Build a Legal-Notice Backup Before a Vendor Goes Offline
Matthew Leo · Published October 23, 2026 · Guides
A cyber incident at a single contractor halted the production and distribution of bankruptcy notices across the U.S. federal court system. The outage is American, but the dependency problem is familiar to Canadian legal, compliance and regulated operations teams.
BAE Systems operates the Bankruptcy Noticing Center for the U.S. judiciary. The Administrative Office of the U.S. Courts said the incident made the centre’s systems and websites unavailable and stopped notices for bankruptcy courts nationwide. Independent reporting described courts adopting different emergency measures while restoration work continued.
The lesson is not to duplicate every vendor platform. It is to know which deadline-critical obligations become invisible when one provider stops sending messages.
Start with obligations, not applications
A useful continuity inventory names the business obligation first:
- Which notice, filing, service or acknowledgement must occur?
- Who is legally responsible for it?
- What starts the deadline?
- What evidence proves it was sent, received or filed?
- Which external system supplies the trigger or proof?
An application list alone can miss the real dependency. A team may still have email while the vendor that generates the underlying notice is offline.
Make a deadline-critical notice register
For every high-consequence notice stream, record these labelled fields:
- Notice type: the event or document being monitored;
- Authoritative source: the court, regulator, counterparty or internal system that creates it;
- Normal delivery: portal, email, API, mail or managed service;
- Backup check: the approved alternate source and who checks it;
- Review frequency: how often the alternate is checked during an outage;
- Evidence: the receipt, timestamp, screenshot or registry entry retained;
- Escalation: the lawyer or accountable owner who decides what to do when information is incomplete.
Do not invent a substitute filing or service method. Court and regulatory rules differ, and an emergency workaround that is acceptable in one jurisdiction may be rejected in another.
Set an outage trigger before the outage
A continuity plan should define when manual checking begins. Suitable triggers might include a vendor status notice, a missing scheduled delivery, repeated login failure or a known incident affecting the provider.
The trigger should produce an assigned action, not a group message asking whether someone is watching. Name a primary owner, a backup owner and an escalation time.
Canada’s Cyber Centre recommends identifying critical data, applications and processes, defining recovery responsibilities and setting recovery-time objectives. For notice operations, the recovery objective should reflect the shortest material deadline, not the vendor’s preferred service target.
Preserve proof without creating a second risk
During an outage, teams often spread sensitive documents across personal inboxes, chat threads and local drives. That can solve the immediate visibility problem while creating privacy, privilege and retention problems.
Use an approved repository for the outage log. Record the source, time checked, person responsible, result and next review. Keep access limited to the people who need it. If a document was originally signed, certified or commissioned on paper, retain the original where the applicable court direction requires it.
Test the plan with one missing notice
A short exercise is more revealing than a long policy:
- Select one deadline-critical notice stream.
- Assume the vendor portal and alerts are unavailable for 24 hours.
- Ask the backup owner to locate the authoritative event without help from the normal system.
- Measure how long it takes to confirm the deadline and preserve evidence.
- Record every permission, contact and instruction that was missing.
- Update the register and repeat the test.
For Canadian court work, follow the current direction for the specific court and case. Ontario’s Court of Appeal, for example, provides contact routes for users who cannot file electronically; other courts and matter types use different procedures. This article is an operational-resilience guide, not legal advice or a substitute for those rules.
Put the obligation in the contract
Vendor agreements should address incident notification, status updates, data return, recovery objectives and cooperation during a transition. The Canadian Cyber Centre’s managed-service guidance specifically asks customers to examine business continuity, disaster recovery and the location of redundant data.
The U.S. outage shows why that language matters. A service can be technically narrow yet operationally national. Your own critical vendor may be less visible until the day it stops.
Sources: the U.S. Courts incident notice, the Bankruptcy Noticing Center service page, the Canadian Cyber Centre’s guides to IT recovery and managed-service risk, and the Ontario Court of Appeal filing page.
Tags: business continuity, cybersecurity, third-party risk, legal technology, incident response