Build a Small Business Disaster Recovery Plan

A disaster recovery plan is critical for the health of every small business, yet only 30% have one. I believe this is because business owners don't have a clear idea on what needs to be done.

The main purpose of any business continuity plan is to protect business critical data from being lost. Successful plans focus on keeping this business critical data backed up and accessible at all times.

What is Business Critical Data?

Business critical data includes information your business could not recover if it were lost. Any small business disaster recovery plan should focus on keeping this irreplaceable data safe. That data might include:

• Customer information
• Email correspondence
• Financial records and information
• Sales and shipping records
• Insurance, vendor and employee contact information
• LAN and WAN Network diagrams and IT vendor service level agreements
• Telephone service level agreements
• Drawings or Specification documents
• HR records
• Video or audio records
• Procedures and Policies
• Quality and product tracking records
• Inventory records
• Certificates and Licenses
• Security information
• Manuals, books and other products created for and by your business
• Offsite storage indexes which include what is stored off site, where it's stored, and when it was updated

How Do Businesses Lose Critical Data?

The ways in which business critical data can be lost vary. Use the list below to determine which are most likely to occur to your business and prepare accordingly. Loss factors might include:

• Human error
• Computer virus attack
• Server software or application software bugs
• Computer hardware failure
• Fire, smoke or water damage
• Power outages
• Employee theft or fraud
• Man-made disasters such as sabotage, hacking or viruses
• Natural disasters such as earthquakes or hurricanes

Some DR Questions for Which You Should Have an Answer

Here's a list of questions that will help you in building a customized and comprehensive disaster recovery plan for your business:

• What types of disasters might we encounter?

• What parts of our business need to be operational as soon as possible following a disaster?

• Could we relocate our business temporarily? If so, where?

• Who are our key personnel? What are their roles in our disaster recovery plan?

• How will we communicate with our employees if the telephone and email are not available?

• What service level agreements do we have with our server and computer vendors?

• What types of disaster damages will our business insurance cover? Should we update our policy?

• How will we finance the costs of recovering from a disaster?

• Do we have current backups of our business critical data? Does that backup include data stored on laptops used by sales or traveling employees?

• Is our backup data stored off site on a daily basis?

• How would we access our critical business applications should our main office be inaccessible? Are server, desktop and other applications stored off site?

• How much data could we afford to lose between backups?

• Do we have an alternative backup source? Do we want to consider alternative solutions such as a redundant server in a secure location at least 50 miles from our main work site?

• How long could we function without a connection to our customers?

• What data will we need the day after a disaster? Where is it and how would we access it?

• How will we route telephone calls should our location be inaccessible?

• How will we communicate via and manage email should our location be inaccessible?

• What data is stored off site, where is it stored, and when was it updated?

• How detailed should we make our DR plan?

Disaster Recovery Plans for Different Types of Disasters

A server crash disaster is a very different event when compared to the total destruction of your business by a hurricane. Your disaster recovery plan should have different response action plans to different disaster scenarios. For instance, your plan might have different steps to recover from a variety of scenarios such as:

• Your main server crashes, and has to be rebuilt from scratch.

• Your business location is intact, and your server can be access remotely, but you can't get to your physical location for some reason.

• Your business location is destroyed by a fire, earthquake, bomb or flood.

• Your business is vandalized. Servers and computers are destroyed and data is stolen.

Critical DR Preparation Tasks You Should Do Now

Disasters aren't always hurricane sized. A poorly timed server crash can do as much damage, and is more likely to occur. The tasks listed below should help you get started on building a disaster recovery plan that will keep your business critical data safe in any type of disaster.

• Make sure you get a full backup of all of your electronic files, email messages, and any other irreplaceable customer data every night. Don't forget to back up laptops that traveling employees are using. Critical customer data is often stored on these assigned laptops.

• Make sure these backups are moved to an off site storage facility on a daily basis.

• Rotate and catalog your back up tapes on a weekly basis, and replace them every so often with new tapes.

• Run a restore test on that data at least once a month. If you can't restore the data that has been backed up, it won't do you much good.

• Keep your backup hardware up to date. Nothing would be worse than having current back up tapes, experiencing a disaster and the loss of your tape drive, then finding that the technology is so out of date that you can't buy another similar tape drive to read those tapes.

• Make a list of all of your operating systems and applications and include the version numbers, license numbers and configuration details. Consider creating a "run book" which includes this information plus screen shots of the configuration screens of your backup software, firewall setup and network drives, at least. The run book should also include details about specific IT activities, for example, how to load operating systems, install desktop software, access and synchronize databases, make configuration changes, restore files from tape, create new user accounts, any special needs for each application, and the personnel who know how to do these tasks. Make a copy and store one off site.

• Store all of your backup tapes and business critical software and manuals at your off site facility. Remember to include copies of software purchased online and downloaded on all computers and laptops. Also, remember to update these when you upgrade your operating systems and software.

• Check the security and accessibility of your off site storage. Who has keys, what are their business hours and will they be available if an area wide disaster occurs?

• Review your IT and phone service level agreements and compare them with your business needs. If a server crashes, can you live with a 12 hour response time from the vendor?

• Enforce procedures that ensure your data and data equipment are secured physically and electronically via controlled access doors and Internet firewalls.

• Consider buying several emergency laptops. On these laptops, install and configure your business critical applications and then store them off site. Test and use them periodically and remember to keep them updated as your business software changes.

• Create a document that includes locations for where to set up alternative office space, who to contact immediately after the disaster, and where to get new servers and computers. Include all business critical contacts, such as your employee's home numbers, your insurance agent, telephone company, Internet broadband provider, IT consultant, and the post office. Having this information will help immensely if you have to transfer your critical services to a new location.

• Review your insurance policy. Does it provide for loss of income after a disaster? What kinds of disasters are covered?

There's a great kit of disaster recovery plan forms for gathering critical information on the Pennsylvania Small Business Development website. The kit was developed by the Institute for Business & Home Safety. There's also a shorter Emergency Checklist that is helpful. Click on the links below to download these documents.

Open for Business DR Forms Kit

Emergency Checklist

I hope this information helps you build a useful disaster recovery plan for your small business.

I’m done with this Disaster Recovery Plan page, take me back Home