Disaster Recovery Plan for Small Business: NJ Guide
If your server died tonight, how long until your business is working again? Most owners I talk to answer with a hopeful guess. A solid disaster recovery plan for a small business replaces that guess with a number you have actually tested.
After 28 years in IT, I have seen the same pattern across South Jersey: businesses invest in backups, then discover during a crisis that nobody ever checked whether those backups work. This guide walks you through building a practical plan in plain English, no jargon and no fluff.
What Is a Disaster Recovery Plan for a Small Business?
A disaster recovery plan is a written, step-by-step document that explains how you get your systems, data and people working again after something goes wrong. That "something" is usually mundane: a ransomware infection, a failed server, a flooded office, a deleted shared folder, or a Microsoft 365 account that has been taken over.
It is different from a backup. A backup is a copy of your data. A disaster recovery plan answers the harder questions:
What do we restore first?
Who does it, and who do they call?
How long can we be down before it hurts?
How much recent work can we afford to lose?
Why Small Businesses in New Jersey Can't Skip This
Big companies have IT departments and recovery sites. A 15-person practice in Turnersville or a 40-person manufacturer in Gloucester County usually has neither. When systems go down, there is no one down the hall to fix it, and every hour offline is payroll, missed appointments and unhappy customers.
The consequences are very real. A medical office that cannot reach patient records cannot treat patients efficiently. A law firm that loses case files faces ethics problems on top of lost time. A manufacturer with a dead server can lose a production run. Downtime is not an IT problem. It is a business problem that happens to start in IT.
Ransomware makes this worse, because attackers go after your backups first. CISA, the federal cybersecurity agency, advises organizations to maintain offline, encrypted backups of data and regularly test those backups. If you want the full prevention picture, read our guide on how to protect your business against ransomware.
The Two Numbers That Drive Every Recovery Plan
You do not need to be technical to understand these. You just need to answer two business questions honestly.
Recovery Time Objective (RTO): How long can you be down?
RTO is the maximum amount of time you can tolerate being offline. For an accounting firm in the middle of tax season, that might be a few hours. For a nonprofit between events, it might be a couple of days. Your answer determines what kind of backup technology you need.
Recovery Point Objective (RPO): How much data can you lose?
RPO is how far back you can afford to go. If your last good backup was last night, you lose a day of work. If it was last week, you lose a week. Businesses that process orders, patient visits or financial transactions usually need backups running many times a day.
Write both numbers down for each major system. Most owners are surprised to find their current setup does not come close to meeting them.
How to Build a Disaster Recovery Plan in Six Steps
Step 1: List what your business actually runs on
Make a simple inventory: servers, workstations, line-of-business applications, cloud services like Microsoft 365 or Google Workspace, your phone system, your internet connection, and any specialized equipment. If you cannot list it, you cannot recover it.
Step 2: Rank each system by how much downtime hurts
Sort everything into three buckets: needed within hours, needed within a day or two, and can wait a week. Email, your main application and your file shares are usually in the first bucket. This ranking becomes your restore order.
Step 3: Follow the 3-2-1 backup rule
Keep at least three copies of your data, on two different types of storage, with one copy offsite. For most small businesses that means a local backup device for fast restores plus an encrypted cloud copy that ransomware cannot reach. The cloud side matters just as much for software-as-a-service data. Many owners assume Microsoft keeps everything safe forever, and it does not. We explain why in why Microsoft 365 isn't enough and you still need a backup.
Step 4: Write down who does what
In a crisis, people freeze. Your plan should name a decision maker, list phone numbers (including personal cell numbers, because your office phones may be down), and say who calls your IT provider, your insurance carrier and your key customers. Print a copy. If your plan lives only on the server that just failed, it is not a plan.
Step 5: Decide how you will communicate
Employees and customers want to know what is happening. Prepare a short script now: what happened, what you are doing, and when you will update them next. Honest, calm and frequent beats polished and late.
Step 6: Test it, and keep testing it
This is the step almost everyone skips, and it is the one that matters most.
Backup Testing: The Step That Separates a Plan From a Hope
A backup that reports "successful" every night can still fail you. Files can be corrupted, a folder can be left out of the job, or the backup can be encrypted by the same ransomware that hit your server. You only find out when you try to restore.
Good backup testing comes in layers:
Monitor daily. Someone should review backup alerts every day and act on failures, not just let them pile up.
Restore a few files every month. Pick random files and folders and confirm they open correctly.
Run a full mock recovery at least once a year. Restore a complete server or critical system into a test environment and time it. Compare the result to your RTO and RPO.
Test after big changes. New server, new software, new office? Test again.
Document every test: what you restored, how long it took, and what went wrong. Those notes are the most valuable part of your plan, and they are exactly what an auditor or cyber insurance carrier will ask to see.
Compliance Makes This Mandatory, Not Optional
If you work in a regulated industry, a tested recovery plan is often a requirement. Healthcare practices handling patient data must have contingency plans under the HIPAA Security Rule, which includes data backup and disaster recovery planning. Our small business HIPAA IT compliance guide covers what that means in practice. Financial firms, law offices and nonprofits holding donor or client records face their own expectations from regulators, clients and insurers.
For a broader framework, the National Institute of Standards and Technology publishes free small business cybersecurity resources that include guidance on recovering from incidents.
Common Mistakes I See in the Field
Backing up to a drive that sits plugged in next to the server. Ransomware, fire and theft take both.
Assuming "the cloud" means backed up. Syncing files is not the same as backing them up.
No one owns the plan. If everyone is responsible, no one is.
Never timing a restore. Restoring 2 TB over a standard office internet connection can take far longer than owners expect.
Treating it as a one-time project. Your business changes, so your plan has to change with it.
Who We Help
Every industry has different recovery priorities, and we build plans around them. We provide IT support for healthcare practices, IT services for financial firms, IT support for law offices, managed IT for manufacturers, and IT support for nonprofit organizations across South Jersey and the tri-state area. If you want to know why clients stay with us for ten years or more, see why choose Saving Grace Technologies. And if you are weighing a proactive provider against calling someone only when things break, read managed IT vs. break-fix. You can find more articles on our blog.
Frequently Asked Questions
What should be in a disaster recovery plan for a small business?
At minimum: an inventory of your systems, a ranked restore order, your RTO and RPO for each critical system, backup locations and credentials, a contact list with roles, a communication script, and a record of your most recent recovery test.
How often should a small business test its backups?
Review backup alerts daily, restore sample files monthly, and run a full recovery test at least once a year. Test again after any major change to your servers, software or office.
What is the difference between a backup and disaster recovery?
A backup is a copy of your data. Disaster recovery is the complete plan for using that copy, along with people, process and technology, to get your business operating again within a time you can live with.
How much does disaster recovery cost for a small business?
It depends on your RTO, RPO and the amount of data. Faster recovery costs more, which is why setting realistic targets first keeps you from overspending or under-protecting. A short conversation about your systems is enough to give you a clear number.
Find Out Where You Stand
Not sure your backups would hold up on your worst day? We will check. Schedule a Free IT Compliance & Security Assessment, on-site in South Jersey or remote, and you will get an honest picture of your risks and a clear plan for fixing them. No pressure, no jargon.
Comments