This one is a checklist rather than an argument. Work through it in an afternoon and you will know more about your firm’s position than most firms your size do.

I am deliberately not going to open with a disaster story. The reason to do this is not that something dramatic is coming. It is that the answers are knowable, and not knowing them is the only genuinely bad outcome here.

Backups

• Name every system that holds something you would not want to recreate. Include the ones that are not on a server, which is most of them now.
• For each one, say where the backup lives and who is responsible for it. If the answer is a vendor, say which vendor and under what plan.
• Confirm that at least one copy is somewhere a problem in your office cannot reach.
• Find the date of the last time somebody restored something from a backup and confirmed it worked. A report saying the backup succeeded is not the same thing.
• Decide how much work you could afford to lose. An hour, a day, a week. That number drives everything else, and most firms have never said it out loud.

Recovery

• Write down, on one page, who does what in the first hour if a key system is unavailable. Include phone numbers that do not depend on the system being available.
• Identify which one or two systems have to come back first. Not everything is equally urgent, and deciding in advance is much easier than deciding at the time.
• Check whether your team could keep working from anywhere else. During filing season, a building being inaccessible is a business problem, not a technology problem.
• Confirm somebody outside the firm has a copy of that one page.

Remote access

• List every way somebody can reach firm data from outside the office. Include personal phones and home computers, because they are on the list whether or not you put them there.
• Confirm multifactor authentication on every one of those paths, with no exception for anybody senior.
• Check whether files can be copied onto a personal machine, and whether they have been.
• Review who still has access from the last two years of departures, including seasonal and contract staff.
• Decide what happens if a laptop or phone is lost, and confirm somebody can actually do that thing remotely.

Reading your own answers

If you can answer everything above, your firm is in better shape than most and the remaining work is documentation. If you cannot, the gaps are almost certainly in the same two places they usually are. Nobody has restored from a backup recently, and departed staff still have access somewhere.

Neither of those is unusual and neither is expensive to fix. What makes them worth doing now is that both get harder to unpick the longer they sit.

If you would rather not do this yourself

This is ordinary work that I do as part of an engagement, and I am happy to walk through your answers with you whether or not that is where it ends up. Tell me what you found and I will tell you what I would fix first.

The number is (617) 221-4100, and I am happy to do this at your office or over the phone.