The operating question
If the lawyer, clerk, administrator or technology provider who normally handles a matter is unavailable tomorrow, can an authorized person regain access and keep the file moving without guessing?
Law-firm continuity is often described as disaster recovery. It is also a routine operating issue. People take vacations, become ill, change firms, lose devices or become unavailable during a deadline. A provider can have an outage, an account can be locked and a recovery code can be sitting in one person’s phone.
For an Ontario law firm, the goal is not to give everyone unrestricted access. It is to preserve appropriate access, confidentiality, accountability and recovery when the normal path is unavailable.
The Law Society of Ontario’s technology guidance places technology inside existing professional responsibilities. Digital continuity is therefore part of competent, supervised and confidential practice.
What continuity means in a law firm
Continuity means the firm can identify priority systems, the authorized people who can reach them, the recovery method for each system and the decisions required when something fails.
- business email and Microsoft 365 or Google Workspace;
- practice-management and document systems;
- electronic signatures, identity verification and transaction platforms;
- accounting, trust accounting, banking and payment services;
- court, filing, conveyancing and client portals; and
- backup, archiving, IT and records providers.
Each system has an owner, an administrator, a recovery route and a different consequence if access is lost. “The IT company handles it” is not a continuity plan.
Five questions every firm should answer
1. Who owns the account?
Record whether the firm or an individual controls the domain, cloud tenant, billing relationship, administrator accounts, recovery email and MFA methods. Business-critical ownership should not remain tied to a former employee’s personal address or a provider’s private account.
2. Who can act when the normal person is unavailable?
Identify another authorized person for critical systems. That person does not need standing administrator access to everything, but must have a documented way to initiate recovery, reach the provider, access essential records and obtain approval for sensitive actions.
3. Is emergency access controlled?
Emergency access should be limited, logged and appropriate to the situation. Options include named backup administrators, secure recovery instructions, provider escalation contacts or a controlled password-manager process. A shared master password in an unprotected document is not a mature solution.
4. What happens to client information during disruption?
Decide how the firm will communicate if email is unavailable, where the authoritative copy of a document is stored and how a file is transferred between authorized people. Define approved temporary workarounds so urgency does not create an uncontrolled disclosure.
5. What happens when a person or provider leaves?
Offboarding should cover email, cloud accounts, practice-management access, shared files, signing tools, devices, vendor portals, billing, recovery methods and records. Provider offboarding should transfer administrator control, return or export information and remove remote access.
Run one practical continuity test
Choose a specific scenario, such as “the office administrator is unavailable for two weeks” or “the primary Microsoft 365 administrator cannot sign in.” Ask an authorized backup person to show how they would:
- identify the systems and client work affected;
- reach the provider and prove the firm’s authority;
- access needed records without an unsafe workaround;
- communicate if normal email is unavailable;
- record what happened and what decisions were made; and
- restore normal ownership and remove temporary access.
The test should not disrupt client work. It should reveal whether the recovery path exists outside one person’s head.
Where AI fits
When a firm uses AI, document-management integrations or outside platforms, ask the same questions: what information is involved, who can access it, what the provider does with it, how outputs are checked and how the use is recorded. For the AI-specific side, see AI guidance for law firms in Belleville, Quinte and Eastern Ontario and Microsoft Copilot and law-firm client files.
Where CyberTECT fits
CyberTECT can help an Ontario law firm map critical systems, confirm business ownership, document provider and key-person dependencies, review emergency access and build a continuity record. Start with the Digital Operations Checkup or discuss Break-Glass Readiness when the central question is whether the firm can regain control under pressure.
Frequently asked questions
Why is digital continuity a law-firm issue?
Law firms depend on email, document systems, practice-management platforms, signatures, accounting, banking and outside providers. A single-person dependency can interrupt client service when access fails.
Should every employee receive administrator access?
No. Continuity requires appropriate backup roles and documented recovery routes, not universal privilege. Use least-privilege access.
What should be reviewed when a lawyer or staff member leaves?
Review email, cloud accounts, practice-management access, shared files, devices, signing tools, banking and vendor portals. Transfer business ownership, preserve required records and remove unnecessary access.
Start with one critical system
Review who owns the firm’s email, document platform or practice-management system, then test the backup recovery route.
Authoritative sources
- Law Society of Ontario – Using technology
- Canadian Centre for Cyber Security – Developing your business continuity plan
- Canadian Centre for Cyber Security – Baseline cyber security controls
General operational information only. This article does not provide legal, privacy, professional-conduct or regulatory advice.
CyberTECT resources provide general operational guidance. They do not replace advice specific to your legal, regulatory, contractual or technical circumstances.