A green checkmark on a backup dashboard tells you the job ran. It does not tell you the data is complete, readable, or restorable in the time your firm can tolerate. The only way to know is to restore something and look at it. Firms that test regularly find problems on a quiet Tuesday. Firms that do not find them in the middle of an incident.
This post lays out a simple testing program that a firm administrator can oversee without being technical.
Why backups fail quietly
Backups fail for ordinary reasons: a folder was added but never included in the job, a credential expired, storage filled up, a database was copied while it was in use and came out inconsistent, or encryption keys were lost. Ransomware adds another risk, because an attacker with administrator access may delete or corrupt backup copies. None of these problems announces itself.
A tiered testing schedule
Monthly: file-level spot check
Ask your IT provider to restore a handful of randomly chosen files from different folders and dates, including a recent matter folder and an older one. Open them. Confirm they are intact, current and readable. This takes minutes.
Quarterly: application and mailbox restore
Restore a single mailbox item or folder, a document from your document management system, and a record set from your practice-management platform if your vendor or backup tool allows it. These tests confirm that the tools your staff actually use are recoverable, not just raw files.
Annually: full recovery exercise
Pick a critical system, such as the file server, a line-of-business application or a virtual machine, and restore it completely into an isolated environment. Time the process from the decision to restore to a working system. This is the number your partners actually need: how long would we be down?
What to record
Keep a one-page scorecard for each test:
- Date and system tested
- Who performed it and who witnessed it
- What was restored and from which backup point
- How long the restore took
- Whether the data opened correctly
- Problems found and who owns the fix
- Date the fix was verified
This log is also useful evidence when a client questionnaire or cyber insurance application asks how often you test.
Questions the test should answer
- Can we restore from the offsite or cloud copy, not just the local one?
- Does the restore work if our domain or primary network is unavailable?
- Are encryption keys and backup credentials stored somewhere other than the systems being backed up?
- Is at least one copy immutable, so that a compromised administrator account cannot delete it?
- Does the measured restore time match what partners were told?
Common testing mistakes
- Testing only the easy copy. The fast local appliance may restore fine while the offsite copy has never been tried.
- Restoring over production. Always restore to a separate location so a failed test cannot damage live data.
- Letting the same person run and approve. Have someone independent verify results.
- Skipping cloud data. Mailboxes and SharePoint libraries need tests too.
- No follow-through. A failed test with no owner and no deadline is just a documented risk.
Connecting tests to firm obligations
ABA Model Rule 1.1, Comment 8 speaks to understanding the benefits and risks of relevant technology, and Rule 1.6(c) addresses reasonable efforts to protect client information. Being able to retrieve client files is part of serving clients competently. The ABA has not set a testing frequency, so choose a schedule you can sustain and confirm local expectations with your state bar.
A hypothetical example
Consider a hypothetical 20-attorney firm that tests quarterly. During one test, the team discovers that a newly created matter share was excluded from the backup job six weeks earlier. Because the gap was found in a test, the fix takes an afternoon. Without testing, the firm might have learned of the omission only after losing data.
Where to start
If you have never tested a restore, begin with the monthly spot check this week and schedule the full exercise within the quarter. Counsel Cyber builds and runs restore-testing programs for law firms and can supply the scorecard and the independent witness. We are glad to start with a short review of your current backup design.