How to Build a BCDR Plan for Your Small Firm
Almost every firm owner I meet says they have backups. Then I ask how long it would take to get everyone working again if the server died tomorrow, and the room usually goes quiet.
That’s the gap a BCDR plan fills. BCDR means backup and disaster recovery: the copy of your data, plus the plan for getting people back to billable work fast.
The call that shaped how I think about this
A lawyer called us because his email account had been hacked. For a lawyer, that’s about as bad as it gets.
We shut the attacker’s access down completely, cleaned up everything, and restored his data from cloud backup. He was back in business within an hour and a half.
I’m proud of that, but speed wasn’t the clever part. We could move that fast because the backup already existed, it lived in the cloud, and we knew how to restore it. Take away any one of those and that day goes very differently.
Start with what you can’t work without
Write out the systems that would stop billable work if they disappeared. For a law firm that’s usually practice management, document management, trust accounting records and email. Accountants will list tax software, client files, CRA EFILE access and the client portal.
Don’t skip Microsoft 365. Email, OneDrive and SharePoint need their own backup. I’d rather you didn’t find that out the hard way.
Decide how much downtime and data loss you can stomach
Two terms come up here, and they’re simpler than they sound.
Recovery time objective (RTO) is how long you can be down before it really hurts. Recovery point objective (RPO) is how much work you can afford to lose. If the last backup ran at midnight and the server fails at 4 PM, you’ve lost a day.
These numbers move with the calendar. An accounting firm in April has far less patience than the same firm in August. Put a realistic number beside each key system. It drives everything else.
Keep copies in more than one place
One backup drive sitting beside the server isn’t a plan. A fire, a flood, a break-in or ransomware can take out both on the same afternoon.
The Canadian Centre for Cyber Security’s Ransomware playbook (ITSM.00.099) recommends multiple backups in multiple locations, including copies that are offline and can’t be reached from your network, plus a secondary copy in the cloud.
What we usually set up is a local backup for quick restores of a file or folder, plus an offsite cloud copy that survives even if your office doesn’t. The backup system also gets its own admin credentials. If a user account gets hacked, the attacker shouldn’t be able to wipe your backups with it.
Think about where the data lives
If you handle personal information, Canada’s private-sector privacy law, PIPEDA, expects you to protect it with safeguards that fit how sensitive it is. Backups are copies of that same information, so they need the same care.
Plenty of our clients want their backups to stay in Canada, and I agree. We keep client backups in Canadian data centres, which makes the conversation with clients and insurers a lot simpler.
Accountants have one more thing to think about. The CRA’s EFILE program responsibilities ask electronic filers to take proper care to protect the confidentiality of taxpayer information. A lost backup full of client tax files isn’t something you want to explain.
Plan the restore, not just the backup
This is where most of the plans I review fall apart.
If the server’s destroyed, what are you restoring to? New hardware takes time to arrive. We use Datto, which can restore to physical or virtual environments, so a firm can run a virtual copy of its server for a few days while replacement hardware ships, then move back once it’s in. You also need to decide ahead of time who makes the call to start recovery and who tells staff and clients what’s going on.
Test it
An untested backup is a guess. The Cyber Centre’s playbook suggests testing on a regular schedule, for example monthly. Restore a few real files and open them. Once or twice a year, do a full test restore of a key server and time it against the RTO you wrote down. Something usually goes wrong the first time, and I’d much rather find it on a quiet Tuesday than mid-incident.
Write it down and keep it where you can reach it
The plan should fit on a few pages. It covers your critical systems with their RTO and RPO, where backups live and how often they run, who to call (your IT provider, your cyber insurer, key vendors), the order things come back in, and how you’ll reach staff if email is down.
Print a copy, and keep another outside your main systems. A plan saved only on the server doesn’t help much when the server is the thing that’s down.
Firms change. You hire, switch software or open a second office in Markham or Vaughan. Look at the plan yearly and whenever something big shifts.
Get a second set of eyes on your plan
If you don’t know how long it would take your firm to get back up and running, I’d want to find that out before something goes wrong.
Book a free 30-minute call with Midas Tech. We’ll talk through your current backups and recovery setup and send you a written fix-first list, so you know exactly what to tackle first.
Book your free 30-minute call or call us at 1-905-787-2038.