Get started Bring yourself up to speed with our introductory content.

How to get started with small business disaster recovery

What's the best place to start with small business disaster recovery? What should small businesses do first? Once something is in place, how can they test their DR plan?

First, determine why disaster recovery is needed. Is it in response to an audit finding? Is it a regulatory or...

legal requirement? Next, determine if some level of DR is already being performed (e.g., backing up data onto tapes, backing up data to a cloud service). Next, if there is no DR activity at all -- hard to imagine these days -- determine what kinds of disaster recovery activities will be needed.

These can include data backups; system failover and failback services; network redundancy; duplicate access paths to an ISP; use of more than one ISP; and primary and alternate sources of equipment, e.g., servers, communications devices, power supplies, racks, cabling and connectors. If you have an IT department with even one person, have a discussion with that person to see what he/she wants to do for DR.

You should also discuss DR activities with other small businesses or experienced DR consultants. You may find that a managed service firm offering disaster recovery as a service (DRaaS) is your best option. Once you determine what you need, set up a project plan to get the work done, document all DR activities and perform tests to be sure the DR plan works.

When testing, first decide what will be tested. Discuss the test with IT staff and determine the objectives of the test, and what constitutes a successful test. Determine what resources will be needed to conduct the test. Define and document all the steps to be taken in the course of the test; this is the script for the test. Then review the test plan and script with all IT resources needed for the test.

If only a production environment exists, and no R&D or other environment is available, the test may have to be held over a weekend or another time that will not impact production systems and scheduled batch jobs. Make sure there are no other activities scheduled at the time the test is to be held. Have all the players available, and review the test before starting the process. Designate a person to take notes and to keep time.

Once the test is completed and systems have been returned to normal, have a post-test review as soon as possible after the test to determine what worked, what didn't work, and lessons learned. Update DR processes and procedures as soon as possible with information from the test. Finally, schedule the next test -- frequent testing is critical.

Next Steps

SMB disaster recovery planning template

Developing an SMB disaster recovery plan

DR planning strategies for small businesses

Dig Deeper on Small business disaster recovery

Join the conversation

1 comment

Send me notifications when other members comment.

Please create a username to comment.

The most important resource you have in your company is your people, and the first priority should be to locate them and make sure they're safe -- not just because it's the right thing to do, but because they have the information your company needs to run. Do you have full names, street addresses, email addresses, landlines, and cell phone numbers for everyone, and is this updated?

Second, make sure the information is available in multiple ways. You don't want it just in a looseleaf notebook in the computer room, because that doesn't help you if the building catches fire. At the same time, you don't want it only online, because what if the power is out? Have it in multiple places in multiple ways, and make sure some of it is in "for dummies" fashion in case inexperienced people are working on it.

Finally, and this is tough because of the security aspects, but make sure there's way for people to get passwords. You don't want one guy to be the password repository and then not be able to get hold of him. This was a big issue in 9/11.