Most smaller companies keep everything in one place: one office, one server closet, one internet connection. A fire, a burst pipe, a break-in or a ransomware attack would all have the same effect. Planning for it does not require a second data center.
Start with two questions
- How long can we be down? An hour, a day, a week? The answer is different for the phones, the order system and the archive.
- How much work can we afford to lose? The last hour, or the last day?
Those two answers decide what the plan has to cost.
Backups that will actually restore
The long-standing guidance, repeated by US agencies including CISA, is the 3-2-1 rule: three copies of your data, on two different kinds of storage, with one copy somewhere else. For ransomware, at least one copy should be offline or impossible to alter, because attackers look for the backups first.
A backup that has never been restored is an assumption. Restore a real file every month and a whole system once or twice a year.
Beyond the data
- A second internet connection that takes over automatically.
- Phones and email in the cloud, so staff can work from home on the same day.
- A list of critical vendors, account numbers and support contacts, kept outside the office.
- Passwords in a password manager that more than one trusted person can open.
- A one-page plan that says who does what in the first hour.
Then rehearse it once. The first run-through always finds something missing.
Related service: IT & CTO/CIO management.