Business continuity and backup: protecting the firm's business from data loss

For a law or notary firm, backup alone is not enough: while the former saves data, business continuity ensures that operations can continue even after a major failure or a ransomware attack. In this guide, we analyze the 3-2-1 backup rule (three copies, two different media, one offsite and immutable copy), RPO and RTO metrics, and the creation of a 5-step disaster recovery plan tested periodically. We also examine the obligations set by GDPR and NIS2, the comparison between on-premise, cloud, and hybrid architectures, and how active monitoring with artificial intelligence allows anomalies to be identified before they turn into an operational blockage.

---

Over the past five years, the nature of cyber risk for the legal sector has undergone a genetic mutation. Until not long ago, the interruption of activities in a professional firm was considered an exceptional event, almost always attributable to hardware failure: a mechanical hard drive damaged by wear and tear, an electrical failure, or the accidental deletion of a network folder by a distracted coworker.

Today the scenario is radically different. Law and notary firms safeguard a information assets among the most attractive on the market: non-public court documents, economic-financial expert reports, confidential communications covered by professional secrecy, banking data, and sensitive personal files. This concentration of critical data has turned law firms into priority targets for criminal groups specialized in attacks double and triple extortion ransomware : it is no longer just a matter of encrypting files to halt operations, but of threatening the public release of confidential client documents.

In this context, limiting oneself to a generic notion of "backup" is a mistake that can cost the very survival of the business. The real challenge for professional firms is not simply keeping a copy of the files, but ensuring the Business Continuity : the ability to restore workflows, database access, and telematic communications very quickly, minimizing economic, reputational, and deontological impact.

From simple copying to business continuity: understanding the paradigm shift

In the common vocabulary of many professionals, the terms “backup” and “business continuity” are still used interchangeably. However, these are two concepts located on distinct logical and strategic levels.

What is backup and what are its intrinsic limitations

The backup it is the technical operation of static data duplication from a primary source to a secondary medium (local, remote, or in the cloud). It is an indispensable measure, but in isolation, it does not guarantee work continuity. Having data saved on an external medium does not mean being able to resume operations immediately after an incident: if the central server breaks down or becomes corrupted, the files are safe, but the infrastructure that allows lawyers to consult them, draft legal documents, and synchronize procedural deadlines remains down.

Business Continuity

the business continuity is the overall architectural, organizational, procedural, and technological framework that enables a firm to continue delivering its services even during or immediately following a severe disaster, whether it is a network outage, a natural disaster, or a violent cyber attack. Business continuity includes backup, but integrates it with:

• Disaster Recovery (DR) : the set of policies and technical tools for the timely recovery of IT systems, servers, and applications
• Resource redundancy : the duplication of compute nodes, power supply, and connections to avoid single points of failure (Single Point of Failure)
• Documented emergency plans : clear operational protocols that instruct each member of the firm on what to do, who to contact, and which alternative channels to use during the emergency

The real cost of downtime in a law firm

When a partner or administrator evaluates investments in cybersecurity, the calculation is often flawed by a misperception: the cost of the technology fee is compared with the presumed probability of suffering irreparable damage. The correct parameter to consider instead is the cost of downtime , meaning the economic and strategic value of each single hour of forced downtime for the firm.

Direct damages and loss of productivity

In an organization with ten to fifty professionals, a 48-hour system outage results in loss of hundreds of billable hours . Lawyers cannot access defensive briefs, digital case files are inaccessible, and the consultation of jurisprudential precedents is compromised. Added to this is the cost of administrative and secretarial staff, unable to perform their normal duties.

Procedural forfeitures and disciplinary sanctions

Digital justice and the Electronic Trial do not grant unjustified margins of flexibility. The inability to file a document by midnight on the deadline date due to a system crash exposes the professional and the firm to very serious consequences:

• Incurable procedural forfeitures to the detriment of the client
• Professional liability and subsequent insurance claims with premium increases
• Disciplinary proceedings before the Bar Association for violation of the duties of diligence, competence, and custody of documents

Reputational damage and loss of customer trust

In the mid-to-high-end legal services market, trust is the primary asset. Having to inform a corporate client or an investment fund that an M&A negotiation or an international arbitration is delayed because the firm's data has been compromised destroys the credibility built over decades of a career. To prevent these critical issues at the root, the most advanced organizations integrate data management with advanced document management software for law firms , ensuring traceability, versioning, and preventive isolation of working documents.

Core metrics: defining RPO and RTO for the legal sector

A business continuity plan cannot be based on generic formulas. It must rest on precise quantitative parameters, agreed upon between the firm's management and the technology provider: RPO and RTO .

Parameter	Technical definition	Application in the law firm
RPO (Recovery Point Objective)	Maximum tolerable time span between the last backup and the failure: measures the volume of data at risk of being lost.	If the RPO is set to 24 hours, a failure at 18:00 wipes out the work done throughout the day. For a modern firm, the ideal RPO is between 15 minutes and 1 hour.
RTO (Recovery Time Objective)	Maximum time needed to fully restore systems operations after an outage.	Measures for how many hours or days the study remains inactive. A 2-hour RTO allows notifications and hearings to resume; a 3-day RTO puts impending deadlines at risk.

Precisely defining RPO and RTO allows for selecting the appropriate technology: from continuous incremental backup to virtual machines replicated in a warm cloud, ready to start up in a few minutes in the event of an on-premise server failure.

The 3-2-1 Backup Rule Applied to Professional Practices

The cornerstone of any data backup infrastructure remains the strategy of 3-2-1 Backup , formulated to eliminate any statistical probability of simultaneous file loss.

3 copies of the data

You must always have at least three distinct copies of the studio's documentary assets:

• The production copy: active files on servers or workstations
• A first local backup copy
• A second geographically disparate backup copy

2 different technological supports

Copies must not reside on the same type of storage medium. Storing the backup only on a second disk of the same server, or on disks with the same technology, exposes the system to the exact same hardware failure factor or malware attack. The ideal combination involves dedicated high-speed local storage ( Enterprise NAS with RAID drives ) supported by secure cloud repositories.

1 off-site and immutable (WORM) copy

At least one copy must reside outside the physical location of the studio: this protects against environmental risks (fire, flood, theft of the physical machines). To counter modern malware designed to search for and delete network backups, the remote copy must also be immutable , based on technology Write Once, Read Many (WORM) or on encrypted and segregated snapshots ( air-gapped ), which prevent any modification or deletion for a predetermined period, even by users with compromised administrative privileges.

The regulatory and compliance framework: GDPR and NIS2 Directive

Safeguarding business continuity is not only a choice of good management sense, but a stringent regulatory obligation that increasingly affects the professional world.

The obligations of the General Data Protection Regulation (GDPR)

Article 32 of EU Regulation 2016/679 (GDPR) expressly requires the data controller to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. Among these measures, the regulation explicitly cites:

• The ability to ensure on a permanent basis the confidentiality, integrity, availability, and resilience of processing systems and services
• The ability to promptly restore the availability and access to personal data in the event of a physical or technical incident
• A procedure to regularly test, verify, and evaluate the effectiveness of the technical and organizational measures adopted

Not having a tested disaster recovery plan can constitute a violation of Art. 32, which can be evaluated by the Data Protection Authority independently of any data breach. In this regard, the practical guidelines available through the Guidelines of the Italian Data Protection Authority , a benchmark for interpreting mandatory security measures.

The impact of the NIS2 Directive (EU 2022/2555)

With the entry into force and transposition of the NIS2 directive , cybersecurity and operational resilience requirements have widened their scope. Law firms do not automatically fall among essential or important entities directly, but they can be involved indirectly when a client subject to NIS2 (a bank, an insurance company, a strategic infrastructure manager) classifies them as relevant supplier and transfers to them, via contract, security requirements and incident notification obligations.

Large corporate clients now contractually require their legal consultants to formally demonstrate compliance with the supply chain resilience provisions set forth by the NIS2 Directive (EU 2022/2555) on the EUR-Lex portal . Not being able to document a solid Disaster Recovery Plan means risking exclusion from the fiduciary registries of major corporate entities. To offer unquestionable guarantees to clients and institutional partners, Lanpartners has aligned its processes with the most rigorous global standards, certified by ISO/IEC 27001 certification , which certifies compliance with the highest standards of security and resilience in information management.

Disaster Recovery Plan (DRP): how to structure it in 5 concrete steps

An disaster recovery plan effective is not a theoretical document put away in a drawer, but a ready-to-use operational guide in case of crisis. Here are the five key steps to implement it correctly in a law firm.

1. Critical asset mapping and data classification

Not all files have the same value at any given moment. It is essential to identify the vital resources that require immediate recovery (your practice management software, the client and hearing databases, PEC and regular e-mail mailboxes, pending case files with short-term deadlines) and separate them from historical archives and closed matters, which can have longer recovery windows.

2. Evaluation and isolation of communication channels

In the event of a ransomware attack or the blocking of the firm's domain, standard email accounts and VoIP switchboards could become unusable. The plan must establish alternative and secure communication channels to allow partners to coordinate the emergency without using potentially infected infrastructure.

3. Emergency recovery procedures (failover and failback)

The document must describe in detail the instructions to activate the failover (the temporary switch to the secondary infrastructure or backup cloud) and the subsequent failback (the controlled return to the sanitized and verified primary environment). For an operational guide on what to do concretely in the first hours after a cyber attack, it may be useful to refer to Incident Response for professional firms .

4. Clear definition of roles

Who is authorized to declare a state of IT emergency in the firm? Who contacts the IT team? Who coordinates communications to clients or any Data Breach notification to the Privacy Guarantor within the 72 hours required by the GDPR? Roles must be assigned by name and accompanied by emergency contact details that are always accessible offline.

5. Periodic Disaster Recovery Testing

A backup that has never been tested does not exist. A report of At-Bay from 2023 , based on real data of ransomware claims managed by the insurer between 2019 and 2023, found that about 1 in 3 companies (31%) fail to restore data from backups during a ransomware attack, often due to corrupted, incomplete, or unreadable files, or backups never tested before the emergency. The study must therefore plan semiannual or annual simulations of bare-metal restore and application recovery to ensure that actual recovery times match the established RTO.

On-premise, cloud, and hybrid solutions: which architecture to choose?

The choice of infrastructural configuration depends on the size of the firm, the volume of documents handled, and the level of mobility required by the professionals.

On-premises infrastructure

Storing data exclusively on physical servers within the firm offers a sense of immediate control and allows high speeds on the local network. However, it entails high hardware maintenance costs, localized physical risks, and complexity in ensuring true geographic redundancy without duplicating expenses for a second private data center.

Full cloud solutions

Complete migration to public or private cloud environments relieves the firm from physical hardware maintenance and facilitates smart working. However, it is essential to verify where the servers reside, as client data must remain within the European Economic Area, and what guarantees of encryption and data sovereignty are provided by the provider.

The hybrid approach: the optimal solution

For most modern law firms, the hybrid architecture represents the ideal balance point. It provides for:

• Local servers or NAS for maximum daily operational speed and low-latency access to heavy files
• Automatic, continuous, and encrypted backup to professional European cloud with ransomware protection
• Virtual instances ready to be launched in the cloud if the firm's physical office becomes inaccessible

To manage this complexity without taking valuable time away from legal work, most firms rely on managed IT services for law firms and notaries, delegating 24/7 proactive monitoring, security patch management, and verified backup execution to specialists.

AI-driven active monitoring: identifying anomalies before system failure

A well-designed continuity plan does not eliminate the risk of failure, but drastically reduces the time between an anomaly and its detection. This is where the active monitoring with artificial intelligence IT management in professional firms is changing in a concrete way: instead of relying solely on periodic manual checks or reactive user reports, AI-model-based monitoring systems analyze the behavior of servers, backups, networks, and applications in real-time, learning the "normal" patterns of a specific firm and flagging anything that deviates from them.

• Early detection of anomalies, such as a backup taking longer than usual, an unusual spike in outbound traffic, or repeated login attempts outside of business hours, before they escalate into a full-blown outage or a successful attack
• Reduction of the mean time to detection, which directly translates to a lower RTO because technical intervention starts before the damage spreads
• Alert prioritization, to prevent IT staff (internal or vendor) from being overwhelmed by low-value notifications and losing sight of truly critical signals

This type of monitoring naturally integrates with the timely detection obligations required by regulations and with broader strategies of cybersecurity for businesses and NIS2 compliance , of which predictive monitoring is only one component, albeit an increasingly central one in preventing operational outages.

Quick resilience check-up: how secure is your firm?

To quickly understand the level of exposure of their firm, professionals can use this short checklist:

• Do we make backup copies of operational data at least daily?
• Is there at least one copy saved outside the firm's premises and protected with immutability (WORM)?
• Do we know with certainty the maximum time required to restore systems in the event of a total shutdown (RTO)?
• Have we performed a full disaster recovery test in the last six months?
• Are the backup copies logically isolated from the main network to prevent ransomware propagation?
• Do we have a written emergency plan that instructs partners and collaborators on how to proceed in the event of a cyber incident?

If the answer to one or more of these questions is negative or uncertain, the firm is operating under a condition of risk that could compromise its daily operations.

Investing in business continuity does not just mean purchasing storage space: it means building a shield to protect your firm's most important asset, namely reputation, confidentiality, and the trust placed in you every day by your clients. To analyze your systems architecture and build a continuity plan tailored to your firm's needs, you can explore our pathways of cybersecurity audits and solutions for law firms or contact the Lanpartners team for specialized consulting.

Frequently asked questions

What is the difference between backup and business continuity for a law or notary firm?

Backup is the static copy of data on secondary storage, while business continuity is the set of technologies, procedures, and organization that allows work to resume after an incident. It includes backup, disaster recovery, resource redundancy, and documented emergency plans. Saving files is not enough if servers and applications remain down.

What are RPO and RTO and what values should be set for a law firm?

RPO (Recovery Point Objective) is the maximum tolerable time frame between the last backup and the failure, i.e., the data that is at risk of being lost. RTO (Recovery Time Objective) is the maximum time to restore systems. For a modern firm, the ideal RPO is between 15 minutes and 1 hour; an RTO of 2 hours allows for the resumption of notifications and hearings, while one of 3 days puts imminent deadlines at risk.

How does the 3-2-1 backup rule work and why must the copy be immutable?

The 3-2-1 rule requires at least three copies of data, on two different technological media, with one copy off-site. The latter must be immutable, using WORM (Write Once, Read Many) technology or encrypted and air-gapped snapshots, so that malware cannot delete or modify it, even using compromised administrative privileges.

What do GDPR and NIS2 require from a law firm regarding backup and disaster recovery?

Article 32 of the GDPR (EU Regulation 2016/679) requires measures appropriate to the risk, including the ability to restore access to personal data in a timely manner and to regularly test the measures adopted. The NIS2 Directive (EU 2022/2555) does not automatically include law firms, but clients subject to the regulation may contractually impose resilience and incident notification requirements.

How often should a professional firm's disaster recovery plan be tested?

The firm should schedule semi-annual or annual bare-metal restore and application recovery simulations to verify that actual times coincide with the established RTO. The test is decisive: a 2023 At-Bay report found that approximately 31% of companies are unable to restore data from backups during a ransomware attack.

What are the steps to create a disaster recovery plan in a law firm?

The disaster recovery plan is built in five steps: map critical assets and classify data; provide for alternative and secure communication channels; describe failover and failback procedures; assign roles by name, including data breach notification to the Authority within 72 hours; perform periodic recovery simulations.