Law firm disaster recovery guide: ensure business continuity

A law firm disaster recovery plan keeps your firm running after an outage by following seven steps:

1. Map your systems, data, and risks.
2. Rank every system by business impact.
3. Set a recovery time objective (RTO) and recovery point objective (RPO) for each system.
4. Price downtime so the budget is easy to justify.
5. Match backup and failover options to those targets.
6. Write down the plan and your first 72 hours, with a named owner for each action.
7. Train your team, test the plan every year, and update it.

At CMIT Solutions, we help law firms put each step of a law firm disaster recovery plan in place with a security-first approach, so client files stay protected and court deadlines stay on track. Our local teams are backed by a nationwide network of IT and cybersecurity professionals, and we bring more than 25 years of experience to every plan we build.

This guide includes an RTO and RPO planning worksheet and a downtime cost scenario for a firm in the middle of a trial.

Explore our IT support for law firms to see how local experts, backed by a nationwide network, can help you build your plan.

 

How to build a law firm disaster recovery plan

Build the plan in order, because each step feeds the next. The sections after this one give you the tools for every step.

1. Map your systems, data, and risks. List every system, device, and vendor, then rate the risks to each. You end with a complete inventory.
2. Rank every system by business impact. Sort systems into three tiers based on what happens to clients and deadlines if they fail. You end with a recovery order.
3. Set RTO and RPO targets. Decide how long each system can be down and how much data you can lose. You end with a completed worksheet.
4. Price downtime. Add up lost billable time, recovery fees, and court costs for a realistic outage. You end with a budget case for faster recovery.
5. Match backup and failover options. Choose the least costly tools that still meet each target. You end with a backup design you can test.
6. Write down the plan and your first 72 hours. Record contacts, roles, and actions in a document your team can follow under stress. You end with named owners for every action.
7. Train, test, and update. Rehearse the plan, restore real data, and revise after every change. You end with a plan you can trust.

CMIT Solutions can guide your team through each step as a trusted technology advisor, not just an IT provider.

Why law firms need a disaster recovery plan

Law firms need a disaster recovery plan because client duties continue during an outage. Courts, clients, and ethics rules do not pause when your server fails. A written plan shows you protected client data, kept clients informed, and met deadlines. Without one, a single failure can put cases at risk.

Disaster recovery restores your systems and data. Business continuity keeps the firm serving clients while that work happens. The federal Ready.gov business continuity planning resource calls a continuity plan essential when business is disrupted.

For a law firm, the risk is more than lost work, and uncertainty about whether current security and backups would hold up adds to it. Data loss and downtime can mean a missed filing, a delayed hearing, or a client who loses trust. CMIT Solutions helps firms prevent, detect, and respond to threats with 24/7 monitoring for managed service customers, and builds backup and recovery into business continuity so recovery starts fast.

Which rules affect a law firm’s disaster recovery plan?

A law firm’s disaster recovery plan is shaped by legal ethics guidance, state bar rules, and, in some practices, privacy laws such as HIPAA. These rules touch client communication, file protection, and data incident reporting. Check which ones apply to your practice areas and state before you set recovery targets.

• Ethics guidance: The American Bar Association’s ethics guidance on disasters says lawyers should be able to reach clients after a disaster. It also says lawyers should keep an up-to-date electronic copy of important documents off-site.
• State bar rules: These vary by state, so confirm the duties that apply in your jurisdiction.
• HIPAA: HHS guidance on business associates lists an attorney whose legal services to a health plan involve protected health information as an example. A firm in that role answers to its business associate agreement and the HIPAA rules, which set the duties and deadlines for reporting security incidents and breaches involving that information.
• State breach notice laws: State laws may require notice to affected people if personal information is exposed, so ask legal counsel which rules apply and what deadlines they set.
• Client terms: Engagement letters and corporate client guidelines may set their own security and notice terms.

CMIT Solutions helps firms match these requirements to their recovery targets with cybersecurity-informed recommendations, and documents how the plan meets each one so security and compliance decisions support the firm’s goals.

Step 1: map your systems, data, and risks

Mapping your systems means listing every application, device, data store, and vendor your firm needs to serve clients, and noting where each one lives. Then rate each risk by how likely it is and how much damage it would cause. This list becomes the foundation for every later step.

As cloud tools, devices, and vendors pile up, IT complexity grows and gaps are easy to miss. When several vendors support different systems, it can also be unclear who is responsible when something fails.

Use this table as your inventory checklist:

Category	What to list	Why it matters in a recovery
Servers and storage	File servers, network storage, and backup devices	They hold the files you must restore first
Computers and mobile devices	Laptops, desktops, tablets, phones, and scanners	Staff need working devices to resume work
Network equipment	Routers, firewalls, switches, and Wi-Fi	Nothing else works without them
Legal and business software	Practice management, billing, document management, e-filing, and research tools	Each one needs its own license, login, and restore steps
Cloud services and accounts	Email, cloud storage, and client portals	You need admin access and recovery contacts to regain control
Communication tools	Phones, voicemail, and video conferencing	Clients and courts must be able to reach you
Financial and trust systems	Trust accounting software, bank access, and payment tools	These systems track client money and must stay accurate
Access and identity	Logins, multi-factor authentication, and e-filing credentials	Lost access can lock you out of every other system
Vendors	Every provider your firm relies on, with a named contact for each	They are the first calls you make

Next, match each risk to a first safeguard:

Risk	Law firm example	Starting safeguard
Ransomware or cyberattack	An email attachment locks the file server	Multi-factor authentication, endpoint protection, and staff security training
Hardware or server failure	The only file server fails during trial prep	Off-site backups and a replacement plan
Human error	A staff member overwrites or deletes a shared folder	Folder permissions and restore options for older file versions
Power or internet outage	The office loses connectivity before a filing deadline	A secondary internet connection and cloud-based tools
Fire, flood, or storm	The office is closed for several days	Remote access and an off-site copy of key documents
Vendor or cloud outage	Your practice management provider goes offline	An exportable copy of your data and a backup way to reach key files

CMIT Solutions’ local team can help you build this inventory across your systems, devices, networks, users, and data, and keep it current as your tools change.

Additional reading: document management for law firms

Check your custom cybersecurity score to see where your firm’s security stands today.

 

Step 2: rank every system by business impact

Ranking systems by business impact means sorting each one by what happens to clients and deadlines if it goes down. Tier 1 systems stop work immediately. Tier 2 systems slow work down. Tier 3 systems can wait. This ranking tells you where to spend your recovery budget first.

When IT priorities are not tied to the court calendar, recovery decisions follow technology convenience instead of client needs.

Tier	What it means	Law firm examples
Tier 1: critical	Work stops, or a deadline is at risk within hours	Practice management, active-matter documents and trial exhibits, email, phones, trust accounting, e-filing access
Tier 2: important	Work slows, but staff can use workarounds for a day or two	Billing and reporting, website and intake forms, internal video conferencing
Tier 3: low	Work can wait several days	Closed-matter archives, old marketing files, historical reports

Two rules make this ranking fit a law firm. First, use a trial-mode override: any system that supports a hearing, filing, or trial in the next 14 days moves up to Tier 1 until the date passes. Your court calendar, not just your software list, decides what is critical.

Second, rank the dependencies. A Tier 1 system is only as available as the internet connection, login service, and network it relies on, so those belong in Tier 1 too.

CMIT Solutions helps you build this ranking with your attorneys and applies a security-first approach to the logins and network access behind each system, so recovery starts with what your clients and deadlines need most.

Step 3: set RTO and RPO targets with a planning worksheet

RTO is how long a system can stay down. RPO is how much data you can afford to lose, measured as time since the last good copy. Set both per system, not once for the whole firm. A hearing tomorrow demands a short RTO. Heavy drafting demands a short RPO.

Targets that were never written down leave a firm guessing how much work it could lose.

Use the worksheet below in four steps:

1. List each Tier 1 and Tier 2 system from Step 2.
2. Ask the attorney who depends on it two questions: “How long can we work without this?” and “How much work could we redo?”
3. Enter your own targets in the last two columns, and name an owner.
4. Test a restore to see whether your current backups can meet each number.

System	Tier	Starting RTO	Starting RPO	Your RTO	Your RPO	Owner
Practice management and calendar	1	2 hours	15 minutes
Active-matter documents and trial exhibits	1	2 hours	15 minutes
Email and calendar	1	2 hours	1 hour
Phones and call forwarding	1	1 hour	24 hours
Trust accounting	1	4 hours	1 hour
E-filing and court access	1	2 hours	24 hours
Any system supporting a trial or hearing within 14 days	1 override	1 hour	15 minutes
Billing and time entry	2	24 hours	4 hours
Website and intake forms	2	24 hours	24 hours
Closed-matter archives	3	72 hours	24 hours

The starting values are illustrative, so adjust them with your managing partner and your IT provider.

For third-party platforms, such as hosted phones, e-filing portals, and cloud practice management, confirm the vendor’s recovery commitments and identify alternative ways to work if its actual RTO or RPO cannot meet your targets. A successful restore test shows recovery performance under the tested conditions, and it does not guarantee the same target will always be met.

CMIT Solutions guides your team through this worksheet, runs the test restores that check each number, and adjusts your setup when a target is out of reach, so your recovery plan matches how your firm works.

Use our IT downtime calculator to estimate what each hour of downtime costs your firm.

 

Step 4: price downtime with a mid-trial scenario

Downtime costs a law firm far more than idle hours. Lost billable time, emergency recovery fees, and rework all add up, and a trial adds court-driven costs on top. This hypothetical scenario shows what a 36-hour outage during a jury trial could cost a small litigation firm.

When technology is treated as a maintenance expense, recovery spending is hard to defend until an outage proves its value.

Hypothetical scenario: A 10-attorney litigation firm is on day two of a five-day jury trial. At 6:00 p.m., its only file server fails.

Trial exhibits, deposition summaries, and the day’s annotated witness outlines all sit on that server. The last backup ran the night before and was never test restored. Restoring takes 36 hours. Assume the outage costs each person about 10 working hours, covering the evening trial prep and most of the next court day.

Cost line	How it is calculated	Without a tested plan (36-hour recovery, 24-hour data loss)	With a tested plan (2-hour recovery, 15-minute data loss)
Lost attorney time	10 attorneys x lost hours x $350	$35,000 (10 hours)	$7,000 (2 hours)
Idle support staff time	6 staff x lost hours x $45	$2,700 (10 hours)	$540 (2 hours)
Emergency recovery and expedited hardware	Flat estimate	$18,000	$2,500
Expert witness rescheduling fee	Flat estimate	$5,000	$0
Rebuilding the lost day of work	2 attorneys x 12 hours x $350	$8,400	$0
Continuance motion and hearing	2 attorneys x 6 hours x $350	$4,200	$0
Total		$73,300	$10,040

The rates and flat estimates are assumptions, so replace them with your own. The lost hours, recovery fees, rescheduling costs, and rework are also separate hypothetical inputs, not direct results of the RTO and RPO figures.

The tested-plan column assumes the recovery costs each person 2 hours of evening prep, and that the 15-minute data loss target is met, so no full day of work must be rebuilt and recreating the small amount of lost work adds no meaningful cost. The table also leaves out costs that are harder to price, such as client trust and the risk of a missed deadline.

The gap comes from the hours lost and the data lost. A 2-hour RTO, if met, reduces downtime, while a 15-minute RPO limits potential data loss to approximately 15 minutes of changes. The actual time needed to recreate any lost work may vary.

CMIT Solutions helps you swap these assumptions for your own rates and recovery targets, so you can see what faster recovery is worth and plan technology spending around your firm’s goals.

Step 5: match backup and failover options to your targets

Backup copies data, and failover keeps a working system available while the primary one is fixed. Your RPO decides how often you must copy data, and your RTO decides whether you need failover or a restore. Pick the least costly option that still meets each target.

As a firm adds attorneys, offices, and matters, a backup setup that once worked can stop keeping up.

Option	Best fit for an RPO of	Best fit for an RTO of	Watch out for
Nightly backup to a local device	About 24 hours	Hours to days, depending on data size	Fire, theft, or ransomware can reach the local copy too
Off-site or cloud backup, several times a day	A few hours	Hours	Restore speed depends on your internet connection and data volume
Continuous or near-continuous replication	Minutes	Minutes to hours	It can copy deleted or encrypted files unless older versions are kept
Failover to a secondary system or cloud environment	Set by the replication behind it	Minutes to hours	It needs its own testing and a separate budget

Keep at least one copy off-site and out of reach of your main network. Ask for versioning, so ransomware has a harder time overwriting every good copy.

Redundancy covers more than data. A second internet connection and battery backup for key equipment keep you online through short outages, and written recovery commitments from your software vendors tell you what to expect from them.

CMIT Solutions pairs layered cybersecurity protection with backup and recovery procedures designed to reduce the risk of reintroducing threats during restoration and to support business continuity. CMIT’s team can match each option to your targets and budget.

Many law firms assume their cyber insurance will cover them after an attack, but insurers increasingly require specific security controls, such as multi-factor authentication, endpoint protection, and logging and monitoring, before issuing or renewing coverage.

Use our insurance readiness assessment to see whether your current security environment aligns with modern insurer expectations.

 

Step 6: write down your plan and your first 72 hours

Your written plan should hold everything the team needs to act under stress: contacts, roles, recovery order, access details, and message templates. Pair it with a 72-hour timeline that names an owner for each action. Together, they turn your targets into steps people can follow.

When a firm has more than one office, response steps can differ by location unless one plan covers everyone.

Plan section	What goes in it	Why it matters
Contact tree	Names, roles, and after-hours numbers for attorneys, staff, your IT provider, insurance carrier, bank, and key vendors	No one searches for a number during an emergency
Recovery order	Systems listed by tier, with RTO and RPO	Staff restore the most urgent systems first
Access steps	How to reach admin accounts and multi-factor authentication recovery options, kept secure	Recovery does not stall on a locked account
Decision rights	A named backup decision-maker and a successor attorney if the managing partner is unavailable	Someone can act for the firm at any hour
Message templates	Short drafts for clients, staff, courts, and opposing counsel	Updates go out fast and sound consistent
Insurance details	Policy information, notice windows, and your broker’s contact	Notice to your carrier goes out on time

Use this illustrative timeline to turn the plan into action. Start urgent actions right away when the situation requires it, even if the table lists them in a later window:

Window	Actions	Suggested owner
First 12 hours	Confirm what is down and whether client data may be involved. Do not wipe or rebuild systems until you know if it was an attack. Contain the issue by isolating affected devices and resetting credentials that may be compromised. If a hearing or trial is under way, call the court clerk and opposing counsel. Switch email and voicemail to an automatic notice.	Managing partner and IT provider
12 to 24 hours	Review your policy’s notification requirements and contact your insurer promptly when a potentially covered incident occurs or is suspected, following the policy’s reporting procedures. List every deadline in the next several weeks and request extensions where needed, starting sooner if a filing or hearing is close.	Managing partner and office manager
24 to 48 hours	Set up a temporary workspace. Finish credential resets and re-enroll multi-factor authentication across all accounts. Restore Tier 1 systems in order.	IT provider
48 to 72 hours	Send clients a plain update about the disruption, and do it sooner if their matter or deadline is affected. Keep an outage notice separate from a data breach notice. Assess applicable breach notification duties promptly with legal counsel. Send required notices within the relevant deadlines, even if the investigation is ongoing, and provide updates as further facts become available. Record what happened and when.	Responsible attorney and IT provider

A mid-trial firm also needs a trial-day protocol:

1. Keep an offline, encrypted copy of exhibits, witness outlines, and the trial calendar on a device that stays with the trial team.
2. Split the roles: one attorney handles the court, and one person runs IT recovery, so attorneys can keep preparing.

CMIT’s continuous monitoring and threat response shorten the time between a problem and a decision. CMIT Solutions also helps you write this plan, assign the owners, and rehearse it before you need it.

Step 7: train your team, test the plan, and update it

Train your team on the plan, test it at least once a year, and update it after any major change to your systems, staff, or vendors. Combine a tabletop walkthrough with a real restore test of Tier 1 data. Until a restore has worked once, your RTO is a guess.

Plans go stale when no one owns the review, and a firm without long-term technology guidance may find out only during an outage.

Teach every person three habits:

• Report fast: Staff tell the plan owner right away about odd emails, locked files, or lost access.
• Know your role: Each person knows their first action and who to call.
• Work from the backup: Staff practice using the temporary workspace and phone forwarding.

Test	What it proves	Suggested frequency
Tabletop walkthrough	Everyone knows their role, including who calls the court	At least yearly
Restore test	Backups restore cleanly within your RTO	Tier 1 data quarterly, other tiers yearly
Failover test	Backup systems take over as planned	At least yearly
Contact list check	Phone numbers, vendor contacts, and after-hours access still work	Every six months

Update the plan whenever one of these changes:

• Software: A new practice management, billing, document, or AI tool, which should be reviewed for security before staff use it.
• People: Staff turnover or a new managing partner.
• Locations: An office move or a new remote work policy.
• Vendors: A new provider or a changed service agreement.
• Insurance: New renewal terms or security requirements.

CMIT Solutions leads the tabletop walkthroughs, staff drills, and yearly plan reviews, using shared tools, systems, and best practices from its nationwide network of technology experts. CMIT also keeps your plan current as threats evolve and your firm grows, and shares insights on adopting new technology, including AI, safely.

Additional reading: AI for law firms

If your firm supports government contractors, our CMMC compliance services can help you prepare for federal security requirements.

 

Keep your firm working when systems fail

CMIT Solutions acts as a trusted technology advisor for law firms, not just an IT help desk, aligning technology decisions with your firm’s goals. Its security-first managed IT services build stronger cybersecurity protection into your environment by design. Layered protection across systems and users, plus backup and recovery, keeps your firm productive and resilient when something fails.

CMIT’s responsive, locally owned teams are backed by a nationwide network of more than 900 IT experts, so you get reliable, personal IT support with consistent tools, standards, and best practices. When in-person help is needed, CMIT provides on-site support, so your plan has people behind it and not just paperwork.

CMIT Solutions helped Optyx, a multi-location optical retailer, unify its IT across locations with consistent, secure infrastructure. The Optyx case study shows what that looks like for a business with many sites.

Call us at (800) 399-2648 or visit our contact page to build a security-first disaster recovery plan, backed by responsive local support, that keeps your firm protected and productive.

 

FAQs

How much does a law firm disaster recovery plan cost?

The cost of a law firm disaster recovery plan depends on your number of systems, your RTO and RPO targets, and how much outside help you need. Faster targets usually cost more because they need more tools and testing. Ask your IT provider for a scoped quote.

CMIT Solutions can scope each recovery tier with you and show what each level of protection costs.

Where should a law firm store its disaster recovery plan?

A law firm should store its disaster recovery plan in three places: a secure cloud location, an offline copy kept off-site, and a copy with each person who has a named role. If the network is down, the cloud copy may be unreachable, so the offline copy is the fallback.

CMIT Solutions can help you keep every copy current after each plan review.

Do remote and hybrid law firms need a different disaster recovery plan?

Remote and hybrid law firms need the same recovery targets as an office-based firm but a different risk list. Home internet, personal devices, and cloud logins become key failure points, so the plan should let staff work from any location. Test that multi-factor authentication works away from the office.

CMIT Solutions helps distributed teams use consistent tools, standards, and best practices across every location, so recovery works the same way for every attorney.

What should a law firm do if a lawyer’s laptop is lost or stolen?

A law firm should act within hours when a lawyer’s laptop is lost or stolen: report it to the managing partner and IT provider, lock or remotely wipe the device, and change the user’s passwords. Then check whether client data was unencrypted, because that affects your notice duties.

CMIT Solutions can set up device encryption and remote wipe before a device goes missing, so devices and client data stay protected.

How should a law firm protect trust account access during an outage?

A law firm protects trust account access during an outage by documenting in advance how it will reach trust records and its bank. Keep bank contacts, a second authorized signer, and a recent offline reconciliation report on file. ABA disaster guidance requires reasonable steps to ensure access to trust funds.

CMIT Solutions can set up secure remote access to your trust accounting records and test it before you need it.