To create a small business disaster recovery plan, work out which disruptions could stop you trading and which functions to restore first. Then name who acts, set up tested backups and workarounds and plan how you will communicate. Finally, test the plan and keep it up to date.
A disaster recovery plan sets out how your business gets operating again after a fire, flood, cyber attack or other serious disruption. Our guide to what a small business disaster recovery plan is explains the term and how it relates to a business continuity plan.
How do you create a small business disaster recovery plan?
You can create a disaster recovery plan in seven steps, from listing your risks to testing the finished plan.
Step 1: Identify the disruptions that could stop your business
Start with the events that could stop you providing your usual products or services. These include fire, flood or storm damage, losing access to your premises, a cyber attack, a power outage, an internet failure and equipment failure. A key supplier closing, or the absence of the one person who runs an essential process, can stop work too.
For each event, business.gov.au suggests looking at the likelihood of it happening and the consequence or damage if it happens. You can then rank your risks from least urgent to most urgent.
A café depends on electricity, refrigeration and its premises, while a consultancy relies on laptops, cloud software and client records. Our guide to the risks involved in owning a business looks at business risks more broadly.
Step 2: Work out your essential business functions
Next, list what your business has to be able to do to keep trading or start recovering. The business.gov.au emergency management template starts with your most important or profitable products or services. It asks how you provide each one to customers and what the backup is if those arrangements fail.
Essential functions might include taking payments, accessing customer records, managing bookings, dispatching orders or keeping stock refrigerated. A laptop is an asset. Taking bookings is the function that depends on it.
For each function, note the people, technology, equipment, premises and suppliers it relies on. Anything with no alternative is a single point of failure.
Step 3: Decide how quickly each function needs to recover
Give each essential function a recovery priority based on how quickly a stoppage becomes serious. A two-hour outage of an internal staff system is inconvenient. Losing your payment system or refrigeration for the same two hours may cost sales or stock.
For each function, also note the likely effect on revenue, which customers or contracts are affected and whether a workaround exists. This is a short business impact assessment.
Then set a target time to restore each function, often called a recovery time objective (RTO). For data, also decide how much recent work you could afford to lose, because that sets how often you back up.
Step 4: Assign recovery roles and keep contacts accessible
The business.gov.au guide to preparing for an emergency suggests setting clear roles and responsibilities for each member of your emergency team. In a small team one person may cover several areas, such as coordination, technology, communication, premises, suppliers or finance and insurance. If you can, name a deputy for each area so recovery continues when someone is away.
Keep a list of the contacts you would call, such as key staff, IT support, suppliers, your landlord, accountant and insurer. The business.gov.au template adds local police, fire, ambulance and state emergency services. Its guide to preparing for an emergency suggests keeping emergency phone numbers in a secure location.
Step 5: Set up tested backups and temporary workarounds
The Australian Cyber Security Centre (ACSC) points to the data your business couldn't function without, such as emails, customer details and financial records (ACSC). A backup routine might run hourly, daily, weekly or monthly.
The ACSC suggests keeping at least one backup offsite, so a fire or theft won't result in complete data loss.
Ransomware is "malicious software that encrypts organisational data or systems, demanding payment (typically in cryptocurrency) for restoration". The ACSC warns it can spread to connected hard drives or cloud storage. Its advice is that, ideally, you connect backup media only while a backup is running.
The ACSC says it is important to try restoring your backups regularly.
The business.gov.au template suggests identifying temporary office space you could access quickly in an emergency. Other workarounds include manual booking or payment processes, hired equipment, a second supplier or spare devices.
Step 6: Plan your communications, records and finances
Decide in advance who contacts staff, customers and suppliers. Note which channel you would use if email or phones are down. The business.gov.au template asks you to list your important customers and how you will contact them to explain what happened.
If a cyber incident exposes personal information, the Notifiable Data Breaches scheme may apply (Office of the Australian Information Commissioner (OAIC)). Organisations covered by the Privacy Act 1988 must notify affected individuals and the OAIC about a data breach likely to result in serious harm.
Under the Privacy Act, a small business is one with an annual turnover of $3 million or less (OAIC). Many small businesses are not covered by the Act, but some are, such as health service providers.
For finances, keep copies of your banking details, payroll, invoices, supplier accounts, an asset list and your insurance policies.
Step 7: Test, store and review the plan
A tabletop exercise tests the plan without a real emergency. With the people named in the plan, you walk through an example, such as your premises closing and your systems going down for two days.
Work through who does what and note what breaks, such as out-of-date contacts, backups that won't restore or confusion over who makes decisions. Beyond tabletop exercises, business.gov.au suggests running regular drills with your staff so everyone knows what to do in an emergency. The same site recommends reviewing the plan regularly and updating it after staff changes or a move to a new business location.
Keep a printed copy and a copy stored away from your main systems. If your systems or premises are down, authorised people can still reach the plan.
What should a disaster recovery plan template include?
A small business disaster recovery plan can be short, as long as another authorised person could act on it. You can copy this disaster recovery checklist into a document, your business plan or a risk register.
| Plan item |
What to record |
| Essential function |
The product, service or process to restore |
| Disruptions |
Events that could stop it, with how likely and damaging each one is |
| Recovery priority |
Urgent, high or normal |
| Target recovery time |
How quickly the function needs to return |
| Dependencies |
People, premises, systems, equipment and suppliers it relies on |
| Workaround |
How you could operate while normal service is down |
| Recovery owner and deputy |
Who coordinates recovery and who steps in if they are unavailable |
| Contacts |
Staff, IT support, suppliers, landlord, insurer and emergency services |
| Backups |
What is backed up, how often, where it is stored and how it is restored |
| Communications |
Who needs to hear from you, who tells them and through which channel |
| Insurance |
Policy details and claims contacts |
| Last tested or reviewed |
Date, result and changes made |
Swipe left or right to see the full table.
The business.gov.au website also publishes an emergency management and recovery plan template. It has three sections: a continuity plan, an emergency action plan and a recovery plan.
Is a disaster recovery plan required by law in Australia?
Work health and safety laws set requirements for workplace emergency plans, which are narrower than a disaster recovery plan (Safe Work Australia). Every state and territory except Victoria has implemented the model work health and safety (WHS) laws.
In those jurisdictions, Safe Work Australia's guidance on regulation 43 of the WHS Regulations lists what an emergency plan must cover. That includes emergency procedures such as evacuation, testing those procedures and training for relevant workers. Safe Work Australia lists each state and territory's regulator and how to contact them.
An emergency plan sets out how people respond during an incident. A disaster recovery plan deals with how the business restores its operations afterwards.
How does insurance fit into a disaster recovery plan?
Insurance sits alongside your disaster recovery plan. The plan sets out how the business responds, and insurance may help with the cost of some losses, depending on the policy.
Cover depends on the policy and insurer you choose. Check the policy wording and its terms and conditions for what is and isn't included.
As part of your planning, you can compare the risks from Step 1 with the cover, limits and exclusions in your current policies. The business.gov.au template suggests recording your insurance policy details in the plan and attaching copies of the policies.
After an emergency, business.gov.au suggests making any insurance claims as soon as possible. After a natural disaster, ASIC's Moneysmart suggests households take photos or videos of the damage and check with their insurer before any repairs.
You can start a claim through the make a claim page. Admitting liability, incurring costs or agreeing to a settlement before you notify your insurer may affect your claim. Starting a claim does not confirm that your claim is covered; your insurer assesses it under the policy terms, conditions, exclusions and limits.
Also keep in mind that notifying of a claim late may affect your claim. An upcover team member or an insurance broker can help you understand your existing insurance and any gaps in cover that might exist.
How upcover can help
upcover arranges insurance for Australian small businesses. upcover works with 80+ insurance partners and can arrange quotes from a range of insurers.
- 70,000+ businesses covered across Australia
- 4.9/5 customer rating
- 80+ insurance partners
Get a quote for small business insurance.
Frequently asked questions
How is disaster recovery different from business continuity?
In the business.gov.au template, a continuity plan prepares a business for an emergency by identifying risks to key areas and how to manage them. A recovery plan guides your business's recovery after an emergency.
Is backing up data enough for disaster recovery?
Backups help restore information, but recovery also depends on people, premises, equipment, suppliers and communication. The ACSC also suggests regularly trying to restore your backups to check they work.
Do cloud backups replace a small business disaster recovery plan?
Cloud storage helps protect data, but a plan also deals with premises, equipment, staff and suppliers. The ACSC notes that ransomware and malware have been known to infect backup files by spreading to connected hard drives or cloud storage.
What should you do first when a disaster hits your business?
Safety comes first: business.gov.au says the most important thing during an emergency is to make sure you and your workers are safe. Once you have assessed the impact, it suggests thinking about what it will take for your business to recover.
How often should you review a disaster recovery plan?
The business.gov.au guidance calls for regular reviews, with an update after staff changes or when you move to a new location. For workplace emergency plans, Safe Work Australia's review triggers include testing the plan and changes to the workplace, workforce or work activities.
Written by upcover's editorial team. This article provides general information only and does not take into account your objectives, financial situation or needs. It is not legal advice; get legal advice about your obligations under work health and safety and privacy laws. Laws and government guidance may change, so confirm what applies with the relevant regulator. Insurance availability and cover are subject to underwriting and the terms, conditions, limits and exclusions of the relevant policy. Read the policy wording and its terms and conditions before deciding. upcover arranges insurance products with selected insurers and underwriters and does not compare all general insurers or insurance products available in the market.
Sources:
- https://business.gov.au/risk-management/risk-assessment-and-planning/make-risk-management-plan
- https://www.safeworkaustralia.gov.au/safety-topic/managing-health-and-safety/emergency-plans-and-procedures/overview
- https://business.gov.au/planning/business-plans/develop-an-emergency-management-plan
- https://cyber.gov.au/protect-yourself/securing-your-devices/how-back-up-your-files-and-devices
- https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/organisations/small-business
- https://www.oaic.gov.au/privacy/notifiable-data-breaches/about-the-notifiable-data-breaches-scheme
- https://moneysmart.gov.au/dealing-with-natural-disasters/what-to-do-after-a-natural-disaster
.svg){kind=logo}
.svg)
.svg)
.svg)
%201.svg){kind=icon}
.svg)
.svg)
