How to Write a Simple IT Disaster Recovery Plan for a Small Office
Most small businesses don’t need a 60-page continuity manual. They need a few pages that say what matters most, how quickly it has to be back, who does what, and proof that the backups actually restore. Here is how to put that together for a small London office.
Why a small office needs a plan at all
The events that stop a small business are rarely dramatic. A server or NAS dies on a Monday morning. Someone clicks a phishing link and ransomware encrypts the shared drive. A burst pipe in the flat upstairs soaks the comms cabinet. A laptop holding the only copy of the accounts is left on a train. In each case the questions are the same: what do we need first, where is the latest good copy of our data, and who is going to sort it out?
A disaster recovery plan answers those questions in advance, while everyone is calm. It doesn’t have to be long. For a firm of five to fifty people, a clear document of three to six pages is usually enough, as long as it is accurate and someone has tested it.
Step 1: List what the business actually runs on
Start with an inventory, not a technology wish list. Write down every system people use to do their jobs and where it lives:
- Email and files – usually Microsoft 365 or Google Workspace, sometimes a local file server or NAS.
- Line-of-business software – accounts, practice management, CRM, design or CAD tools, booking systems.
- The network – broadband line, router and firewall, switches, Wi-Fi, phones (VoIP).
- Devices – laptops, desktops, printers, and any machine with data stored only on it.
- Logins and licences – admin accounts, domain name and DNS registrar, software licence keys.
For each item, note who supplies it and how to contact their support. This list alone often exposes the riskiest gaps, such as a domain registered to a former employee’s personal email.
Step 2: Decide how fast, and how much data you can lose
Two simple ideas turn a vague worry into decisions you can act on:
- Recovery time objective (RTO) – how long each system can be down before it seriously hurts the business. Email might be two hours; an archive of old projects might be a week.
- Recovery point objective (RPO) – how much recent work you could afford to re-do. If losing a day’s changes to the accounts is unacceptable, nightly backups are not enough for that system.
Rank your systems into two or three tiers. Tier one gets the fastest recovery and the most frequent backups; lower tiers can wait. This stops you spending money protecting things that don’t matter while the critical database is backed up once a week.
Step 3: Make sure the backups match those targets
Check, system by system, that the backup really covers what you think it does. The common rule of thumb is three copies of important data, on two different types of storage, with one copy kept off-site or in the cloud and ideally one that can’t be altered or deleted by ransomware. Things that are often missed:
- Cloud services such as Microsoft 365 – Microsoft keeps the service running, but long-term recovery of deleted or overwritten data is your responsibility. See our Microsoft 365 backup service.
- Laptops that store work locally instead of in synced folders.
- Configuration you’d need to rebuild: firewall settings, Wi-Fi details, software install files and licence keys.
- Backups that sit on the same NAS, or in the same room, as the data they protect.
Step 4: Write down who does what
When something fails, people waste time working out who to call. Put this on one page at the front of the plan:
- Who decides that the plan is being invoked, and their deputy.
- Phone numbers for your IT support, internet provider, landlord or building management, insurer and key software suppliers, kept somewhere that doesn’t depend on the systems that may be down (a printed copy and a copy on a personal phone).
- How staff will be told what is happening and how they should work in the meantime, for example from home on Microsoft 365 if the office is unusable.
- Where the admin passwords and recovery codes are kept, and who can get to them.
Step 5: Test it, then keep it current
An untested backup is a hope, not a plan. At least once or twice a year, restore something real: a deleted folder, a mailbox, a full virtual server onto spare hardware. Time how long it takes and compare it with your RTO. Walk through a scenario with the people named in the plan – “the office flooded overnight, what happens at 9am?” – and fix whatever turns out to be missing.
Review the plan whenever something significant changes: a new office, a new core system, staff leaving who held key logins. A plan that describes last year’s setup can be worse than none, because people trust it.
When it’s worth getting help
You can draft most of this yourself. Where outside help pays off is in checking that backups really meet your targets, setting up off-site or immutable copies, and running a proper restore test. If a disaster has already happened and a drive or server has failed, stop using it and get advice before trying recovery software – our data recovery team works on failed disks, RAID arrays and NAS boxes in our London lab.
For planning, testing and ongoing support, see our disaster recovery and business continuity service or our wider business IT services. Call 020 7237 6805 to talk it through with an engineer.
Talk to an engineer
Describe the problem and the make and model if you know it. We will reply with a price and the fastest way to get it fixed, usually the same working day.
020 7237 6805 London repair centreUnit 1, 80 Willow Walk, London SE1 5SY
Monday to Saturday, 9am–6pm
Ready to send it in? Book online and get your job number by email straight away.