Premium IT support provider in Norwich, Norfolk

A failed server at 9am, a stolen laptop, a power cut, a flooded office or a ransomware message can stop a small business far more quickly than most owners expect. This small business disaster recovery guide explains how to prepare for disruption, recover in the right order and keep customers informed while systems are restored.

For businesses across Norwich, Norfolk, Suffolk and East Anglia, recovery planning does not need to mean enterprise-level costs or pages of technical paperwork. It means making sensible decisions before an incident: knowing what must be available, where your data is held, who can act, and how long the business can operate without each system.

What disaster recovery means for a small business

Disaster recovery is the practical process of restoring your technology and business operations after an incident. It covers more than fires and floods. For many SMEs, the more likely causes of downtime are cyber attacks, accidental deletion, hardware faults, broadband outages, failed updates and the loss of a key device.

A disaster recovery plan is different from a backup alone. A backup is a copy of data. Recovery is the wider plan for using that copy, rebuilding access, replacing equipment, communicating with staff and returning to normal working without creating further risk.

The right approach depends on your business. A small accountancy practice may need rapid access to client records and secure email, while a retailer may prioritise card payments, stock systems and internet connectivity. A construction firm with staff on the road may need mobile access to drawings and job information. Start with the services that stop work when they are unavailable.

Identify the systems that keep you trading

Do not begin by trying to protect everything equally. List the systems, devices and information your team relies on during a normal working week, then decide what the effect would be if each one failed.

Include email and Microsoft 365 accounts, shared files, finance and payroll software, customer databases, websites, phones, broadband, Wi-Fi, servers, laptops, line-of-business applications and any cloud platforms used by staff. Remember the less obvious dependencies, such as password managers, domain renewals, supplier portals and remote access tools.

For each item, record three simple points: who owns it, where it is hosted and how quickly it needs to be restored. This creates a realistic recovery order. Payroll might be able to wait until tomorrow, but email, customer telephone calls or access to live orders may need attention within hours.

Set recovery targets that suit your budget

Two targets make recovery planning clearer. Recovery Time Objective, or RTO, is the longest acceptable period a service can be unavailable. Recovery Point Objective, or RPO, is the maximum amount of data you can afford to lose.

For example, if your files are backed up every night and a server fails at 4pm, you could lose a day’s work. That may be acceptable for some data, but not for a busy order system or records updated throughout the day. More frequent backups reduce potential data loss, but usually increase cost and management requirements.

Be honest about these trade-offs. Promising immediate recovery for every system can be expensive and unnecessary. The aim is not perfection. It is an affordable plan that prevents a manageable issue becoming a serious interruption to the business.

Build backups you can actually restore

Backups are only useful if they are protected, accessible and tested. Many businesses discover too late that files were not included, the backup has failed silently or the only copy was connected to the same network affected by ransomware.

A sensible starting point is the 3-2-1 principle: keep three copies of important data, on two different types of storage, with one copy held off-site. For most small businesses, that might mean live data, a local backup for fast restoration and an encrypted cloud or off-site copy for protection against theft, fire or a site-wide incident.

Protect backup accounts with strong unique passwords and multi-factor authentication. Restrict access so that not every user can delete or alter backup settings. Where possible, use immutable or protected backup storage that cannot easily be changed by an attacker using compromised staff credentials.

Testing matters just as much as taking copies. Schedule a recovery test at least twice a year and after major changes to your systems. Restore a sample of files, check that they open correctly and confirm the right staff can access them. For critical systems, practise restoring to alternative hardware or a separate location.

Prepare for ransomware and cyber incidents

Ransomware can encrypt files, lock devices and disrupt phones, cloud accounts and shared services. Paying a demand offers no guarantee that data will be returned or that stolen information will not be misused. Your first priority is to limit the spread and preserve evidence.

If you suspect an attack, disconnect affected computers from the network and Wi-Fi where safe to do so. Do not switch off systems unless advised, as valuable information may be lost. Contact your IT support provider, change compromised passwords from a known-clean device and avoid reconnecting machines until they have been assessed.

Your recovery plan should state who has authority to make decisions during a cyber incident. It should also include current contact details for your IT provider, cyber insurance company, bank, software suppliers and legal or data protection advisers where applicable.

Prevention reduces the chance of reaching this point. Keep devices and software updated, use multi-factor authentication, filter malicious email, remove unnecessary administrator access and train staff to report suspicious messages without embarrassment. A quick report can prevent an organisation-wide problem.

Plan for people, premises and communications

Technology recovery is only one part of staying operational. If the office is inaccessible because of flood damage, a power problem or a local incident, can staff work securely from home or another site? Do they have suitable laptops, chargers, secure logins and access to the files and phone systems they need?

Create a short emergency contact list outside your normal email system. Include directors, key employees, IT support, building management, insurers, utility providers and telecoms contacts. Keep a printed copy in a safe location as well as a protected digital copy.

Decide how you will communicate with staff and customers if email is unavailable. This could be a mobile group message, a temporary voicemail greeting, a notice on your website or an agreed contact number. Clear communication protects trust. Customers are generally understanding when they know what is happening and when they can expect an update.

For businesses dependent on phone calls or internet connectivity, consider resilience options such as mobile data failover, a secondary broadband connection or cloud-based telephony that can redirect calls to mobiles. The best option depends on how costly even a short outage would be.

Write a recovery plan people can use

A plan buried in a shared folder, with no access during an outage, is not a plan that will help. Keep the working version concise and make it available securely in more than one place. It should be written for the people who will use it under pressure, not only for technical staff.

Your document should cover these four areas:

• Immediate actions, including how to report an incident, isolate affected equipment and protect staff.
• Recovery priorities, with the order for restoring connectivity, communications, accounts, files and core applications.
• Responsibilities, showing who makes business decisions, who contacts suppliers and who updates customers.
• Supplier and account information, including support numbers, contract details, licence records and secure access arrangements.

Add clear instructions for common scenarios, such as a lost laptop, failed server, unavailable Microsoft 365 account, broadband outage or suspected ransomware. These do not need to be lengthy technical manuals. A page of accurate actions is more useful than a 40-page document nobody has read.

Test the small business disaster recovery guide

A recovery plan should change as your business changes. New staff, cloud migrations, replacement phones, new accounting software and office moves can all create gaps in a once-sensible plan.

Run a simple tabletop exercise with the people responsible for operations. Ask: what would happen if the office had no internet tomorrow morning? How would we access customer records if a director’s laptop was stolen? Who can approve emergency spending for replacement equipment? The answers often reveal missing contact details, unclear ownership or systems that have never been backed up.

Then test one practical element. Restore a file set, redirect a phone number, work from a secondary connection or confirm that a staff member can sign in securely from another location. Record what worked, what did not and what needs changing.

Get the right support before an incident

Small businesses rarely need a full internal IT department, but they do need dependable support when decisions cannot wait. A local provider that understands your setup can help assess risks, configure backups, improve cyber security, document systems and provide a clear route to assistance when an incident occurs.

Anglian Internet supports businesses across East Anglia with managed IT, Microsoft 365, connectivity, cyber security, telephony and backup-focused planning. Bringing these services together can make recovery simpler because fewer suppliers need to be contacted during a disruption.

The most useful disaster recovery plan is one your business can carry out on a difficult day. Put the essentials in place now, test them regularly and give your team the confidence to act quickly when something goes wrong.