Disaster Recovery Plan Template for Small Business

Most small businesses know they should have a disaster recovery plan. Far fewer have one written down, and the ones that do often keep it in a single person's head. This disaster recovery plan template gives you a practical, fill-in-the-blanks starting point built for a business with 5 to 250 employees, not a Fortune 500 data center.

Below you'll find what to gather before you start, the full template you can copy section by section, a filled-in example, and the Southern California risks your plan should account for.

Key Takeaways

• A disaster recovery plan template gives you a ready-made structure for restoring IT systems and data after ransomware, hardware failure, a power shutoff, or a natural disaster.
• The nine sections that matter most are scope, recovery team, critical systems with RTO and RPO targets, backups, scenarios, recovery steps, communications, vendors, and testing.
• Write the plan so someone other than your usual IT person could follow it, and store a copy somewhere that works when your network doesn't.
• A plan you haven't tested is a guess. Run a tabletop exercise at least once a year and a real restore test every quarter.

What Is a Disaster Recovery Plan Template?

A disaster recovery plan template is a pre-built outline for documenting how your business will restore its IT systems and data after a serious disruption. Instead of starting from a blank page, you fill in your own systems, people, vendors, and recovery steps under headings that are already organized in the right order.

It helps to be clear about scope. A disaster recovery (DR) plan covers technology: servers, cloud apps, data, networks, phones, and the devices your team uses. A business continuity plan is broader and covers how the whole business keeps operating, including staffing, facilities, and customer service. The DR plan is one piece of the continuity plan, and it's usually the piece that decides how long you're down.

Why a Small Business Needs a Written DR Plan

The businesses that struggle most after a disaster usually aren't the ones with the worst luck. They're the ones that had to figure out the recovery while it was happening. FEMA estimates that 40% of small businesses never reopen after a natural disaster, and many more close within a year.

Small businesses face a specific set of problems that a written plan solves:

• One person knows everything. If your office manager or outside IT contact is on vacation or unreachable, nobody else knows where the backups are or how to restore them.
• Passwords and vendor numbers live in the system that's down. If your password manager, email, and contact list are all in Microsoft 365 and that account is compromised, you're locked out of your own recovery tools.
• Nobody agreed on priorities. Without a ranked list, the first system restored is whichever one the loudest person needs, not the one that keeps revenue flowing.
• Insurers and regulators ask for it. Cyber insurance applications, HIPAA, and many client contracts now expect a documented and tested recovery plan.

What to Gather Before You Fill In the Template

You'll move through the disaster recovery plan template much faster if you collect a few things first. Set aside an hour with whoever manages your IT and pull together:

• A list of every system the business uses: servers, cloud apps, line-of-business software, email, phones, internet, and firewall.
• Where each system's data is backed up, how often, and how long backups are kept.
• Vendor and support contacts, including account numbers and contract details.
• Your recovery targets. For each important system, decide how long you can be without it and how much recent data you can afford to lose. Our guide to setting RTO and RPO walks through how to pick realistic numbers.
• Insurance details, especially your cyber insurance carrier's incident hotline. Many policies require you to call them before hiring outside help.

The Disaster Recovery Plan Template (Copy and Fill In)

Copy each section below into a document and replace the bracketed text with your own details. Keep the language plain. The goal is a disaster recovery plan template that a stressed person can follow at 2 a.m., not a policy binder.

Section 1: Plan overview and scope

• Business name and locations: [Company name, office addresses]
• Plan owner: [Name and title of the person responsible for keeping this plan current]
• Last updated: [Date] Next review: [Date]
• What this plan covers: [For example: all servers, Microsoft 365, accounting system, phones, internet, and company laptops]
• What counts as a disaster: [For example: any outage expected to last more than 4 hours, any ransomware or suspected breach, or loss of access to the office]
• Who can declare a disaster and activate this plan: [Name, plus a backup]

Section 2: Recovery team and contacts

List each role with a primary and a backup person. In a small business, one person often covers several roles, and that's fine as long as it's written down.

• DR coordinator (makes decisions, tracks progress): [Name, mobile, personal email]
• Technical lead (restores systems): [Internal IT person or managed service provider, 24/7 number]
• Communications lead (staff, clients, vendors): [Name, mobile]
• Executive approver (spending, legal, insurance): [Owner or partner, mobile]
• Department contacts who confirm systems work after restore: [Accounting, operations, front desk]

Include personal email addresses and mobile numbers. Your work email may be the thing that's down.

Section 3: Critical systems and recovery priorities

This table is the heart of the disaster recovery plan template. Rank systems by how much it hurts to lose them, then set your targets.

Section 4: Backups and data protection

• Backup solution(s): [Product names and who manages them]
• Backup schedule: [For example: servers hourly, Microsoft 365 three times daily, laptops daily]
• Copies and locations: [Local appliance in office, cloud copy in a separate region]
• Protected copy ransomware can't delete: [Yes or no; where it lives; how long it's locked]
• Retention: [How far back you can restore]
• Who receives backup failure alerts: [Name or service desk]
• Date of last successful test restore: [Date]

If you aren't sure your backups follow the 3-2-1 backup rule, fix that before you finish the rest of the plan. Every recovery step below depends on it.

Section 5: Disaster scenarios and first steps

Write a short first-response checklist for the disasters you're most likely to face. Here are four scenarios most small businesses should include:

• Ransomware or suspected breach: [Disconnect affected devices from the network but leave them powered on. Call technical lead. Call cyber insurance hotline. Do not pay or contact the attacker. Preserve logs.]
• Server or critical hardware failure: [Call technical lead. Spin up the server from the backup appliance or cloud if supported. Notify staff of expected downtime.]
• Office unavailable (fire, flood, earthquake, power shutoff): [Staff work remotely using company laptops. Forward main phone line to mobile. Confirm cloud systems are reachable.]
• Microsoft 365 account compromise or outage: [Reset affected passwords, revoke sessions, and check mail forwarding rules. Use the backup communication channel listed in Section 7.]

Section 6: Recovery procedures and restore order

For each priority system from Section 3, document the restore steps in plain language. A useful format:

1. Prerequisites: [What has to be working first, such as internet, firewall, or domain controller]
2. Restore source: [Which backup, where it lives, and how to log in to it]
3. Steps: [Numbered instructions, or a link to the vendor's restore guide]
4. Verification: [How to confirm it's working, and which department contact signs off]
5. Fallback: [What to do if the primary restore fails]

Order matters. In most offices, the internet connection and firewall come first, then identity (Microsoft 365 or a domain controller), then line-of-business applications, then file shares, and finally individual workstations.

Section 7: Communication plan

• Backup communication channel: [Group text, personal email list, or a messaging app that doesn't depend on your company systems]
• Who tells staff, and when: [Within 1 hour of declaring a disaster]
• Who tells clients, and what they say: [Approved holding statement below]
• Who must be notified for legal or contract reasons: [Insurance carrier, regulators, key clients with notification clauses]

A simple holding statement you can adapt: "We're experiencing a technology outage affecting [service]. Our team is working on it, and client data [is / is not believed to be] affected. We'll update you by [time]. For urgent needs, contact [name and phone]."

Section 8: Vendor and service provider directory

Section 9: Testing, maintenance, and sign-off

• Tabletop exercise: [Annually; date of last exercise]
• Test restore of a critical system: [Quarterly; date of last test and result]
• Plan review triggers: [New system, new office, staff change in a listed role, or any real incident]
• Where copies of this plan are stored: [Printed copy at the owner's home, encrypted copy in a personal cloud account, copy held by managed IT provider]
• Approved by: [Name, title, date]

Disaster Recovery Plan Example: A 20-Person Accounting Firm

Templates are easier to fill in once you've seen a finished one. Here's a condensed disaster recovery plan example for a fictional 20-person accounting firm in Riverside County:

• Scope: Microsoft 365, a tax and accounting application on an in-office server, the file server, VoIP phones, and 22 laptops.
• Team: The managing partner is DR coordinator, the office manager handles communications, and the firm's managed IT provider is technical lead with a 24/7 line.
• Priorities: Internet first (RTO 4 hours), Microsoft 365 second (RTO 4 hours, RPO 8 hours), tax application third (RTO 8 hours, RPO 1 hour). During tax season, the tax application moves to priority one.
• Backups: An on-site backup appliance snapshots the server hourly and can run it as a virtual machine if the hardware dies. A locked cloud copy is kept for 90 days. Microsoft 365 is backed up separately three times a day.
• Office-unavailable scenario: Staff work from home on company laptops, the main line forwards to the office manager's mobile, and the tax application runs from the cloud copy.
• Testing: A tabletop exercise each October before tax season and a quarterly test restore of the tax database.

The whole plan runs about eight pages. That's normal for a business this size. A shorter plan that people read is better than a long one they don't.

What Recovery Looks Like With and Without a Plan

It's easy to treat DR planning as paperwork until you see the difference it makes in the first day of an incident. Here's how a ransomware attack discovered at 8 a.m. on a Monday typically unfolds for two otherwise identical businesses:

Neither business avoided the attack. The difference is that one made its decisions in advance, calmly, while the other had to make them under pressure with missing information. That's the real value of filling in a disaster recovery plan template before you need it: the hard choices about priorities, contacts, and communication are already settled.

The timeline above also shows why the plan and the backups have to match. A well-written plan can't recover data that was never protected, and great backups don't help much if nobody knows where they are or how to restore them.

Southern California Risks Your Plan Should Cover

Generic templates are written for anywhere. If your business is in the Inland Empire, Orange County, Los Angeles, or San Diego, add these regional risks to Section 5 of your disaster recovery plan template:

• Public Safety Power Shutoffs. During high-wind and fire-weather events, utilities such as Southern California Edison and SDG&E may cut power to reduce wildfire risk. Shutoffs can last a day or more. Plan for battery backup that lets servers shut down cleanly, and know which systems keep running from the cloud.
• Wildfire and smoke. Even when your building is safe, evacuation orders and road closures can keep staff out of the office for days.
• Earthquakes. Servers and network racks should be secured, and your offsite backups should be far enough away that a regional quake doesn't affect both copies.
• Extreme heat. Server closets without dedicated cooling can overheat during heat waves, especially if building air conditioning shuts off on weekends.

For a quick overview of the planning process as a whole, this short video from TechTarget's Eye on Tech covers the core steps:

How to Keep Your Disaster Recovery Plan Current

A disaster recovery plan template is only useful if the finished plan reflects how your business works today. Most plans go stale within a year because nobody owns the updates. Build these habits in:

1. Assign a single owner. One named person is responsible for keeping the plan current and scheduling tests.
2. Review it after every change. New software, a new office, a departing employee in a listed role, or a new IT provider should all trigger an update.
3. Run a tabletop exercise once a year. Walk the team through a realistic scenario, like ransomware on a Friday afternoon, and note where people hesitate. Our step-by-step guide on how to test your disaster recovery plan shows how to run one.
4. Test restores every quarter. Actually restore a server or database and time it. Compare the result to the RTO in Section 3.
5. Update after real incidents. Even small outages teach you something. Add what you learned within a week, while it's fresh.

Common Mistakes When Using a DR Plan Template

• Storing the only copy on the network. If ransomware encrypts your file server, it encrypts the plan too. Keep printed and offline copies.
• Listing systems without priorities. A list of 20 systems with no ranking doesn't tell anyone where to start.
• Writing for the person who already knows. Steps like "restore the server the usual way" are useless if that person isn't available.
• Forgetting cloud apps. Many businesses document their server carefully and leave out Microsoft 365, which is often where most of their data lives.
• Setting targets the backups can't meet. A 1-hour RPO means nothing if backups run once a night. Check Section 3 against Section 4.
• Never testing. An untested plan feels reassuring right up until the moment you need it.

How TechWorks Helps You Build and Test Your DR Plan

TechWorks helps Southern California businesses turn a blank disaster recovery plan template into a plan that works under pressure. Through our data backup and disaster recovery services, we:

• Inventory your systems and help you set realistic RTO and RPO targets for each one.
• Design backups that meet those targets, including protected cloud copies and Microsoft 365 backup.
• Document step-by-step restore procedures for your specific environment.
• Run tabletop exercises and scheduled restore tests, then update the plan with what we learn.
• Serve as your 24/7 technical lead when something goes wrong.

If your recovery plan lives in someone's head or a folder nobody has opened in years, contact TechWorks to schedule a DR planning session. We'll help you complete the disaster recovery plan template for your business and test it before you need it.