free review here]