Disaster Recovery Plan for Small Business: 8 Steps

Quick answer: A disaster recovery plan for small business lists your critical systems, sets how long each can be down (RTO) and how much data you can lose (RPO), keeps 3-2-1 backups with one copy offsite and one that cannot be altered, names who does what, gives restore steps, and is tested with real restores at least every quarter.

Almost every business says it takes backups. Far fewer can answer a simple question: if your main server stopped working this morning, how long would it take to get the business running again, and how much data would you lose? For many small and mid-sized businesses the honest answer is "we are not sure", and they find out during a ransomware attack, a failed disk or a flooded office.

A disaster recovery (DR) plan answers that question in advance. It is not only for large enterprises with data centres. A trading firm in Bhiwandi, a clinic chain in Thane or a CA practice in Andheri depends on data and systems that can fail. This guide explains how to set recovery targets, choose a backup setup that fits your size, write a short plan and test that it works.

Backup and Disaster Recovery Are Not the Same

A backup is a copy of your data. Disaster recovery is the full process of getting systems and people working again after a serious failure. You need backups for DR, but backups alone are not enough.

Consider a ransomware attack that encrypts your accounting server. You may have a backup, but you also need a clean machine to restore it to, the software installed and licensed, people who know the steps, and a way to confirm the backup itself was not infected. A DR plan covers all of this. Our guide to ransomware protection for small businesses explains how to reduce the chance of that attack in the first place.

Start With Two Numbers: RTO and RPO

Before choosing any technology, agree on two targets for each important system:

• Recovery Time Objective (RTO): the maximum time a system can be down before the business is seriously affected. For example, four hours for billing, two days for an internal wiki.
• Recovery Point Objective (RPO): the maximum amount of data, measured in time, you can afford to lose. An RPO of 24 hours means a daily backup is enough. An RPO of 15 minutes needs something much more frequent.

These targets should come from business owners, not only from IT. Ask each department what happens if their system is down for an hour, a day and a week. The answers show where to spend money and where a simpler setup is fine.

Follow the 3-2-1 Backup Rule

The 3-2-1 rule is a widely used starting point for backup design:

• 3 copies of your data: the live data and two backups.
• 2 different types of storage, for example a local backup device and cloud storage.
• 1 copy offsite, away from your main office.

Many organisations now add one more layer: at least one copy that cannot be changed or deleted for a set period, often called an immutable or offline backup. This protects you if ransomware or a compromised admin account tries to delete backups along with live data. Do not forget cloud apps: email and files in Microsoft 365 or Google Workspace need their own backup. See our note on Microsoft 365 backup for business.

Choosing a Setup That Fits Your Size

Setup	How it works	Strength	Limitation	Suits
On-site backup only	Local backup device or NAS	Fast restores, simple to manage	Shares fire, theft and ransomware risk with main systems; does not meet 3-2-1	Not recommended on its own
Cloud backup	Data copied to a cloud service	Offsite copy without a second location	Large restores depend on internet speed	Small offices with modest data
Hybrid backup	Local copy plus cloud copy	Fast daily restores and protection from site-wide incidents	Two systems to monitor	Most SMEs
Disaster Recovery as a Service (DRaaS)	Ready-to-start copy of servers in the cloud	Short downtime for critical systems	Higher cost	Systems with RTO of a few hours

For more detail on choosing storage and tools, read our guide to data backup solutions for small business.

The Fix: How to Build Your Disaster Recovery Plan

Follow these steps in order. A small business can complete the first version in a few weeks.

1. List critical systems and data: include servers, accounting and ERP, email, file shares, cloud apps, websites and any line-of-business software, with the owner of each.
2. Set RTO and RPO for each: agree the targets with business owners and rank systems by how quickly they must return.
3. Design backups to meet the targets: apply the 3-2-1 rule, add an immutable or offline copy, and set backup frequency to match each RPO.
4. Write restore steps for each critical system: document where backups are, what hardware or cloud resources are needed and the exact order of steps, so someone other than the usual admin can follow them.
5. Name roles and contacts: list who declares a disaster, who restores what, who informs staff and customers, plus a backup person for each role and contacts for vendors and your internet provider.
6. Store the plan and secrets safely: keep copies of the plan, licence keys and configuration details outside your main systems, for example in a secured offline or cloud location.
7. Test restores on a schedule: restore random files monthly, one full system quarterly, and run a yearly tabletop exercise based on a scenario such as ransomware or a flood.
8. Review and update: after each test and each real incident, record how long recovery took, compare it with the RTO and fix the gaps.

What the DR Plan Document Should Include

A DR plan does not need to be long. It needs to be clear enough that someone can follow it under pressure. Include the list of critical systems with RTO and RPO, backup locations and schedules, step-by-step restore instructions, names and phone numbers with backups, vendor contacts, how staff will be informed and keep working, and where licence keys and configuration details are kept securely.

If an incident involves a cyber attack, also note your reporting duties. Organisations covered by CERT-In's April 2022 directions must report specified cyber incidents within six hours of noticing them. Our CERT-In 6-hour reporting checklist explains what to prepare.

Example: A Disaster Recovery Plan for Small Business

To make this concrete, here is how a 40-person distribution company might set its targets. Its billing and accounting system gets an RTO of four hours and an RPO of one hour, so the database is backed up every hour to a local device and copied to the cloud each night, with one weekly copy locked against deletion. Email runs in the cloud, with a separate backup service keeping 90 days of history. Shared files get an RTO of one day and a daily backup. The website is hosted outside the office and backed up by the hosting provider, with a monthly copy kept by the company.

The plan itself fits on four pages: the system list with targets, restore steps for billing and file shares, a contact sheet, and a test log. That is enough to guide the team on a bad day, and short enough that people will actually read and update it.

Common Gaps in Small Business DR

• Backups never tested: the software shows a green tick every night while a key database is excluded or files cannot be opened.
• Cloud apps assumed safe: email and cloud files are treated as "backed up by the provider" without checking retention and restore options.
• Backups on the same network: ransomware that reaches the server can often reach a connected backup drive too.
• One person holds the knowledge: if the only admin is unavailable, nobody knows the passwords or steps.
• Restore time never measured: a full restore over a slow internet link may take days, far beyond the RTO.

Frequently Asked Questions

How often should a small business back up its data?

Match backup frequency to the RPO of each system. Many businesses back up file servers daily and critical databases several times a day. Test restores regularly so you know the backups work.

Is cloud backup safe for business data?

It can be, if the data is encrypted in transit and at rest, access is protected with multi-factor authentication, and you know where the data is stored. Check the provider's retention, deletion protection and restore speed before relying on it.

What is the difference between high availability and disaster recovery?

High availability keeps a system running through small failures, such as a failed disk or server, often without users noticing. Disaster recovery brings systems back after a serious event that takes out a whole site or system.

How much does a DR setup cost?

Cost depends on data volume, the number of critical systems, how short your RTO and RPO are, and whether you use local, cloud, hybrid or DRaaS options. Short recovery targets cost more, so set them per system rather than for everything.

Do we need a separate business continuity plan?

A DR plan covers IT systems. A business continuity plan covers the wider business: people, premises, suppliers and customers. Small businesses often combine both in one short document.

How Affix Center Can Help

Affix Center Softech Services is an IT and e-governance solutions company based in Mumbai. Our cloud and infrastructure team designs hybrid backup and DR setups that match your RTO and RPO, and our IT operations team runs monitoring, restore tests and updates to the plan.

If you are not sure how quickly you could recover from a server failure or ransomware attack, talk to our team for a practical DR review.