Disaster recovery planning for small business: where to start
Start with a short list of what your business cannot run without, then ask what happens to each item if it disappears for a week. That list, and your answers to it, is the whole first stage of disaster recovery planning. Everything else builds on it.
Step one: list what the business depends on
Most owners picture a fire or a flood when they hear the word disaster, but the events that actually stop a small firm are usually duller. A laptop dies with the only copy of the quotes folder on it. An email account gets locked after a password phishing scam. The internet line goes down and takes the card terminal with it. A landlord cuts the power for a day. Your list should cover all of these, not just the dramatic ones.
Go through the business one function at a time. For each function, write down the systems and resources it needs: email, accounting software, customer files, the shared drive, the booking system, the phone line, the payment terminal, the premises itself. Then add the people. If one person is the only one who knows the login for the bank or the website host, that is a dependency too, and it is one of the most common gaps we see in small firms.
Next, rank the items. For each one, ask two questions. How long could we go without this before customers notice? And how long before we lose money or break a contract or legal obligation? Anything that fails both tests quickly goes to the top of the list.
Step two: set a recovery time and a data loss limit for each item
Two numbers do most of the work in any plan. The first is the recovery time objective, usually shortened to RTO. That is how long you can be down before it really hurts. The second is the recovery point objective, or RPO, which is how much recent work you can afford to lose, measured in time. If your RPO for customer orders is one day, you need a backup at least that often. If it is one hour, a nightly backup will not cover you.
You do not need exact figures. Pick a rough number you could defend to a customer or to yourself on a bad day. For many small firms, email and customer records need same-day recovery on both numbers, while an old brochure website can wait a few days. Writing the numbers down matters more than their precision, because it turns a vague worry into decisions you can actually act on.
Step three: check that your backups actually restore
A backup you have never restored from is a hope, not a backup. Owners often find out during a real incident that the backup job has been failing for months, or that it quietly skipped the folder that mattered most. The test is simple. Pick one important folder, restore a copy of it to a spare machine or a separate location, and open a few files. Time how long the process takes and write that down. It is your real recovery time for that data, and it is often longer than people expect.
Aim for the common 3-2-1 approach where you can: three copies of important data, on two different types of storage, with at least one copy kept somewhere else, such as cloud storage or a drive that lives off-site. Be careful with synced cloud folders in particular. Deleting or corrupting a file in a synced folder can remove it everywhere at once, so you need a copy that does not update automatically along with the original.
What to do this week
Put the dependency list, the two numbers for each item, and your restore test results into one short document, a few pages at most. Store a copy somewhere you can open without your office network, and note who can make decisions if you are unavailable and where the account logins are kept securely.
Then take the item at the top of your list and fix the gap you found. For most small businesses, that is either a backup that has never been tested or an account that only one person can access. Sort that out this week and you will have done more about disaster recovery than most small firms ever do.