A law firm that can be back in under two hours: immutable backups and a tested failover to a second region

A law firm's product is the matter file, and clients ask about its protection in every outside-counsel questionnaire. This firm, about 300 attorneys in three cities, kept its document management system, billing and mail on servers in one metropolitan area, with backups in the same building. A hurricane, a flood or a ransomware crew that reached the backup copy would have stopped client work. No one could say how long recovery would take, because it had never been timed.

We started with numbers, not products. Every system was placed in a tier with a written recovery point objective (how much data may be lost) and recovery time objective (how long it may be down). Tier 1 is email, document management, billing and identity: 15 minutes and 2 hours. Tier 2 follows within 8 hours, and the rest within 3 days. Those targets decided the design. Fifteen minutes meant continuous asynchronous replication of virtual machines and database logs to a second region more than 1,000 miles away, so one storm cannot reach both copies.

Replication is not a backup, because it copies mistakes and encryption as faithfully as it copies work. So the firm also has backups on the 3-2-1-1-0 pattern: three copies on two media, one offsite, one immutable, and zero errors after verification. The immutable copy is object storage with Object Lock in compliance mode, which stops anyone, including an administrator with stolen credentials, from deleting it before its retention date. The backup system has its own identity and MFA with no trust relationship to the production directory, and restores pass through a clean-room step that scans systems before they rejoin the network.

Failover needs more than data. The second region has a domain controller, a standby network with the same addressing, IPsec tunnels from all three offices and DNS records with 60‑second TTLs, so users reach the new site without waiting for caches to expire. Microsoft 365 is backed up separately from the platform, with the same immutability. The runbook names an owner for every step and a call tree for the partners; it is short enough to follow under stress.

We rehearse it. Each quarter the team restores a Tier 1 system into the second region and times it; once a year, attorneys work from the second region for a full day. In the last full drill the firm was running in 1 hour 40 minutes, with 11 minutes of data lost, both inside target. Rule 1.6(c) of the ABA Model Rules asks lawyers to make reasonable efforts to protect client information; a tested plan, with dates and timings, is the kind of evidence that supports that effort. Our article on backups that restore describes the pattern in more detail.