A cyclone warning, a flooded office, a ransomware message or a failed server can stop a small business far faster than most owners expect. This small business disaster recovery guide focuses on the practical decisions that keep your people working, your customers informed and your critical data available when normal operations are disrupted.
For businesses across Mackay and regional Queensland, recovery planning needs to account for more than a lost laptop. Severe weather can affect power, internet access, premises and staff travel at the same time. Cyber incidents can lock files, interrupt phones and expose customer information without any warning at all. A workable plan prepares for both.
What disaster recovery means for a small business
Disaster recovery is the process of restoring your technology, data and communications after an incident. It sits alongside business continuity, which covers the wider question of how your business continues to operate while systems, premises or suppliers are unavailable.
For a small business, a disaster recovery plan does not need to be a thick document that nobody reads. It needs to answer clear operational questions: Which systems must be restored first? Where is the latest clean copy of our data? How will staff communicate? Who has authority to make decisions? How quickly can we safely resume work?
The right answer depends on your business. A medical practice, trade business, retailer, professional office and warehouse may all rely on different applications, equipment and response times. The goal is not to buy every available technology. It is to protect the systems that would cause the greatest financial, operational or reputational damage if they stopped.
Start with the services your business cannot lose
Before selecting backup or cloud services, identify the technology your team uses to generate revenue and serve customers. Include obvious systems such as accounting software, file storage, email and line-of-business applications, but do not overlook internet connections, phones, mobile devices, Wi-Fi, printers, access control and payment terminals.
For each service, decide how long it can reasonably be unavailable. Email may be inconvenient for a few hours, while an online booking platform or phone system may require a much faster response. This is your recovery time objective, often called RTO.
Then consider how much recent data you could afford to lose. If a file server is backed up overnight and fails at 4 pm, could the business recreate a day’s work? If not, backups need to run more often. This is the recovery point objective, or RPO.
These two measures turn a vague concern about downtime into a plan that can be built and tested. They also prevent overspending. Not every file needs near-instant recovery, but payroll records, customer data, job documentation and current financial information usually deserve stronger protection.
Map dependencies before an outage exposes them
A system rarely works in isolation. Your cloud application may depend on reliable internet. Your VoIP phones may require network equipment, power and user logins. A staff member working remotely may need multi-factor authentication, a managed laptop and access to cloud files.
Document these dependencies in plain language. Include account owners, administrator credentials, licence details, key suppliers and the location of network equipment. Keep secure copies available outside the office. If the only password list is stored on the server that has failed, recovery becomes slower than it needs to be.
Build backups that can actually be restored
A backup is only valuable if it is complete, current, protected and recoverable. Many businesses discover too late that they had a backup job running but no usable copy of the files they needed.
A sensible approach follows the 3-2-1 principle: maintain at least three copies of important data, on two different types of storage, with one copy kept offsite. For example, you may retain production data, a local backup for fast restoration and an encrypted offsite backup in a secure cloud environment.
Cloud platforms still need backup planning. Microsoft 365 protects the service infrastructure, but it does not replace a business-controlled backup strategy for deleted emails, SharePoint files, Teams data or accidental changes. Retention settings help, but they are not always enough for long-term recovery or ransomware response.
Protect backup systems from the same threats affecting your main network. Use multi-factor authentication, restricted administrator access, encryption and separate credentials. Where possible, keep an immutable or isolated backup copy that cannot be altered by a compromised account. This is particularly valuable when ransomware targets shared drives and connected backup storage.
Testing matters just as much. Restore a sample of files regularly, then schedule broader recovery tests for critical systems. Test how long it takes, whether permissions return correctly and whether staff can use the restored data. A successful backup notification is not proof of successful recovery.
Plan for communications, connectivity and power
When an incident occurs, customers will usually notice silence before they understand the cause. Your plan should state how you will communicate with staff, customers and suppliers if email, office phones or the premises are unavailable.
Cloud phone systems can allow authorised staff to answer business calls from another location or a mobile when the office is inaccessible. Call forwarding and recorded messages can also help manage expectations. These measures are useful only if they are configured and tested before an outage.
Internet resilience deserves the same attention. A second connection, mobile failover or 4G/5G backup can keep essential cloud services and phones operating during a primary service fault. It may not provide the same speed as a fixed connection, so decide which applications and users receive priority during failover.
Power is another local consideration. A properly sized uninterruptible power supply can provide enough time to save work and shut down servers safely during a short interruption. It is not a substitute for a generator or extended outage plan. For longer events, identify where staff can work, how devices will be charged and how mobile data usage will be managed.
Prepare for cyber incidents as well as weather events
A disaster recovery plan should assume that a cyber incident is possible, even with good security controls. The first hours of a ransomware attack or account compromise are critical. Staff need clear instructions to report suspicious activity quickly, rather than attempting to fix it themselves or continuing to use affected systems.
Your incident procedure should cover at least these actions:
- Disconnect affected devices from the network where safe to do so, without deleting evidence.
- Contact your nominated IT support provider and internal decision-maker immediately.
- Preserve details such as ransom notes, unusual login alerts, screenshots and the time the issue was identified.
- Reset compromised credentials and review account access from a clean device.
- Notify customers, insurers, regulators or law enforcement where required after assessing the incident.
Prevention reduces the likelihood and impact of these events. Keep operating systems and applications patched, use multi-factor authentication, apply least-privilege access, protect endpoints and provide staff with regular phishing awareness training. A recovery plan works best when paired with proactive monitoring and a clear security baseline.
Give people clear roles during a disruption
In a small team, one person may wear several hats. That is exactly why responsibilities should be agreed before an incident. Nominate a business lead to make operational decisions, a technical contact to work with IT support, and a communications contact to update staff and customers.
Create a short emergency contact list that includes mobile numbers, internet and phone providers, building management, insurers, software vendors and your IT partner. Store it securely in more than one place. Staff should also know which communication channel to use if normal systems are unavailable.
Avoid making the plan dependent on one key employee. Cross-train another person to access essential instructions, approve urgent purchases and coordinate customer communications. Annual leave, illness and travel do not wait for a convenient time to coincide with a disruption.
Test the small business disaster recovery guide
A recovery plan that has never been tested is an assumption, not a safeguard. Start with a simple tabletop exercise: talk through a realistic scenario with the people who would respond. For example, ask what happens if the office loses power during a busy week, or if staff cannot access shared files after a suspicious email is opened.
Then test individual components. Restore a file. Fail over an internet connection. Receive a business call on a mobile. Recover a user account. Confirm that a replacement laptop can be configured and securely connected. Record what worked, what took too long and what information was missing.
Review the plan after major changes, including a move to new premises, a phone-system replacement, new cloud software, staff changes or significant hardware upgrades. A plan from two years ago may refer to systems, contacts and processes that no longer exist.
EHW Technology can help businesses align backup, cloud services, connectivity, endpoint protection and recovery procedures into a practical arrangement that suits their operations. The best time to confirm whether recovery will work is during a controlled test, not when customers are waiting and the pressure is already on.