Lawyers have financial, ethical and humanitarian reasons to protect their colleagues, staff and clients from the consequences of disasters and can make plans to minimize any negative outcomes of those disasters.
During his Friday panel at the ABA Techshow 2021 titled “Rebooting a Practice: Disaster & Continuity Planning,” attorney Richard Ferguson pointed out that lawyers always have to deal with and plan for disaster, such as data hacks and hurricanes. This last year saw additional disruption caused by the COVID-19 pandemic, resulting in unprecedented changes in social and business operations and forcing legal and justice systems online.
“Those disaster responses that gave rise to the way we’ve been doing business for the last 12 months seemingly came out of nowhere, but the reality is, thanks to systems planning they were able to happen and we were able to support our clients and our society during this pandemic,” said Ferguson, who practices with Lynass, Ferguson & Shoctor in Edmonton, Alberta, Canada. “Chances are we are never going to go back.”
Ferguson explained that business and disaster continuity plans outline how law firms expect their practices to function despite any disruptions. He contended that large firms are more likely to have plans for disaster recovery and business continuity than small firms and solo practitioners. According to data from the ABA Law Practice Division, 86% of large law firms have disaster and continuity plans compared to only 20% of solo practitioners.
Ferguson provided several practical tips for preparing disaster and continuity plans. He recommended that lawyers, with the support and involvement of key members and staff, create plans with the firm’s unique geographical risks in mind, such as if they’re located in a flood-plain or in an area known for earthquakes. He said law firms should consider creating different plans for different disasters and review and update them regularly.
“You can have one plan for if you have a disaster to your network, computer system and a very different plan for a natural disaster,” he said. “You will have a different plan for if someone comes into your office and is wanting to take a hostage. So, develop series of plans to address each of those issues.”
Ferguson also stressed that law firms are inviting disaster if they don’t implement guidelines to secure their data and their clients’ data. He suggested they advise their employees against using public Wi-Fi and train them to identify spoofing and phishing emails that could compromise their network.
He said law firms should be mindful of physical security, ensuring that servers aren’t easily accessible to visitors and hard copies of software and data are locked up on site. He also recommended taking an inventory of all technology and consider placing tracking devices on major components.
Ferguson highlighted other electronic elements that should be included in disaster and continuity plans. He said law firms should encrypt client data—whether it’s stored in the cloud, on a computer or on portable devices—and have policies requiring strong passwords or two-factor authentication.
He also suggested that law firms back up their data to several locations—the cloud, an onsite data bank and an offsite data storage location—and frequently test their recovery capabilities.
“If anything, this pandemic has underscored the need and requirement for virtual databases, for paperless offices where people can access that information from anywhere on nearly any device and know that they can all share and rely on it,” Ferguson said.
He directed lawyers to the ABA Committee on Disaster Response and Preparedness, which offers additional resources on disaster and business continuity planning, including a guide and sample plans. It also includes information from the Federal Emergency Management Agency on how to respond to the COVID-19 pandemic.
In closing, Ferguson said solo practitioners and leaders of small firms need to consider who should represent them in business matters or with clients if they die as a result of a disaster.
“We always advise clients that if you make a will, say who is going to take care of things,” he said. “Well, you want to address who is going to take care of things in the context of your law firm and your law practice. Because if you die and don’t leave someone in a position of authority, that too is now its own special disaster.”