Client files deserve a copy the network cannot reach.

The Canadian Bar Association brings together professional duties around confidentiality, integrity, availability, retention and recovery. Its guidance is international good practice rather than UK regulation, and it maps closely to what SRA, ICO and NCSC sources expect of UK firms.

Preserve integrity

Records must be protected from alteration, corruption and destruction, with recoverable copies of important files maintained.

Keep records accessible

Files must remain readable and usable over the long term, not merely exist somewhere in storage.

Document backup and recovery

A written backup and disaster-recovery plan is part of competent data and file management.

Keep several copies and versions

Multiple backups, staggered at different points in time, rather than reliance on one current copy.

Test that recovery works

The existence of a backup is not enough. Firms should routinely verify that data can actually be restored.

Separate full backups from the network

Connected backups face the same risks as production systems. Guidance recommends moving a full backup off-network, described as air gapped, to a secure location.

Encrypt backup information

Backups should be fully encrypted, at rest and in transit.

Protect copies like originals

Recovery copies must be protected to the same standard as the original information, or the recovery architecture itself becomes a confidentiality risk.

Define recovery objectives

Firms should set a recovery time objective and recovery point objective that reflect obligations to clients and the regulator.

Control third-party risk

Due diligence on providers, clarity on where data is stored, and a preference for services where the firm can hold its own encryption keys.

Retain and delete properly

Keep information for the period professional and statutory obligations require, then destroy it securely. Clicking delete is not sufficient for confidential data.

Know what is protected

A documented approach covering what is backed up, how frequently, who is responsible and which records are recovered first.

CBA guidance states that full backups should be separated from the rest of the network, because connected backups face the same risks as production systems. That is precisely what Firevault is.

Recovery objectives are set by the firm's plan. The storage simply has to honour them without staying exposed.

CBA guidance is persuasive international practice. The obligations that bind UK firms come from the SRA, UK GDPR and NCSC. Firevault supports the controls; the firm and its advisers own compliance.