Backup For
Small Law Firms & Solo Attorneys

The files a small law firm can't afford to lose

A firm's documents span decades of accumulated work. Many are one-of-a-kind: once lost, they are simply gone. The following categories are what a working law office should be able to recover, from a specific date, on demand.

• Matter files and working folders, including all drafts, research notes, and correspondence for open and closed cases
• Client documents received or uploaded, such as contracts, title records, medical records, and supporting evidence
• Signed engagement letters and retainer agreements
• Discovery materials and evidence files, including large production sets and media received from opposing counsel
• Deposition transcripts and hearing recordings
• Time & billing records and invoice histories, which may be the primary record of work performed
• Document-management system exports from platforms such as NetDocuments, iManage, or Worldox
• Scanned wet-signature originals, notarized documents, and executed court filings
• Email archives and PST files, including client communications that may have no other record
• Firm financial records, trust account documentation, and operating account statements
• Templates, clause libraries, and custom forms built up over years of practice

Any one of these categories can become the critical file in a matter or a bar inquiry. Backup that cannot produce a specific version from a specific date is not adequate protection for a working law practice.

Where backup gaps hide in a law office

• Practice-management and DMS platforms treated as the backup. Clio, MyCase, and NetDocuments store your data on their infrastructure, but that is not the same as an independent backup you control. Accidental deletion, permission errors, or a vendor-side incident can remove data from a platform without giving you a path to recover a prior version on your own timeline.
• OneDrive or Dropbox sync mistaken for backup. Cloud sync mirrors whatever is on your device. If a file is deleted or overwritten on one machine, that change propagates to the cloud copy, often within seconds. Ransomware that encrypts your local files will encrypt the synced copy too. Sync and backup are different things. See our page on cloud sync vs backup for a full comparison.
• Local scans and originals living on one machine. A reception desk scanner, a paralegal's workstation, or a conference-room PC often holds documents that exist nowhere else. If that machine fails before the files are moved to a shared drive, the documents are lost.
• No tested restore process. A backup that has never been tested is a backup whose reliability is unknown. Many firms discover gaps only at the moment a file is actually needed.
• Email archives left uncovered. PST files stored locally on an attorney's desktop are frequently excluded from network backups because they are large, locked during use, and easy to overlook in a backup scope configuration.
• Single point of knowledge after staff turnover. When the one person who configured the firm's backup leaves, the knowledge of what is covered, where backups go, and how to restore often leaves with them.

A backup standard for small law firms

The points below reflect CISA small-business backup principles and the #StopRansomware campaign guidance, adapted to the practical realities of a law office. They are a starting framework, not legal or compliance advice. Your obligations to clients and your bar are separate and are yours to determine with qualified advisors.

• Maintain a separate, off-site copy. The 3-2-1 principle calls for at least three copies of data, on two different media types, with one stored off-site. A backup that lives only on the same network as your workstations does not meet this standard.
• Retain enough version history to catch delayed discovery. Ransomware and accidental deletions are often not noticed for days or weeks. A backup window of only 24 to 48 hours may not let you recover a clean version of affected files. CISA recommends backup retention sufficient to recover from delayed-detection events.
• Encrypt data in transit and at rest. Client files contain confidential information. Backup data should be encrypted before it leaves your environment and remain encrypted in storage.
• Monitor backups and receive failure alerts. A backup job that fails silently leaves you with no coverage and no warning. Monitoring that flags missed or failed jobs is a baseline requirement, not an enhancement.
• Test restores on a regular schedule. CISA explicitly recommends periodic restore testing to verify that backups are usable. A quarterly spot-restore of a sample of files across different backup sets is a reasonable starting cadence for a small firm.
• Name a recovery owner and maintain a priority file list. Someone in the firm should know what is backed up, where it is, and how to initiate a restore. A documented list of the highest-priority file categories speeds up recovery when time pressure is highest.

For additional context on preparing for ransomware scenarios specifically, see ransomware restore readiness and the small-business backup checklist.