Mike Tyson once said, "Everyone has a plan until they get punched in the mouth." In business, that punch usually comes as a disruption you assumed you were ready for.
For a lot of downtown firms, that day was December 25, 2020, when the RV bombing on Second Avenue took out an AT&T switching facility and knocked phones and internet out across Middle Tennessee for days. Firms with hearings that week, closings mid-signature, and filing deadlines that don't move for anybody found out fast which parts of their plan were real and which were just assumptions.
Assumptions feel like facts right up until they're tested. Here are four that catch law firms off guard more than any others.
We're Backed Up
Most firm administrators can point to where client files back up. Fewer can say when someone last restored a file from it, how long that restore actually took, or whether it covered everything in the practice management system, not just the shared drive.
An untested backup is a lot like a will nobody's reread since it was signed. You assume it says what you think it says. You find out otherwise on the day someone actually needs it, and for a law firm that day is usually a closing, a filing deadline, or a client who wants their file right now.
A backup only proves its value the moment you're recovering from it, which is exactly why testing matters more than the backup itself.
Someone Would Tell Us If There Was a Problem
A lot of firms invest in monitoring tools that are genuinely good at one thing: telling you something's wrong. What happens after that alert fires is still up to the people in the room.
A smoke detector doesn't put out the fire. It tells you there is one. Your monitoring platform works the same way, and a malpractice carrier's security questionnaire confirming you have detection in place doesn't tell you whether client files were already gone by the time anyone actually saw the notification.
Our Team Knows What to Do
Late on a Friday afternoon, the practice management system goes down and nobody can agree on who's in charge, what to check first, or what to tell the attorneys with hearings Monday morning. When there's no documented plan and no practice run, even a good team is starting from zero at the worst possible time.
Firms that run fire drills don't do it because they expect flames. They do it so nobody's asking which stairwell to use once the alarm actually goes off. A recovery plan works the same way. Attorneys and staff should already know their role before a system goes down, not figure it out live while a deadline closes in. Chaos rarely comes from the outage itself. It comes from nobody knowing what to do next.
It Won't Happen to Us
Nobody expects to be the firm that loses a settlement to a spoofed wiring instruction. Then an associate replies to what looks like a routine email from opposing counsel, and the funds are gone before anyone notices.
Most disruptions aren't dramatic. A phishing email gets clicked, a hard drive fails, the power blinks during hearing prep. The firms that recover fastest aren't the ones that avoided a disruption. They're the ones who expected one eventually and built a plan around it.
That expectation matters even outside a crisis. Corporate clients, especially the health systems and insurers based here, increasingly ask outside counsel to attest to specific security controls as a condition of the engagement. A firm that's never tested its own recovery plan is guessing at that attestation, not answering it.
(Note: the exact ethics rules governing a lawyer's duty of technology competence vary by state — Tennessee follows the ABA framework, but the specific rule number and language should be confirmed with the firm's ethics counsel. We're IT nerds, not attorneys.)
You Can't Prepare for a Disruption You've Already Decided Won't Happen
In our experience, it's rarely the dramatic event that catches a firm off guard. It's the ordinary Wednesday nobody saw coming. Most of these risks can be found and fixed before they become a client-facing problem, and that's exactly where we start with the law firms we work with.
We offer a free, no-obligation consultation. No sales pitch, just a real look at your backups, your disaster recovery plan, and whether your team actually knows what to do when something goes wrong.and find out before an outage forces the question.
Schedule Your Free Consultation!
