A disaster recovery plan is a short, written set of instructions for getting your business running again after something breaks. It names what matters most, who does what and how long each system can stay down. It is not a thick binder. For most small and mid-sized offices, a clear plan fits in a few pages.
San Diego has its own mix of risks. Wildfire smoke and power shutoffs, a Santa Ana wind event, a water leak in a Downtown tower, a ransomware email that lands in Kearny Mesa, or a failed server in Sorrento Valley. Most of these are small events that turn big because nobody wrote down the next step. Good business data backup is the foundation, but backups alone do not tell your staff what to do at 7 a.m. when the office is dark.
This guide walks you through building the plan yourself. You will list your systems, set recovery targets, pick a recovery method, write the steps and test them. Plan on a few focused sessions rather than one long meeting. Read it through once, then work on your own business as you go.
What a Disaster Recovery Plan Actually Covers
A disaster recovery plan answers four questions. What could go wrong? What do we need back first? How do we get it back? Who makes the calls while it happens? If your plan answers those four clearly, it is doing its job.
The plan focuses on technology: servers, laptops, cloud accounts, phones, internet, line-of-business software and the data inside them. It is a close cousin of a wider continuity plan, which also covers people, space and suppliers. If you want that bigger view, business continuity consulting helps you connect the two.
Keep one idea in mind as you write. The plan is for a stressed person who did not write it. Short sentences, numbered steps and phone numbers beat clever wording every time.
A printed copy of the plan matters, because your shared drive may be the thing that is down.
List What You Run & Rank What Matters
Start with an inventory. Write down every system your business touches in a normal week. Include the obvious ones and the quiet ones that people forget until they fail.
- Email, calendar and file sharing
- Accounting, billing or practice management software
- Customer or client database
- Phones and voicemail
- Internet connection and the firewall behind it
- Laptops, desktops and any office servers
- Printers, scanners and badge or door systems
- Cloud accounts, domain name and website hosting
Next, rank each item. Ask one question: if this were gone for a full day, what would stop? A law firm near the courthouse may rank document management first. A Gaslamp restaurant group may rank the point-of-sale system first. A Mission Valley hotel office may rank booking and phones. Your ranking will not match anyone else’s, and it should not.
Give each system an owner, meaning one named person who knows where it lives and who to call. Owners keep the plan alive when staff change.
Set Recovery Targets: RTO & RPO
Two terms drive almost every decision in a recovery plan. They sound technical, but the ideas are simple.
- Recovery time objective (RTO): how long a system can be down before it hurts the business badly.
- Recovery point objective (RPO): how much recent work you can afford to lose, measured in time. An RPO of four hours means you accept losing up to four hours of changes.
Set both for each ranked system. Be honest. Everyone wants zero downtime and zero data loss, but each step toward zero costs more. A system you can live without for two days needs a far simpler setup than one that must return in an hour.
| System | Example RTO | Example RPO | What that usually means |
|---|---|---|---|
| Phones & voicemail | 1 hour | Not applicable | Cloud phone with a forwarding plan |
| Email & calendar | 4 hours | Near zero | Hosted email with separate backup |
| Accounting software | 1 business day | 4 to 24 hours | Nightly backup, tested restore |
| Main file shares | 4 to 8 hours | 1 to 4 hours | Frequent backup plus fast restore |
| Archived projects | 3 days | 1 week | Low-cost cloud storage |
These numbers are examples. Your own will depend on how you earn money and what your clients expect.
Most small offices end up with only three or four distinct recovery tiers once they rank honestly.
Know the Risks That Fit San Diego
A plan works best when it reflects the events you are most likely to face. Generic plans miss local detail. Think through these and note which ones apply to your building and your staff.
Power & Weather
Heat waves strain the grid, and utilities in Southern California sometimes cut power during high fire-weather days. Rolling outages hit offices in East County and the backcountry edges more often, but any business can lose power. Battery backup units give you minutes, not hours. Decide in advance who shuts down servers safely and who tells staff to work from home.
Fire, Smoke & Access
Wildfire seasons bring road closures and poor air quality. Your office may be fine while your team cannot reach it, or the other way around. A plan that assumes everyone can work remotely from day one needs cloud-based tools and tested remote access.
Buildings & Water
Older converted spaces in Little Italy and downtown towers both have plumbing above ceilings and equipment closets. A single burst pipe can take out a network rack. Keep gear off the floor and away from water lines where you can.
Cyber Events
Ransomware, a hijacked email account and a bad software update are far more common than earthquakes in the average office. Treat them as primary scenarios, not afterthoughts.
Choose How You Will Recover
There are a few common ways to bring systems back. Most businesses use a mix, matched to the targets you set earlier.
| Method | Best for | Typical recovery speed | Watch out for |
|---|---|---|---|
| Local backup copy | Fast restores of files & servers | Minutes to hours | Fails if the building is lost |
| Cloud backup | Off-site safety, remote teams | Hours, depends on data size | Slow first full restore |
| Replicated standby systems | Systems that cannot wait | Minutes | Higher monthly cost |
| Rebuild from scratch | Low-priority systems | Days | Needs documented settings |
Cloud-based copies protect you when the office itself is unreachable. Read about cloud backup services if your data is mostly in the office today. If your team lives in Microsoft’s tools, remember that those accounts need their own protection, which is covered by Office 365 backup.
Many offices pair local and cloud copies, then add tested restore steps. That combined approach is what backup and disaster recovery services usually deliver as one managed package.
A local backup device restores a failed server far faster than any download over the internet.
Write the Plan in Plain Steps
Now put it on paper. Use one short section per scenario, such as “Office has no power,” “Ransomware suspected” or “Main server will not start.” Keep each to a numbered list.
- Declare the event. Name who can officially call it a disaster and how they tell everyone else.
- Contact the right people. List cell numbers for owners, your IT provider, your internet carrier, your landlord and your insurance agent.
- Protect what is left. Disconnect affected devices if a cyber event is suspected. Do not wipe anything yet.
- Restore in priority order. Follow the ranking you made earlier, starting with the shortest RTO.
- Communicate. Use pre-written messages for staff and clients so nobody invents wording under stress.
- Record what happened. Keep a simple log of times and actions. You will want it later.
Store the plan in three places: a printed copy off-site or at home, a copy on a phone and a copy in cloud storage that does not depend on your office network. Include logins for critical vendors in a secure password manager that several trusted people can reach.
Test It Before You Need It
An untested plan is a guess. Backups that cannot restore are the most common surprise in a real emergency. You do not need a full-scale drill to find the gaps.
- Every month: restore one file or folder from backup and open it.
- Every quarter: walk through one scenario on paper with your owners and see who hesitates.
- Every year: restore a full system to a spare machine or test environment and time it against your RTO.
- After any big change: new software, new office, new staff in key roles. Update the plan the same week.
Write down what went wrong in each test and fix it. The goal is not a perfect score. The goal is fewer surprises next time.
If you need to pull back files that were lost before you had a plan, data recovery services can sometimes retrieve them from failed drives, though outcomes vary. Cost is a common question, and data recovery cost in San Diego explains what to expect.
A timed test restore tells you whether your recovery target is real or only hopeful.
Common Mistakes to Avoid
- Writing the plan once and never opening it again.
- Keeping the only copy on the server that might fail.
- Setting every system to the same urgent target, which makes the plan expensive and unfocused.
- Forgetting non-IT dependencies, such as your internet provider’s support line or your domain registrar login.
- Assuming cloud apps back themselves up. Most providers protect their platform, not your accidental deletions.
- Leaving out who talks to clients. Silence during an outage costs trust.
Compare how different approaches handle these risks before you commit to one.
| Approach | Giga San Diego | Do It Yourself | Backup Software Only |
|---|---|---|---|
| Written plan | Built with you, reviewed yearly | You write & maintain it | Usually not included |
| Restore testing | Scheduled & documented | When you remember | Rarely tested |
| Local risk fit | Planned around San Diego risks | Depends on your knowledge | Generic settings |
| Who answers at 2 a.m. | Your provider’s team | Whoever picks up | Vendor support queue |
| Cost pattern | Predictable monthly fee | Low cash, high time | Low fee, hidden gaps |
A disaster recovery plan does not need to be long or fancy. It needs to be accurate, stored where you can reach it and tested often enough that people trust it. Start with your ranked list of systems, set honest targets and write the first scenario this week.
If you would like a second set of eyes, ask for a free IT assessment. A technician will look at your backups, your recovery options and your biggest gaps, then give you a written quote in plain English. No pressure, and no obligation to continue.
FAQs
What should a disaster recovery plan include?
At minimum: a list of systems ranked by importance, recovery time and data loss targets for each, backup locations, step-by-step recovery instructions, contact numbers, and who makes decisions. Add a communication section for staff and clients, plus a schedule for testing and updating the plan.
How often should I test my disaster recovery plan?
Restore a sample file monthly, walk through one scenario each quarter and do a full system restore once a year. Also test after any major change, such as a new server, new software or a move to a new office. Regular small tests beat one large annual drill.
How much does a disaster recovery plan cost in San Diego?
Writing one yourself costs mostly time. Working with a provider typically adds a one-time planning fee or folds into a monthly backup and recovery service. Costs rise with the number of systems, tight recovery targets and standby systems. A free assessment gives you a firm number.
What is the difference between backup and disaster recovery?
Backup is a copy of your data. Disaster recovery is the full process of getting systems, access and operations working again, using those copies. You need both. A backup with no plan leaves people guessing, and a plan with no good backup has nothing to restore.
Do small businesses really need a disaster recovery plan?
Yes. Small offices often have fewer spare resources and less tolerance for downtime. A short plan, even three pages, removes guesswork during an outage. It also helps with insurance conversations and with clients who ask how you protect their information.
Tyler Navarro
Editorial Director, Giga San Diego
Tyler runs the Giga San Diego editorial desk and turns what our technicians see every week, from Santa Ana wind outages to office moves along I-5, into practical guides for San Diego business owners. He grew up in the county and has spent more than 15 years in IT services, starting on a help desk in Kearny Mesa and later leading network and support projects for biotech firms, clinics, logistics companies and defense suppliers. He holds Microsoft 365 and CompTIA Security+ certifications. Lately he focuses on how AI tools such as Microsoft Copilot can help small teams without exposing sensitive data, and every guide he writes is reviewed by a working technician before it goes live.