Small Business Disaster Recovery Planning: The Ultimate Checklist
Disasters aren’t just the dramatic stuff you see on the news. For most UK small businesses — the ones with 10–200 staff — a disaster is a flooded storeroom, an unexpected ransomware lockout, a supplier that doesn’t turn up after a storm, or an electrical outage that halts production for a day. This checklist is written for business owners who care about outcomes: staying open, keeping customers, protecting cash flow and your reputation. No tech waffle, just practical actions that save time, money and headaches.
Why you need a disaster recovery plan (and fast)
If your team can’t do the basics for 24–72 hours, you’ve got a crisis. The cost isn’t only lost sales — it’s angry customers, late invoices, compliance headaches (hello, GDPR breaches) and stressed staff. I’ve seen offices shut by burst pipes and local firms unable to trade for a week because they hadn’t mapped who does what. A clear plan turns chaos into coordinated action.
The ultimate checklist
Work through these items with your leadership team. You don’t need a consultant to tick boxes, but you do need decisions and someone accountable.
1. Do a simple risk assessment
Identify the top threats for your location and sector: flooding (particularly in low-lying areas), winter storms, power cuts, cyber attacks, supply chain failure, or key person absence. Be realistic—local flooding maps, recent weather disruptions and supplier notes are useful. Rank them by likelihood and impact.
2. Business impact analysis (BIA)
List your critical functions (orders, payroll, customer support, manufacturing). For each, note the maximum tolerable downtime and the cost per day if it’s offline. That gives you priorities: what must be restored in hours, and what can wait days.
3. Assign clear roles and responsibilities
Name a decision-maker for incidents, plus deputies. Spell out who contacts staff, suppliers, insurers and regulators. In a small business, people cover multiple hats—write those hats down so there’s no morning-after confusion.
4. Protect and restore your data
Backups aren’t optional. Ensure backups are regular, tested and kept offsite (cloud or physical). Test restores quarterly—restoring is the bit that often fails when it matters. Protect credentials and document where backups are and who can access them.
5. Communication plan
Decide how you’ll tell staff, customers and suppliers you’re affected. Prepare templates for phone scripts, emails and social posts to save time. Maintain an up-to-date contact list stored in more than one place—paper and digital—and ensure someone can access it remotely.
6. Alternative workspace and remote arrangements
Can staff work from home? Do you need temporary premises? Identify nearby co-working spaces or partners who could host you if necessary. For retail or client-facing roles, have a plan for rerouting sales or appointments.
7. Power and connectivity resilience
Consider uninterruptible power supplies for critical equipment, and mobile connectivity plans if fixed lines fail. For manufacturing or refrigeration, test generator arrangements and ensure legal and safe use.
8. Supplier and supply-chain continuity
List your top suppliers and the critical parts or services they provide. Have at least one alternative for each essential supply or a temporary workaround (substitute materials, local suppliers). Keep contract and delivery terms documented so you can act swiftly.
9. Insurance and finance checks
Review your business interruption cover, contents and cyber insurance. Know the policy excesses and claim process. Keep an emergency pot or overdraft arrangement so you can make fast purchases or payroll if needed.
10. Protection of physical assets
Consider practical measures: raised shelving in flood-prone areas, sump pumps, secure server cabinets, fire extinguishers and signage. Regularly inspect and log maintenance—insurers and inspectors like to see that you’ve looked after your premises.
11. Staff training and wellbeing
Run short drills so everyone knows the basics: alarms, evacuation, who to call and how to access key systems remotely. Include wellbeing check-ins—staff under stress make mistakes, and you’ll need people fit to respond.
12. Legal and compliance obligations
Know your reporting duties: regulatory notifications, data breach reporting to the Information Commissioner’s Office (ICO), and health and safety follow-ups. Keep a pack of templates for required statements to regulators and customers.
13. Testing, review and continuous improvement
Test at least twice a year. A table-top exercise (walkthrough of an incident) and a full test of restoration procedures are valuable. After any incident or drill, capture lessons learned and update the plan.
Practical tips for UK businesses
– Take local factors seriously: if you’re near a river or on a low-lying estate, moving paperwork off the ground is cheap insurance. Weather-related closures are common—plan for staff who can’t commute.
– Cyber threats are now a routine business risk. Treat phishing training and simple multi-factor authentication as basic housekeeping rather than optional extras.
– Keep physical copies of essential documents (insurance, bank contacts, deeds) in a secure, fire- and water-resistant location or with a trusted offsite contact.
– Work out who will talk to the press or local council. A calm voice and clear facts preserve credibility.
What a simple plan looks like
One page with: the decision-maker, three highest-priority functions, where backups are, critical supplier contacts, immediate steps for the first 24 hours, and a location for staff to gather (physically or online). It’s not Hemingway; it’s usable in the dark at 02:00.
Quick checklist summary
- Risk assessment and BIA completed
- Roles assigned and contact lists updated
- Backups configured, tested and offsite
- Communication templates prepared
- Alternate workspace and supplier options identified
- Insurance reviewed and accessible
- Staff trained and drills scheduled
- Plan tested and lessons logged
FAQ
How long should my disaster recovery plan take to create?
A practical first draft can be done in a few days with senior staff and a clear list of priorities. Make it iterative: start small, test, then expand. Better to have a usable plan now than a perfect one later.
How often should we test the plan?
At minimum twice a year: one table-top exercise and one test that verifies technical restores or alternative workspace arrangements. After any real incident, run an immediate review and update.
Do small businesses really need cyber insurance?
It depends on your exposure. For most businesses, some level of cyber cover makes sense alongside good basic security practices. Insurance alone doesn’t prevent incidents, but it helps manage recovery costs and liability.
What if my staff can’t get to the office during severe weather?
Plan for remote working where possible, and identify roles that must be done in person. Keep a list of local temporary sites and a simple rota so essential on-site duties are covered safely.
Final thoughts
Disaster recovery planning for a small business is about preserving cash flow, customer trust and the ability to trade. It doesn’t need to be complicated—prioritise, assign responsibility, protect critical data and practise. I’ve seen firms that could’ve closed for good bounce back because they’d done these basics. A modest investment of time now typically saves far more in lost revenue, reputation and stress later.
Start with the one-page plan, run a simple test, and you’ll be buying yourself time, protecting money, safeguarding credibility and sleeping a good deal easier.
