Business continuity and disaster recovery: a small business guide

A backup is not a plan. It is one ingredient in a plan. Business continuity is the bigger question every owner should be able to answer: when something goes badly wrong, a cyberattack, a fire, a key system or supplier going down, a key person leaving overnight, how does your business keep serving customers? Here is how a small business builds an answer that actually fits.

You do not need a thick binder or a consultant. You need to think it through once and write it down.

Three terms, plainly

These get used interchangeably, but they nest inside each other:

• Backup is a copy of your data. It is the raw material of recovery, nothing more.
• Disaster recovery (DR) is the technical plan for getting your systems and data back after a disruption: how you restore, from where, and in what order.
• Business continuity (BC) is the whole-business plan for keeping operating through a disruption, covering your people, processes, communications, and premises, not just the IT. Disaster recovery is the IT chapter of it.

Most small businesses have a backup, some have a rough idea of recovery, and very few have a continuity plan. That gap is where a bad day becomes a closed business.

Start with what actually matters

You cannot protect everything equally, and you do not need to. Start by listing your critical business functions: the handful of things that, if they stopped, would stop the business. For most small businesses that is taking orders, serving clients, getting paid, and delivering the work. Everything else can wait a day or two. You build the plan around the critical few.

Set your recovery targets

For each critical function, two simple numbers drive every other decision. They sound technical but they are just plain questions:

• Recovery time objective (RTO): how long can this function be down before it really hurts? An hour? A day? Three days?
• Recovery point objective (RPO): how much recent data can you afford to lose? If your systems failed right now, is losing the last hour of work survivable, or the last day, or must it be near zero?

These two answers decide how often you back up and how quickly you need to be able to restore. A function that must be back in an hour with near-zero data loss needs a very different setup from one that can wait until Monday. Naming the targets stops you from either under-protecting what matters or overspending on what does not.

Write the plan (keep it short)

A useful continuity plan for a small business fits on a page or two and covers:

• Who does what. Who makes the call that this is a real incident, who leads the response, who talks to customers.
• How you communicate when your normal email and phones might be down. Agree an out-of-band method in advance, and how you will update staff, customers, and suppliers.
• Where the plan lives. It has to be reachable when systems are down, so keep an offline or printed copy, not only a file on the server that just died.
• Key contacts: your IT provider, insurer, bank, landlord, and critical vendors, with after-hours numbers.
• A workaround for each critical function, even a manual one, to keep serving customers while systems come back.

Test it, because an untested plan is a guess

A plan nobody has ever tried is a hope, not a safeguard. Testing does not have to be elaborate:

• Walk through a scenario out loud. Gather the key people for twenty minutes and talk through "ransomware hit this morning, what do we each do?" You will find the gaps immediately.
• Actually restore from a backup. Recovering a real file or system proves the backup works, which is the one thing you never want to discover during a genuine emergency.
• Review after anything real. Every outage or near-miss is free information. Update the plan while it is fresh.

The disruptions worth planning for

You are not planning for one disaster, you are planning for a category of them. The common ones for a small business: a cyberattack or ransomware event, an extended cloud or software outage when a service you depend on goes dark, a physical problem like a fire, flood, or simply losing access to your premises, the sudden loss of a key person who holds knowledge nobody else does, and a critical supplier or vendor failing. A good plan does not need a separate script for each; it needs your critical functions protected in ways that hold up no matter which of these hits.