Disaster recovery for small businesses: what happens when everything stops?

Here's a question worth asking before you need the answer: if every computer in your office stopped working right now, how long until you're back in business?

For a lot of small businesses, the honest answer is "I don't know." That's what disaster recovery and business continuity planning are for.

Disasters are usually boring

When people hear "disaster," they picture tornadoes and floods, and in Indiana those are real. But most business disasters are less dramatic:

• A ransomware attack that encrypts every file
• A server or hard drive that simply dies
• An employee who deletes the wrong folder
• A burst pipe over the network closet
• A lost or stolen laptop with the only copy of something important

Ransomware is the big one. In Verizon's 2025 Data Breach Investigations Report, ransomware was involved in 88% of breaches at small and midsize businesses.

Backups are what make ransomware survivable

When ransomware hits, there are two ways back: pay the criminals, or restore from backup. In Verizon's report, 64% of ransomware victims didn't pay. A working backup is how a business makes that choice.

Recovery isn't cheap either way. Among the organizations Sophos surveyed in 2025 (100 to 5,000 employees), the average cost to recover from a ransomware attack, not counting any ransom, was $1.53 million. Most of that is downtime, cleanup and lost business. Smaller businesses spend less in dollars, but often more as a share of what they can afford, which is why getting back up quickly matters as much as having the data.

What a solid plan includes

1. Backups that follow the 3-2-1 rule: three copies of your data, on two different types of storage, with one copy offsite.
2. Cloud data counts too. Microsoft 365 and Google Workspace keep your services running, but they're not a full backup on their own. Deleted or encrypted files can be gone for good once retention periods end.
3. Regular restore tests. A backup you've never restored from is a hope, not a plan.
4. A written recovery order. What comes back first? Usually email, your main business application and shared files.
5. A contact list that isn't stored on the systems that are down, including your IT provider, insurer and key vendors.

Five questions every owner should be able to answer

• Where are our backups, and when were they last tested?
• How much data could we lose: an hour, a day, a week?
• How long would it take to get our most important systems running?
• Who do we call first?
• Does our cyber insurance require anything we're not doing?

If any of those made you pause, you're not alone, and it's very fixable.

Want help answering them? Schedule a free consultation.

---

Sources: Verizon 2025 Data Breach Investigations Report · Sophos, The State of Ransomware 2025