Most small businesses have some kind of backup and no plan. When a drive dies, a laptop is stolen, ransomware locks the files or the internet is down for two days, the first hours disappear into questions nobody has answered: what do we bring back first, where is the backup, who do we call and what do we tell customers? This guide shows you how to answer them in advance, on one page, with no jargon. It includes a planner that builds the plan from how long you could cope without each system. IT-Support-SA supports businesses from Pietermaritzburg across KwaZulu-Natal and the rest of South Africa with backups, security and recovery.
Want a recovery plan that is set up and tested properly? Book a free chat through IT-Support-SA, see our IT support services or WhatsApp us on 069 560 0708.
The Short Answer
A disaster recovery plan answers four questions for every system you rely on: how long can you be without it, how much recent work can you afford to lose, what has to be in place to meet that, and who does what on the day. Rank your systems from the ones that stop you trading to the ones that can wait. Match the protection to the ranking, so you spend where it matters. Keep three copies of your data with one off-site and out of ransomware’s reach. Test a real restore every quarter. Print a one-page contact sheet. That is the plan.
Backup Is Not Recovery
This is the point most small businesses miss. A backup is a copy of your data. Recovery is getting the business working again using it. You can have one without the other:
- The backup job says “successful” but nobody has ever opened a file from it.
- Ransomware encrypted the backup too, because it sat on the same network and was always connected.
- The data is safe in the cloud, but the accounting software is not, or nobody remembers the licence key.
- There is no computer to restore onto, and it will take a week to get one.
- The restore works, but takes three days when you can only afford one.
Our guides to cloud backup and data recovery cover the first half. This guide covers the second: the plan that turns copies into a working business.
What Actually Takes South African Small Businesses Down
You do not need exotic scenarios. The usual causes are ordinary:
- Power. Load shedding, surges and power cuts that interrupt the server or corrupt a database. See our backup power guide.
- Connectivity. A fibre cut, a faulty router or a tower on the wrong side of an outage. Cards, cloud software, email and WhatsApp all stop at once.
- Ransomware and hacked accounts. Files locked, or an email account taken over. See ransomware protection and multi-factor authentication.
- Hardware failure. A drive, a server, a laptop. It will happen eventually, which is the point.
- Theft, fire and water. The office that holds both your computers and the backup drive next to them.
- Human error. The folder that was deleted, the update that went wrong, the staff member who clicked the link.
- A supplier going down. The bank’s card network, your software vendor, your host or your internet provider.
Two Numbers That Do the Work
Two plain ideas run the whole plan, and the planner below asks for both:
- How long could you cope without it? The technical name is the recovery time objective (RTO). A card machine may need to be back within about two hours. Your accounting data may be fine for a few days.
- How much work could you afford to redo? The technical name is the recovery point objective (RPO). If you back up every night, a failure at 4 pm means redoing a day. If that is acceptable, nightly is enough. If you could not redo a day of bookings, you need more frequent copies.
The shorter the time and the smaller the loss you can tolerate, the more the protection costs. That is why you should not treat every system alike. Most small businesses have two or three things that really stop them trading and a long tail that can wait.
Build Your Recovery Plan
For each system you use, choose how long you could cope without it. Choose how much recent work you could afford to redo and enter a rough turnover for a normal working day. The planner puts your systems in the order to bring them back, shows what to have ready for each one and sets a backup rhythm. It also gives you a rough cost of being down, a checklist for everything and the first steps of an outage. You can copy the plan or send it to IT-Support-SA.
Three things to notice. Systems you could only cope without for a couple of hours are the ones that need standby arrangements, such as a second internet connection or a card machine on its own mobile data. Things that can wait a few days only need a good backup and a note of who to call. And the checklist for everything applies whichever systems you chose.
The 3-2-1 Rule, and Why Ransomware Changes It
The long-standing rule for backups is 3-2-1: three copies of your data, on two kinds of storage, with one copy off-site. It still holds. Ransomware adds one condition: at least one copy must be out of reach of the machines that could be infected. That means a copy that is not permanently connected, or one held somewhere that cannot be changed or deleted from your network, with version history so you can go back to before the infection. A backup drive plugged into the server all day is the first thing ransomware encrypts.
Test the Restore
This is the single most valuable habit in the plan, and the one most often skipped.
- Every quarter, restore a few real files to a different location and open them.
- Once a year, or after any major change, restore a whole system, or as much as you can, to a spare machine, and time it. The time it takes is your real recovery time, which may differ from what you assumed.
- Write down how you did it, step by step, so someone else can do it under pressure.
- Fix what you find. A failed test is a good result: you found it on a quiet day.
A backup report that says “completed” tells you the job ran, not that you can recover.
Power and Internet: The Two Failures You Will Actually Have
In South Africa the likeliest outages are power and connectivity, so they deserve their own line in the plan:
- Put the router, the server, the switch and the card machine’s connection on a UPS or backup power so a power cut does not become a corrupted database.
- For anything that must keep trading, add a second internet line on a different network that takes over automatically.
- Know your provider’s fault number and account details, and put them on the contact sheet.
- Have an offline procedure for card machines and sales, practised once so the staff do not meet it for the first time on the day.
Our load shedding and business IT guide has a planner for sizing backup power.
People: Who Does What
Recovery fails more often through confusion than through technology. The plan should say, in a few lines:
- Who decides and who stands in if they are away.
- Who calls the IT provider, the internet provider and the software vendor.
- Who tells the staff, and where: one message, one place.
- Who talks to customers, and what the first message says.
- Who has the administrator logins, at least two trusted people, with an emergency copy kept safe and offline.
Link this to your staff changes: when someone leaves, their access, and sometimes their knowledge of the plan, leaves with them. See our offboarding checklist.
The First Hours of an Outage
Have these written down before you need them, because under stress people skip steps:
- Stop and write down what stopped, when and who noticed. Do not switch things on and off at random.
- Call the right person, from the contact sheet, and decide who is in charge.
- Tell the team in one place, with one message.
- Switch to the workarounds you set up: cash float, paper bookings, forwarded calls.
- Tell customers early, honestly, with a time you expect to be back.
- If it might be ransomware or a hack, disconnect the affected machines from the network, do not pay or reply to anyone, and get help before you restore anything.
- If personal information may have been exposed, start your POPIA steps and note the times.
- Afterwards, write down what happened and what you will change.
POPIA, Insurance and Your Plan
Two things make a plan more than good housekeeping. In general terms, POPIA expects you to keep personal information secure (Section 19), and where it may have been accessed by an unauthorised person, to notify the Information Regulator and the people affected as soon as reasonably possible (Section 22). A plan that covers who decides and what is logged makes that far easier on the day. See our POPIA IT compliance checklist.
Insurers are also asking more questions about backups, multi-factor authentication and recovery. A plan and a record of tested restores are good answers. Our guide to cyber insurance requirements explains what insurers tend to ask. This is general information, not legal or insurance advice, so check how it applies to your business.
Keep It Alive
A plan that is written once and filed is worth little. Put three dates in the diary:
- Every quarter: test a restore and update the contact sheet.
- When anything changes: a new system, a new supplier, a new member of staff, a move of premises.
- Once a year: read the whole plan again, ask whether your answers to “how long can we cope” are still true and practise the offline procedure.
Keep a printed copy where you can reach it when the network is down.
How IT-Support-SA Can Help
The plan is only as good as the thing behind it, and that is where we come in. IT-Support-SA sets up and monitors backups, makes sure at least one copy is out of ransomware’s reach, adds failover for internet and power where it matters and tests the restore with you so you know how long it really takes. We help you write the one-page plan and keep it current. We start with a free conversation about what you rely on and what would stop you trading. Contact IT-Support-SA, read about what IT support costs or WhatsApp us on 069 560 0708. We support businesses across Pietermaritzburg, the KZN Midlands, Durban, Ladysmith, Johannesburg, Cape Town and all 9 provinces of South Africa. If you are weighing up who should look after your IT, our guide to break-fix versus managed IT services explains the difference.
Mistakes That Make Recovery Harder
- Treating a backup as a plan.
- Never testing a restore.
- Keeping the only backup next to the computer it protects.
- A backup that is always connected, so ransomware encrypts it too.
- Treating every system as equally urgent, and so protecting none of them properly.
- One person who knows the logins.
- No plan for power or internet, the likeliest failures.
- No offline procedure for card machines and sales.
- Nobody knows who calls whom.
- Writing the plan once and never updating it.
Conclusion
You cannot prevent every failure, but you can decide in advance how you will get through one. List what you rely on, rank it by how long you could cope without it, match the protection to the ranking, keep a copy that ransomware cannot reach, test a real restore every quarter and put a one-page plan and a contact sheet where you can find them. An afternoon spent on this now is cheap compared with a week of improvising later.
If you would like help building the plan, setting up the backups and testing the restore, contact IT-Support-SA, see our IT support services or WhatsApp us.