Disaster Recovery for Irish Law Firms: Why Backup Alone Is Not Enough
Law firms invest heavily in preventing cyber incidents, but prevention is only one part of resilience. Ransomware, hardware failure, cloud disruption, accidental deletion, fire or flood can still make critical systems and information unavailable. When that happens, the priority shifts quickly from protection to recovery, and the firm needs to know whether it can restore the systems, data and communications required for legal work within a timeframe the business can tolerate.
For Irish law firms, that means looking beyond whether backups exist. A completed backup job does not prove that a restore will work, that an application can be recovered, that dependencies have been accounted for or that critical work can resume quickly enough. The Law Society of Ireland’s Legal Services Excellence Standard checklist reflects this distinction by asking firms to provide evidence that a disaster recovery policy has been implemented and periodically tested, and that data is backed up off-site and remains available if premises are damaged or destroyed.
Backup is only one part of recovery
Backup, disaster recovery, cyber recovery and business continuity are related, but they are not interchangeable.
| Capability | What it provides | The question that matters |
|---|---|---|
| Backup | Protected copies of data | Can the information be restored successfully? |
| Disaster recovery | Restoration of systems, applications and infrastructure | How quickly can critical services return? |
| Cyber recovery | Recovery after a cyber incident with additional validation | Can the firm recover without reintroducing the threat? |
| Business continuity | A way to keep essential work moving during disruption | How does the firm operate while normal systems are unavailable? |
These capabilities work together, but they address different parts of resilience. Backup protects the data, disaster recovery restores technology, cyber recovery focuses on restoring safely after an attack, and business continuity keeps essential operations moving while recovery takes place.
A law firm can have reliable backups and still have a weak recovery position if critical systems take too long to restore, priorities are unclear or the process has never been tested under realistic conditions. The objective should therefore be broader than protecting copies of data. It should be to prove that the firm can restore what legal work depends on, in the correct sequence and within an agreed timeframe.
For a deeper explanation of the role managed backup plays within that process, SureLogik’s guide to Backup as a Service looks at the relationship between protected data, recovery testing, RTOs and RPOs.
Recovery should start with the work that cannot wait
Not every system needs to return at the same time. If a serious outage affects a law firm during a working day, restoring a rarely accessed archive may be far less important than recovering identity services, email, active documents or a critical practice management application. A useful recovery strategy therefore starts by identifying the systems and services that support the firm’s most time-sensitive work.
That may include:
- identity and access services
- Microsoft 365 and email
- document and case management platforms
- active client and matter files
- financial and billing systems
- specialist legal applications
- the databases and infrastructure those systems depend on
The important point is not the list itself, but the sequence and the dependencies between systems. A document management platform may be critical, for example, but if it depends on an authentication service or database, recovering it in isolation may not restore anything useful.
This is where Recovery Time Objectives and Recovery Point Objectives help. An RTO defines how quickly a service needs to return, while an RPO defines how much recent data the firm can afford to lose. Those targets should reflect business impact rather than default settings in a backup product. The Law Society’s guidance on planning for disasters and business interruption also recommends identifying critical services, systems and data so that recovery priorities are understood in advance.
Why cyber recovery is different for law firms
Traditional disaster recovery often assumes that production infrastructure has failed while the recovery data remains trustworthy. A cyber incident introduces a different risk because the most recent recovery point may not be the safest one. If an attacker has been present before ransomware is deployed, accounts may have been altered, malicious software may have been introduced or data may already have been compromised.
Simply restoring the newest available copy can therefore reintroduce the problem. Cyber recovery may require protected or immutable recovery copies, known-good recovery points, credential resets, isolated validation and checks before recovered systems are reconnected.
Ireland’s National Cyber Security Centre ransomware guidance recommends frequent backups of critical business data and specifically advises organisations to use air-gapped or immutable storage so that ransomware cannot easily compromise the copies required for recovery. For law firms, this creates a practical balance between speed and safety. Recovery needs to happen quickly enough to support the business, but not so quickly that compromised systems are returned to production.
SureLogik explores this distinction in more detail in its guide to cyber recovery versus disaster recovery, particularly the additional controls needed when recovery follows a deliberate cyber attack rather than a conventional outage.
A green backup dashboard is not recovery evidence
Backup monitoring is useful, but it only shows that a process appears to have completed successfully. It does not demonstrate that a deleted file, mailbox, database or application can be restored when needed, or whether the recovered system will actually be usable once it is back online.
Regular restore testing provides stronger evidence because it can show what was restored, whether the recovered data was usable, how long the restore took and whether the required recovery objective was met. This is particularly important in legal environments because systems rarely operate in isolation. A restored application may still be unusable if its database, identity service or another dependency remains unavailable.
The strongest recovery programmes therefore test realistic scenarios and document the results, giving the firm evidence of what works rather than relying on assumptions drawn from successful backup jobs.
How quickly should a law firm be able to recover?
There is no single recovery time that is appropriate for every law firm or every system. The useful question is how long the business can realistically operate without a particular service before the impact on legal work, clients or deadlines becomes unacceptable.
A backup may be perfectly usable and still be inadequate if recovery takes longer than that threshold. Recovering a critical legal application within two days may be technically successful, for example, but operationally unacceptable if legal professionals need access within a few hours to progress transactions, prepare filings or communicate with clients.
The Law Society’s 2026 ransomware guidance for legal practices highlights this issue directly, asking firms to consider the realistic prospect of restoration from backups, downtime costs and which services are genuinely business critical. The practical measure of resilience is therefore not simply whether data can be recovered, but whether critical services can return quickly enough to support the work of the firm.
For organisations considering this specifically in the context of ransomware, SureLogik’s ransomware recovery guide looks at system prioritisation, clean recovery and the practical steps involved in restoring operations after an attack.
Business continuity needs to work alongside recovery
Disaster recovery restores technology, while business continuity deals with how the firm operates while that restoration is taking place. The two need to work together because an outage does not suspend client requirements, deadlines or the need for communication.
If email is unavailable for several hours, the firm still needs a way to manage urgent communications. If an office is inaccessible after fire or flood, legal professionals still need access to critical systems. If a document platform is down, there needs to be a clear process for handling genuinely urgent work until service is restored.
The Law Society’s disaster-planning guidance for solicitors recommends that firms prepare for business interruption, document how essential records will be protected and recovered, establish communication procedures and periodically test the plan. Recovery planning therefore needs to cover both the technical process and the practical decisions required while systems remain unavailable.
For more on the operational side of this planning, SureLogik has also published a guide to building a business continuity plan.
Third-party and cloud services still need recovery planning
Modern legal practices depend heavily on external technology providers, including Microsoft 365, cloud platforms, outsourced IT services, case management systems and specialist legal applications. Moving a service to the cloud changes where the technology runs, but it does not remove the need for recovery planning.
The Law Society highlighted this issue in its guidance on third-party cyber risk for legal practices, noting the profession’s increasing reliance on cloud-based case management, outsourced IT, eDiscovery platforms and other external technology providers.
For each important service, the firm should understand who is responsible for protecting the data, what the provider’s recovery capability includes, how quickly the service can be restored and whether additional protection is required. Saying that data is “in the cloud” does not answer any of those questions, particularly where the service is central to day-to-day legal work.
Recovery testing should reflect realistic failures
Testing should reflect the failures that could materially affect the firm rather than simply the easiest technical task to demonstrate. Depending on the environment, that might mean restoring a Microsoft 365 mailbox, recovering a document repository, bringing a database and application back online, recovering a virtual machine after infrastructure failure or validating a protected recovery point after a simulated ransomware incident.
The purpose is to expose gaps that may only become visible when systems, people and dependencies have to work together. The Law Society’s guidance on building a practical cyber incident response plan makes a similar point. Plans can look comprehensive on paper but fail during a real incident because responsibilities are unclear, communications depend on affected systems or the plan has never been tested. The same principle applies to recovery, where an untested process can give a misleading sense of readiness.
GDPR adds another layer of pressure
Where a cyber incident involves personal data, the firm may need to manage regulatory obligations while technical recovery is already under way. The Irish Data Protection Commission’s guidance on personal data breaches states that where a breach presents a risk to affected individuals, the relevant supervisory authority must be notified without undue delay and, where applicable, within 72 hours of the organisation becoming aware of the breach.
During that same period, the firm may also be trying to contain the incident, assess affected systems, communicate internally and restore essential services. A tested recovery process will not remove those obligations, but it can reduce uncertainty around how systems will be restored and who is responsible for the technical response.
Six questions that reveal whether recovery is genuinely ready
A law firm does not need to begin a recovery review by purchasing new technology. A more useful starting point is to establish what the current arrangements can actually deliver.
- What needs to be recovered first?
Identify the systems and data that support the firm’s most time-sensitive work. - How quickly must those services return?
Set realistic recovery targets based on the operational effect of downtime. - How much recent data could be lost?
Set appropriate RPOs and confirm that backup frequency supports them. - When was the last successful restore test?
Ask for evidence of what was restored, how long it took and whether the result was usable. - Are recovery copies protected from the same incident affecting production?
Consider separation, immutability and other controls that reduce the risk of backups being deleted, encrypted or corrupted. - Does the firm know the recovery sequence?
Document which systems need to return first, what they depend on and who is responsible for each stage.
These questions move the conversation away from whether backup software has been installed and towards whether the firm has a recovery capability designed around the needs of the practice.
Recovery readiness should be demonstrable
For Irish law firms, cyber resilience should not end with prevention. Security controls reduce the likelihood of an incident, but they cannot guarantee that critical systems will always remain available. The stronger measure is whether the firm knows what needs to return first, how quickly it needs to be available, what dependencies must be restored alongside it and whether that process has been proven through testing.
A green backup dashboard can show that a job completed, but it cannot show that the firm can resume critical legal work after a serious outage. Recovery readiness is stronger when the firm can demonstrate that critical services can be restored safely, in the correct order and within a timeframe the business can tolerate.
Frequently asked questions
Q: What is disaster recovery for a law firm?
Disaster recovery is the planned process for restoring critical systems, applications and data after a serious disruption. For law firms, this may include Microsoft 365, document and case management platforms, client files, databases, practice management systems and supporting infrastructure.
Q: Is backup the same as disaster recovery?
No. Backup creates protected copies of data, while disaster recovery covers the wider process of restoring systems, applications and infrastructure so the firm can resume operations. A backup can therefore be working correctly while the wider recovery process remains untested.
Q: What is cyber recovery?
Cyber recovery is the process of restoring systems and data following a cyber incident while taking additional steps to avoid returning compromised systems to production. This may include immutable backups, known-good recovery points, isolated validation and credential resets.
Q: How often should a law firm test its backups?
There is no single testing frequency that suits every environment. Testing should reflect the importance of the system, how frequently the data changes and the firm’s recovery requirements. The key is to test often enough to provide current evidence that critical information and systems can be restored within the required timeframe.
Q: What should an Irish law firm include in a disaster recovery plan?
A disaster recovery plan should identify critical systems and data, RTOs and RPOs, recovery priorities, system dependencies, backup arrangements, responsible people, supplier contacts and testing requirements. It should also account for situations in which normal offices, email or other communication systems may be unavailable.
Assess recovery readiness
SureLogik helps organisations understand what needs to be recovered, how quickly it needs to return and whether existing backup and disaster recovery arrangements can meet those requirements. This includes managed backup, disaster recovery, restore testing and cyber recovery planning built around critical business systems and data.