Resolutions fail when they are vague. "Be more secure" does not survive the first busy week of January. "Run a restore test on the last Friday of each quarter" does. Backup and disaster recovery lend themselves to concrete resolutions, because the tasks are specific, measurable and easy to calendar.
Here are six that a law firm can adopt on the last day of the year and keep all the way through the next.
Resolution 1: Know What Is Backed Up
Make a one-page list of every system holding client or firm data, and beside each, note whether it is backed up, how often, where the copy is stored and who is responsible. Include cloud applications, email, document management, practice management, billing, phone systems and laptops.
The exercise usually reveals at least one surprise. Finding it on December 31 is much cheaper than finding it during an outage.
Resolution 2: Protect at Least One Copy From Tampering
Modern attackers hunt for backups. Ensure at least one copy is offline or immutable, so that a compromised administrator account cannot erase it. Also confirm that backup credentials are separate from your everyday administrator accounts and protected by multi-factor authentication.
CISA's ransomware guidance has long encouraged offline, encrypted backups and regular testing, and this resolution puts that advice into practice.
Resolution 3: Test Restores on a Schedule
Put four dates on the calendar. At each, restore a random matter folder, a mailbox and, at least twice a year, a full server or system in an isolated environment. Record the date, duration, result and any fixes.
A short log of tests is one of the most persuasive documents you can show a partner, client or insurer.
Resolution 4: Write Down Recovery Targets
Agree, with partners, on two numbers:
- Recovery time objective: how long the firm can be without systems before the damage becomes unacceptable.
- Recovery point objective: how much recent work could be lost.
Many firms discover that their assumptions are more optimistic than their actual capabilities. That is useful information, because it points to where investment is needed.
Resolution 5: Update the Disaster Recovery Plan
A plan should answer practical questions:
- Who declares an emergency, and who is their backup?
- Whom do we call, and what are their numbers? Keep a printed copy.
- Which systems come back first? Typically email, document management, phones and practice management.
- Where will people work if the office is unavailable?
- How will we communicate with clients, courts and staff?
- What do we do about deadlines? Know your courts' procedures for emergencies.
Review the plan each year and after any significant change. Hold a short tabletop exercise where participants walk through a scenario such as a ransomware attack or a flooded server room.
Resolution 6: Align Backups With Obligations
Review your cyber-insurance application, client outside counsel guidelines and engagement letters for backup-related commitments. Confirm that what you promised matches what you do. ABA Model Rule 1.1, Comment 8 on technology competence and Rule 1.6(c) on reasonable safeguards support the idea that a documented, tested approach reflects reasonable care. Check your state bar for any specific guidance.
Making Resolutions Stick
- Assign an owner for each resolution, with a due date.
- Put recurring tasks on shared calendars, not in someone's head.
- Report quarterly to partners with a brief summary.
- Tie to budget, so gaps identified are funded.
- Celebrate small wins. A successful restore test deserves recognition.
A Quick Self-Assessment
Answer yes or no:
- Could you name every system that is backed up?
- Do you have a copy an attacker could not delete?
- Have you restored something in the past three months?
- Do partners know how long recovery would take?
- Is the recovery plan printed and current?
Every no is a resolution waiting to be written.
How Counsel Cyber Helps
Counsel Cyber helps law firms put these resolutions into practice with scheduled restore tests, documented recovery objectives and clear reporting. If you want a backup review to open the new year, we are glad to start with a short conversation.