Your Next 90 Days: One Baseline, One Workflow Fix, One Outcome

The insight: a quarter can only carry three commitments

Pick one baseline, one workflow fix, and one outcome. That is the whole plan. Not a twelve-item infrastructure audit, not a new platform migration, not a vendor bake-off. Three commitments, one per month, each with a number attached at the end of it.

Law firm owners resist this because three feels small. It isn't. Most firms cannot tell you their site's current error rate, have never actually restored from a backup, and have no idea what their Largest Contentful Paint is on a phone over a real network. A firm that finishes the quarter knowing all three of those things is ahead of almost every competitor in its market — because those competitors also spent the quarter shopping for tools instead of measuring anything.

The source: CISA already narrowed the list for you

You do not have to invent your own security priorities. CISA's small-business guidance prioritizes enforced MFA, patching, tested backups, and removal of unused accounts and services. That is four items, and every one of them is boring, unglamorous, and unlikely to appear in a sales deck.

Notice what is not on that list. No new endpoint suite. No AI-powered threat dashboard. No annual penetration test you will file and never read. The federal guidance for organizations your size is essentially: turn on multi-factor authentication and enforce it, keep software current, prove your backups restore, and delete the accounts and services nobody uses anymore.

The word doing the heaviest lifting in that list is tested. An untested backup is a belief, not a control. Firms discover this at the worst possible moment — the morning the site is down, the intake forms are dead, and someone is on the phone with a host asking how long a restore takes while paid traffic keeps arriving at a broken page.

An untested backup is a belief, not a control. You do not have a recovery plan until you have timed one.

The 90-day sequence

Month one: measure error rate

Establish the baseline before you change anything. Pull server error rates across your site — 5xx responses, timeouts, failed form submissions. You want a number and a trend line, not an impression.

What this usually surfaces:

• Intake forms that fail silently. The form appears to submit; nothing lands in the CRM. Firms in this situation often find the leak only when they compare form submissions against actual intake records for the month.
• Errors concentrated on mobile. A desktop-tested site behaves differently on a mid-range phone on a weak connection, which is exactly the device most of your prospects are using.
• Errors that spike under load. Shared hosting shows this pattern when a neighbor on the same box has a busy afternoon.

Do not fix anything in month one beyond obvious emergencies. The point is the baseline. If you fix and measure simultaneously, you will never know which change did what.

Month two: test a full restore and document the recovery time

This is the workflow fix, and it is the month most firms skip. Restore the entire site to a staging environment from your most recent backup. Time it. Write down the number.

Then write down the things you learned while doing it:

• Who has the credentials to initiate the restore, and what happens if that person is on vacation.
• Whether the backup includes the database, uploaded files, and configuration — or just some of those.
• How far back the retention window actually goes, versus what you assumed.
• What breaks after restore: SSL, DNS, third-party integrations, tracking scripts, call-tracking numbers.

While you are in there, close out the rest of the CISA list. Enforce MFA — enforce, not "make available." Apply outstanding patches. Remove unused accounts and services: the former paralegal's login, the marketing vendor you stopped working with in 2023, the plugin nobody remembers installing. Unused accounts and dormant services are attack surface you are paying to maintain.

The documented recovery time is your deliverable. "We can be back up in 40 minutes and here is who does it" is an operational fact. "We have backups" is not.

Month three: verify the effect on LCP

Now check the outcome. Largest Contentful Paint measures how long it takes for the main content of your page to render — the thing a prospective client actually waits for. Measure it on mobile, on real-world connection speeds, on the pages that matter: your highest-traffic practice area pages, your city pages, your contact page.

Compare against month one. Patching, removing dead services, and tightening the stack often move LCP on their own, because every unused plugin and abandoned script was costing render time. If LCP has not moved, you now know the constraint is elsewhere — server response time, image weight, or render-blocking resources — and you have eliminated three other suspects.

Why late summer is the right window

Q4 demand arrives on infrastructure you already have. Late summer is a useful time to fix the systems that will carry it, because you are working on a site that is not yet under peak load and you have runway to discover problems before they cost you cases.

A firm that runs this plan enters Q4 with a known error rate, a timed and rehearsed recovery procedure, and a verified page-speed number. A firm that skips it enters Q4 with the same site and better hopes.

The discipline this plan actually buys

Here is the underrated benefit: a plan is stronger when it protects focus from new-tool distraction. Between now and December, someone will pitch you a platform that promises to solve all of this. If you have three named commitments with three named months, the answer is easy — "not this quarter." If you have no plan, every pitch sounds urgent, and you end the year with three half-configured tools and zero measured improvements.

This is the same logic that governs scale infrastructure generally. Firms that want to own more cities and practice areas do not get there by trying twelve tactics at once; they get there by building page inventory systematically and letting it compound. The sequencing discipline is identical. One thing, measured, then the next.

Your next step

Before you close this tab, do the smallest version of month one: open your hosting dashboard and find your error rate for the last 30 days. If you cannot find it, or your host cannot produce it, that is your finding — and it tells you something about whether your current environment can support the other two months of this plan.

Then put three dates on the calendar. Month one, error-rate baseline. Month two, full restore test with a documented recovery time. Month three, LCP verification against the baseline. Assign a name to each. A plan with no owner is a wish.

If your current setup cannot give you those numbers — or you would rather run this on infrastructure built for it — see how BOSSEO approaches Dedicated Hosting.