A small-business disaster recovery plan must restore your critical services and data within targets you set in advance, and it starts by identifying the services you cannot run without, securing encrypted offline backups, and naming an incident lead who can activate the plan. Ready and CISA publish the guidance, and our team at NelSec Consulting can help you apply it.
TL;DR:
- Prioritize services by business impact and set restoration and data loss targets; an RPO of four hours requires backups every four hours or more often.
- Keep three data copies across two media or locations, including one offline copy; restrict access and test restores regularly to guard against ransomware.
- Name an incident lead, technical recovery owner, business approver, communications owner, and offline vendor contacts; define who activates the plan and authorizes each restoration.
- Hold quarterly tabletop exercises lasting 60 minutes, test partial restores twice yearly, and complete an annual full restore; update the plan after every test.
- Review insurance exclusions annually: a business owner’s policy does not cover flood damage, and business interruption or cyber coverage depends on policy terms.
Table of Contents
- What a disaster recovery plan for a small business must include
- How do you identify critical services and set RTO and RPO?
- Backups and data protection: rules that survive ransomware
- Roles, decision authority, and communications during recovery
- How often should you test and update the plan?
- Insurance, financial recovery, and outside help
- A simple disaster recovery plan template and checklist
- Where a small-business IT partner fits
- NelSec Consulting: help building and testing your recovery plan
- FAQ
- Sources
What a disaster recovery plan for a small business must include
Ready.gov says a small-business plan should name critical functions, recovery priorities, responsible people, recovery strategies, communications, and procedures for restoring hardware, applications, data, facilities, and operations. In practice, that means building these pieces:
- Scope and objectives: what the plan covers, who the primary contacts are, and where copies live.
- A complete inventory: servers, laptops, phones, applications, data, paper records, vendors, and the dependencies between them.
- A prioritized recovery list: which services come back first, and why that order protects revenue.
- Step-by-step procedures: short checklists for likely events such as ransomware, a power outage, flooding, or equipment failure.
- Storage and access rules: online and offline copies, and exactly who can open each one.
Organize the plan around business services, not a flat list of devices. "Taking customer payments" depends on a point-of-sale app, a network connection, a payment vendor, and a person who knows the login. Map those links and the return order becomes obvious.
How do you identify critical services and set RTO and RPO?
A business impact analysis asks one question per service: what happens to us if this service is unavailable? Its output is a ranked list with recovery targets attached. Follow these steps:
- List every service your business runs on, such as email, accounting, scheduling, and file storage.
- Rate the damage of an outage in lost revenue, missed obligations, and customer trust.
- Set the RTO, the target time to restore the service.
- Set the RPO, the maximum recent data you can afford to lose. Ready.gov gives a clear example: if you can lose no more than four hours of data, your backups must support an RPO of four hours or less.
- Sort services into tiers. The University of Michigan's planning guidance uses service tiers mapped to RPO and RTO ranges. A simple version is to prioritize services by business impact, then set backup and restoration targets for each service.
Backups and data protection: rules that survive ransomware
Backups only count if they restore. CISA advises automated, scheduled backups, a mix of on-site and remote protection, encryption and access controls, and offline or isolated copies. It also warns that recovery without backups can take weeks or months, or be impossible.
The 3-2-1 rule is the workable baseline:
- Three copies of your data: the live version plus two backups.
- Two different media or locations, such as a local drive and a cloud service.
- One copy offline or air-gapped, because malware that finds an attached backup can encrypt or delete it.
- Restricted access: only a few named people can reach backup systems, and credentials differ from daily logins.
- Restore testing: run partial restores often and a full restore on a schedule, verify file integrity, and keep incremental rollback copies where they fit your data.
Pro Tip: Keep a physical "go-bag" with recovery credentials, software licenses, and offline system images. NCCoE guidance recommends exactly this, since your password manager may be the thing that is down.
Roles, decision authority, and communications during recovery
A restore can finish technically and still stall because nobody was authorized to resume operations. NIST treats recovery as a management responsibility: leaders approve authority and priorities while technical staff execute. CISA recommends documenting the following roles:
- Incident lead: declares the event and activates the plan.
- Technical recovery owner: isolates systems and runs restores.
- Business decision-maker: approves restoration actions and spending.
- Communications owner: speaks to employees, customers, and partners with one consistent message.
- Vendor and legal contacts: your IT provider, insurer, attorney, and software vendors, with phone numbers that work offline.
Write down who can activate the plan and who approves each restoration step. Then keep a short notification list: employees first, then customers and partners affected by the outage, then law enforcement and regulators where a legal duty applies.
How often should you test and update the plan?
Plans that nobody exercises age quietly. A realistic cadence for a small business:
- Quarterly: a 60-minute tabletop exercise where the team talks through a scenario and CISA recommends reviewing the incident response plan on the same schedule.
- Twice a year: a partial restore of a critical system or folder set.
- Annually: a full restore of your top-tier services to clean hardware or a cloud environment.
Tests reveal the surprises: how long cloud files take to download, how long a rebuild really runs, which staff member did not know their role. SBA says to record lessons learned and update the plan after every exercise or incident. Capture the timeline, what failed, and who owns each fix in an after-action report, the practice the NIST Quick-Start Guide describes for the Recover function. Then adjust your RTO and RPO to match what the test proved.
Pro Tip: Run tests during low-impact windows, such as a weekend morning, and invite your vendors so their response times get measured too.
Insurance, financial recovery, and outside help
Money decisions belong in the plan before the event. Review these with your agent:
- Business-interruption coverage: may help with bills and some lost profit, depending on the policy.
- Cyber coverage: confirm what it pays for after ransomware or data loss.
- Property coverage: the SBA notes that a business owner's policy does not cover flood damage, so check exclusions and limits every year.
- Federal and local help: the SBA's recovery guidance points to disaster loans plus SBDC and SCORE advisors for resilience planning and post-disaster support.
Photograph damage, keep invoices, and log outage times as they happen. Documentation and timely claim filing are what turn coverage on paper into money in hand.
A simple disaster recovery plan template and checklist
Copy this into a document and fill in each line. It is a starting point you can use today.
One-page recovery checklist
- Critical services, ranked, each with its RTO and RPO
- Incident lead, backup lead, and phone numbers for every role
- Backup locations (cloud, local, offline) and who can access each
- Vendor, insurer, and legal contacts
Initial response
- Isolate affected devices from the network and call the incident lead.
- Notify your recovery team and your IT provider.
- Confirm which backups are clean before restoring anything.
- Restore the top-tier files and services first.
As recovery progresses
- Bring backup systems online for gold and silver services.
- Update employees and customers on status and next steps.
- Start insurance documentation.
Keep the plan in two places: an online copy and a printed one. Attach a password list, vendor contacts, and system images so nothing depends on a machine that might be down.
Where a small-business IT partner fits
I work with NelSec Consulting, and in our experience the gap is rarely knowledge. It is time. A managed IT partner can run the assessment, write the playbook, schedule restore exercises, and answer the phone when something breaks. Outside help pays off most when you have no one internal who can lead a restore.
— Devon
NelSec Consulting: help building and testing your recovery plan
We help small businesses and nonprofits turn this checklist into a tested plan. Our team covers backup and disaster recovery planning, network security, IT support, and restore testing, all explained without jargon. We start with a free initial assessment and keep our pricing transparent, so you know what you are paying for before work begins. See our services page to book your assessment.
FAQ
What are the key components of a disaster recovery plan?
A solid plan has an inventory of systems and data, a ranked list of critical services, RTO and RPO targets, backup and restore procedures, named roles, and a communications plan. Ready.gov also recommends keeping an offline or printed copy.
What are RTO and RPO in disaster recovery?
RTO is the target time to restore a system or business function. RPO is the maximum amount of recent data you can afford to lose, so a four-hour RPO means backups must run at least every four hours.
What are some examples of disaster recovery?
Examples include restoring files from an offline backup after ransomware, rebuilding a server from a saved system image, and moving operations to cloud services after a flood closes your office. Each works only if the backup was tested beforehand.
How often should a small business test its disaster recovery plan?
Exercise the plan and test partial and full restores on a regular schedule that suits your business. Update the plan after every test or major business change.