Disaster Recovery Plan for Small Business: A Simple Template
A disaster recovery plan is the written answer to a simple question: what do we do when the systems are gone? Gone because the server failed, because ransomware encrypted everything, because the office flooded, because the power has been out for two days, or because the person who knew all the passwords is in hospital. Most small businesses have the pieces of an answer scattered across a few heads and an old email. This article is a template that puts them on paper in an afternoon. It replaces an earlier list of tips with something you can actually fill in, and it is the document our business continuity planning service produces with clients.
Before you start: three numbers per system
For each system the business depends on, decide three things. How long you could be without it (the recovery time objective). How much work you could stand to redo (the recovery point objective). And its priority relative to the others, because everything cannot come back first. A typical office lands on “email and phones within hours, the accounting and line-of-business systems within a business day, everything else within two days.” Write those numbers down; they decide how the backups are built and what the plan costs. Our backup guide explains how the numbers translate into a backup design.
The template
1. Contacts and roles
Who declares a disaster and starts the plan. Who runs recovery (usually the IT provider). Who talks to staff, who talks to customers, who calls the insurer and the bank. Home and mobile numbers for each, and a deputy for each role. This section is the one that matters at 6 a.m. on a Sunday.
2. Systems inventory
| System | Where it lives | Priority | Recovery time | Recovery point | Depends on |
|---|---|---|---|---|---|
| Email and calendars | Microsoft 365 | 1 | 4 hours | 1 hour | Internet, identity |
| Phone system | Hosted provider | 1 | 4 hours | n/a | Internet or mobile app |
| Accounting | Hosted server or vendor cloud | 2 | 1 business day | 4 hours | Identity, database |
| Line-of-business application | Server in office or hosting | 2 | 1 business day | 4 hours | Server, database, file share |
| Shared files | SharePoint | 2 | 1 business day | 4 hours | Identity |
| Workstations | Office | 3 | 2 days | 1 day | Identity, network |
| Website | Web host | 3 | 2 days | 1 day | DNS, registrar |
Replace the rows with your own. Under a managed plan this inventory already exists; ask your provider for it rather than writing it from memory.
3. Backups: where they are and how to reach them
For each system in the inventory: what is backed up, how often, where the copies are (local appliance, cloud service, immutable copy), how long they are kept, and how to log into the backup service, with the credentials sealed and stored where the disaster cannot reach them. Include the date of the last successful test restore. If this section is hard to fill in, that is the finding.
4. Recovery procedures, in order
Step by step, for the scenarios that matter to you: a failed server, ransomware, a lost office, a cloud account takeover, a long power or internet outage. Each procedure names the order (identity and network first, then the priority-1 systems, then the rest), where each system is restored to (the same hardware, replacement hardware, a hosted server, a cloud virtual machine), who does each step and roughly how long it takes. For ransomware, the procedure starts with containment and closing the entry point before any restore; our article on what to do when infected with ransomware is the detailed version, and the incident response plan covers the breach side.
5. Workarounds while systems are down
How orders are taken, customers are answered and payroll is run when the systems are not there. Paper forms, a spare laptop with mobile internet, the phone system’s mobile app, a bank contact who can process payroll from a spreadsheet. These are the difference between a business that is inconvenienced for two days and one that stops.
6. Communications
What staff are told and how, since email may be the thing that is down: a group text list, a phone tree. What customers and partners are told, in a pre-written short message. Who is authorised to speak publicly, and that nobody else does. What is reported to the insurer, and when: most policies require notice within hours of a cyber incident.
7. Alternate workplace
Where people work if the office is unusable: from home with the cloud systems, at a second location, or at a client’s spare space. What each person needs to do that: a laptop, a phone app, a VPN or zero-trust connection, a printed copy of this plan.
8. Vendors and insurance
Account numbers and support numbers for the internet carrier, phone provider, backup service, cloud provider, hosting, software vendors, the landlord, the electrician and the insurer, with the policy number and the incident hotline. Cyber policies come with a response firm and counsel; the number is in the policy and belongs on this page.
9. Testing schedule and log
Monthly file restore, quarterly server restore to a test location, annual tabletop walk-through of the whole plan with everyone named in it. A log of each test with the date, who ran it, what worked and what was fixed afterwards. The log is what an insurer or auditor asks to see.
10. Review
The plan is reviewed after every test, after any incident, and whenever a system, a vendor or a person in it changes. A plan more than a year old is a draft.
Scenarios worth walking through
- Ransomware on a Friday night. Who notices, who isolates, who calls the insurer, how long until the priority-1 systems are back from the immutable copy.
- The server room is under water. Where the systems come back (a hosted server, a cloud virtual machine) and how people work from home meanwhile. Our hosting and colocation service exists partly for this scenario.
- A two-day power outage in January. Cloud systems keep working; the office does not. Who has laptops and where they go.
- The Microsoft 365 tenant is compromised. Who has the emergency administrator account, how sessions are revoked, what is restored from the tenant backup.
- The one person who knows everything is unavailable. Whether the plan, the passwords and the vendor contacts exist anywhere else.
How we build this with clients
Under a managed plan the inventory, the backups and the recovery procedures are ours to maintain, and the plan is written with you during onboarding and tested on the schedule above. For businesses that are not clients, our business continuity planning service produces the document and runs the first test, and the backup pricing calculator gives the monthly figure for backups that can actually meet the recovery numbers you choose. The cyber insurance readiness check shows how the plan maps to the questions insurers ask.
Free tools from OAC Technology
- Cloud backup pricing calculator: a monthly figure for server and Microsoft 365 backups
- Cyber insurance readiness check: fourteen questions insurers ask, scored in a minute
- Managed services pricing calculator: a monthly figure for managed IT, in about a minute
Common questions
What is the difference between disaster recovery and business continuity?
Disaster recovery is the technical plan for getting systems and data back. Business continuity is the wider plan for keeping the business operating while that happens: where people work, how orders are taken by hand, who talks to customers. A small business usually writes both in one document, with the recovery section being the longer part.
How often should we test the plan?
Restore a file monthly, restore a whole server to a test location quarterly, and once a year walk through the entire plan as a tabletop exercise with the people named in it. Plans that are never tested contain a surprise, and the surprise is found during the disaster.
What recovery time should a small business aim for?
Most businesses can stand a day without their systems and cannot stand a week. For a typical office, restoring critical systems within eight business hours and everything within two days is achievable and affordable. A medical practice, a busy accounting firm in season or a manufacturer may need hours, which costs more and is worth deciding on purpose.
Do we need a plan if everything is in the cloud?
Yes. The cloud removes the failed-server scenario and adds others: an account takeover, a deleted tenant, a provider outage, ransomware syncing through OneDrive, an internet outage at the office. The plan is shorter but the questions are the same: what do we restore, from where, and how do we work in the meantime.
How long does it take to write?
An afternoon for a first version using this template, with the systems inventory from your IT provider. It gets better each time it is tested. A plan that exists and is imperfect is far more valuable than a perfect one that is still being written.
Does cyber insurance require a plan?
Most applications now ask whether a written incident response or disaster recovery plan exists and when it was last tested. Answering yes truthfully requires this document and a date.
Talk to us
If your business does not have a written recovery plan, or has one nobody has tested, we will build the inventory, fill in this template with you and run the first restore test. Call 952-548-5558 or contact us; the first conversation is free and there is no long-term contract.
