When firms talk about disaster recovery, they usually talk about products. A better starting point is a pair of questions. How long can we be without this system? And how much recent work can we afford to lose? The answers are called the recovery time objective and the recovery point objective, and they decide almost every technical choice that follows.
Two Terms Worth Knowing
Recovery Time Objective (RTO): The maximum acceptable time a system can be down before the impact becomes unacceptable. If your RTO for email is four hours, your plan must restore email within four hours.
Recovery Point Objective (RPO): The maximum acceptable amount of data loss, measured in time. If your RPO for the document system is one hour, you need backups or replication frequent enough that you never lose more than an hour of work.
Think of RTO as how fast you come back and RPO as how far back you go when you do.
Why Law Firms Should Set These Deliberately
Without stated goals, recovery is whatever the IT setup happens to deliver. A nightly backup means up to a day of lost work. A single backup server means days of rebuild time. Partners often discover this only during an outage.
Setting objectives also forces useful conversations. Which systems actually matter on a deadline? Who decides priority when everything is down at once?
Step 1: List Your Systems
Write down every system the firm relies on, such as:
- Email and calendaring
- Practice management and billing
- Document management and file shares
- Trust accounting
- Phone system
- E-filing credentials and court portals
- Time-entry and payroll
- Remote access and VPN
- Client portal and website
Step 2: Rate the Impact of Downtime
For each, ask the responsible attorney or office manager:
- What stops if this is down for one hour? A day? A week?
- Are there court or filing deadlines that depend on it?
- Is there a workaround, such as paper calendars?
- Does downtime create an ethical issue, such as access to client funds or confidential records?
Step 3: Assign Tiers
A simple three-tier scheme works for most small firms.
- Tier 1, critical: Email, document and case management, trust accounting. Target restoration in hours.
- Tier 2, important: Billing, phones, client portal. Target restoration within a day or two.
- Tier 3, deferrable: Archives, rarely used applications. Can wait several days.
These categories are guidelines. Your firm's practice mix may shift priorities, for example a litigation firm may rank e-filing access higher.
Step 4: Decide the Data Loss You Can Tolerate
For each Tier 1 system, ask: if we restored to this morning's state, what would we lose, and how painful would that be? Some firms can accept redoing a day of work. Others, with heavy document drafting under deadline, may want hourly or continuous protection.
Step 5: Match Technology to Goals
- A tight RPO means more frequent backups or continuous replication.
- A tight RTO means faster restore methods, such as local backup copies, standby systems or cloud-hosted recovery.
- Tighter goals cost more. Be honest about the budget, and fund the most important systems first.
Step 6: Test Against the Goals
An objective is a claim until you test it. Run a restore of a Tier 1 system and time it, including the steps that precede it, such as finding credentials and getting approvals. Compare the result to your RTO. If it is longer, either improve the process or change the objective with open eyes.
Step 7: Write It Down
Create a one-page table with each system, its tier, RTO, RPO, owner and backup method. Share it with partners so expectations match reality. Update it when you adopt new software.
Include Dependencies
Systems rarely stand alone. Restoring a document system may depend on identity services, networking and internet service. Map the order of restoration so you do not discover a hidden dependency mid-crisis.
A Note on Communication
Plan how you will communicate during an outage, including how staff will be notified if email is down and how clients will be contacted. Keep a printed contact list.
Counsel Cyber helps law firms set realistic recovery goals and build backup systems that meet them. If you would like to walk through your own systems and tiers, we can facilitate the discussion.