Almost every business believes it has backups. Far fewer have restored from them recently, know how long a restore takes, or have a copy that ransomware cannot reach. A recovery plan closes those gaps.
1. List what the business cannot run without
Walk through a normal week and list the systems and data you depend on, such as accounting, payroll, email, client or member records, project files, estimating, and tax software. Include cloud services. Their data can be lost through account compromise or mistakes, even if the provider is reliable.
2. Set recovery targets for each
For each system, decide:
- Recovery point objective (RPO). How much recent data can you afford to lose, such as an hour, a day, or a week? This sets how often backups run.
- Recovery time objective (RTO). How long can you operate without it? This sets how fast restores must be.
A tax practice in April and a contractor at a bid deadline will have tighter targets than they would in a quiet month. Plan for the busy season.
3. Follow 3-2-1, with ransomware in mind
Keep three copies of important data, on two different types of storage, with one copy offsite. Then add protection against ransomware. At least one copy should be immutable or offline, so an attacker with administrator access cannot encrypt or delete it.
4. Protect the backups themselves
Encrypt backups, restrict who can delete them, and use separate credentials, with MFA, for the backup system. Many ransomware attacks deliberately target backups first.
5. Write the restore steps down
For each critical system, write short, plain steps: where the backup is, who can access it, what order to restore in, and how to confirm it worked. Store a copy offline, because your documentation should not be locked inside the systems that failed.
6. Test restores on a schedule
A backup you have not restored is a hope, not a plan. Restore a sample of files monthly and a full critical system at least annually, ideally before your busy season. Time it. If it takes longer than your recovery target, adjust the plan.
7. Cover access and people
Recovery often stalls because the one person with the credentials is unavailable. Make sure at least two trusted people can reach the backups and the accounts needed to restore them.
Our business continuity work covers all of this, including inventory, targets, backup fixes, runbooks, and rehearsed restores.
Written by the Syntonyl team. This article is general information, not legal, tax, or financial advice.