Disaster recovery: building a plan for a smaller company
Why most smaller companies have no disaster recovery plan, and how to build one pragmatically, step by step.
A fire, a cyberattack, a major outage: when the IT estate goes down, every hour of downtime is expensive. Yet according to studies by the CESIN, the French association of information security officers, fewer than 30% of smaller companies have a formal disaster recovery plan.
What is a disaster recovery plan?
A disaster recovery plan is a working document describing how to restore the IT estate after a major incident. It answers two fundamental questions:
- RPO (Recovery Point Objective): how much data can you afford to lose? (1 hour, 24 hours, a week?)
- RTO (Recovery Time Objective): how quickly must the IT estate be operational again?
Why smaller companies do not have one
The reasons are always the same:
- “It only happens to other people”
- No in-house IT director to own the subject
- The IT supplier never suggested it
- The perceived cost seems out of all proportion
In reality, a disaster recovery plan suited to a smaller company requires neither a colossal budget nor a complex infrastructure.
Building your plan in 5 steps
1. Identify the critical assets
List the applications, data and services without which the business stops. For a distributor, that is the ERP and email. For a law firm, it is the file server and the practice management software.
2. Assess the risks
For each critical asset, identify the threats: hardware failure, ransomware, human error, physical disaster. Estimate the likelihood and the impact.
3. Set your RPO and RTO
Set realistic objectives based on the business. An RPO (maximum tolerable data loss) of 4 hours and an RTO (time to return to service) of 24 hours is a reasonable target for many smaller companies.
4. Choose the technical solutions
Depending on the objectives:
- Off-site backup (Veeam, Acronis, a cloud solution) with restoration tested
- Replication to a secondary site or to a cloud environment (recovery services such as AWS Disaster Recovery or equivalents)
- Hardware replacement contract with the supplier (delivery within 4 hours, within 24 hours)
5. Document and test
The plan should fit into a few clear pages, with the emergency contacts, the step-by-step procedures and the access credentials needed. Above all: test it at least once a year. A plan that has not been tested is a plan that will not work on the day.
The real cost
For a smaller company with 20 to 100 workstations, a working disaster recovery plan typically costs between 2,000 and 10,000 euros a year (off-site backup + an annual test). Compare that with the cost of a complete business shutdown, which runs into tens of thousands of euros a day.