Disaster Recovery and Business Continuity for SMEs

Most businesses only discover the state of their backups on the worst possible day. Disaster recovery and business continuity planning is about making sure that day is survivable: that you know how quickly you can be back, how much you might lose, and that your plan actually works when you need it. This guide explains the key ideas in plain English and how a UK SME can build a plan that holds up under pressure.

Two terms that are often confused

Business continuity (BC) is the whole-business plan for carrying on through a disruption, whether that is a fire, a flood, a cyber attack or a key supplier failing. It covers people, premises, communications, suppliers and processes. Disaster recovery (DR) is the IT slice of that: how you restore your systems and data. You need both, and DR sits inside BC. A perfect data restore is little use if staff have nowhere to work and no way to answer the phones.

The two numbers that shape everything: RTO and RPO

Before any technology, agree two numbers for each important system:

• RTO (recovery time objective) — how quickly you must be back up and running. If your order system can be down for four hours but not four days, your RTO is four hours. RTO drives how much you invest in fast failover and standby.
• RPO (recovery point objective) — how much data you can afford to lose, expressed as time. If losing an hour's work is tolerable but a day's is not, your RPO is one hour. RPO drives how often you back up.

These are business decisions, not technical ones, and they differ by system: your finance database may need a tight RTO and RPO, while an archive can tolerate a loose one. Setting them honestly stops you either under-protecting a critical system or overspending on one that does not matter.

Backups: the 3-2-1 rule

Backups are the backbone of recovery, and the widely used standard is 3-2-1: three copies of your data, on two different types of media, with at least one copy kept off-site or offline. The off-site or offline copy is the one that matters most against ransomware, which increasingly tries to encrypt or delete the backups it can reach along with your live data. The NCSC's backup guidance sets out the principles for small businesses.

Two common blind spots: cloud data and the leaver's laptop. Cloud services such as Microsoft 365 are your responsibility to back up, not the provider's, and data that lives only on individual devices is not backed up unless you have arranged it. Make sure your 3-2-1 covers everything the business actually depends on.

Building a plan that works

A workable SME plan does not need to be a huge document. It needs to answer a few questions clearly:

1. What are our critical systems and data, and what are their RTO and RPO?
2. How do we restore each one, from where, and who does it?
3. Where do people work if the office is unavailable, and how do we communicate?
4. Who does what in the first hour: a short list of roles and contacts.
5. Who do we need to tell, including customers, and any regulator or the ICO if personal data is involved?

Keep the plan, and the key contacts, somewhere you can reach even if your systems are down, for example a printed copy and an offline copy. A plan that only exists on the server you are trying to recover is no plan at all.

Test it, or it isn't real

The step almost everyone skips is testing. A backup you have never restored from, and a plan you have never walked through, are assumptions. Schedule a test at least once or twice a year and after any significant change: restore a real system to a safe place, confirm it works and how long it took, and walk the team through their roles. Each test turns a hopeful document into a proven capability, and surfaces the gaps while the stakes are low. This discipline is part of good IT infrastructure management.

Where cyber attacks fit

For most SMEs today, the most likely "disaster" is a cyber attack, especially ransomware. Recovery planning and security go hand in hand: strong prevention reduces how often you need the plan, and a tested, offline backup is what lets you refuse a ransom and restore instead. Our ransomware action plan covers the incident response, and a cyber security checklist covers the prevention that keeps you out of trouble in the first place.

A simple business continuity plan

An SME plan does not need to be a weighty document; it needs to answer the right questions on one or two pages:

• Critical functions: the handful of things the business must be able to do (take orders, pay people, serve customers).
• Systems and data behind them, each with an agreed RTO and RPO.
• Recovery steps: how each system is restored, from where, and by whom.
• Alternate working: where people work and how they communicate if the office or main systems are unavailable.
• Roles and contacts: who does what in the first hour, with phone numbers.
• Who to notify: customers, key suppliers, insurers, and any regulator or the ICO if personal data is involved.

Keep it somewhere reachable when systems are down, a printed copy and an offline copy, not only on the server you might be trying to recover.

Scenarios worth planning for

You do not need a plan for every possibility, but a few cover most real-world disruption:

• A cyber attack, especially ransomware, now the most likely serious incident for most SMEs.
• Loss of premises through fire, flood or an access problem.
• A key supplier or cloud outage, including your IT or telecoms provider.
• Loss of a key person who holds knowledge or access nobody else has.

Walking through even these four exposes gaps, such as a system only one person knows how to restore, that are far cheaper to fix in advance.

Where backups commonly fail

Most recovery failures trace to a handful of avoidable mistakes: a backup that was never tested and turns out to be incomplete or corrupt; a backup held on the same network, so ransomware encrypts it too; an assumption that the cloud is backed up when it is not; and a retention window too short to cover a problem found weeks later. The fixes are the 3-2-1 rule, an offline or immutable copy, explicit backup of cloud data, and, above all, regular restore tests.

Talk to Omega IT

Omega IT helps UK businesses set sensible RTO and RPO targets, put resilient backups in place and test recovery, as part of our managed IT support.

Sources

• NCSC: Backing up your data (Small Business Guide)
• NCSC: Small Business Guide to cyber security

General guidance, accurate to October 2026. Diagrams by Omega IT.