Disaster recovery for small teams

This is one of those topics that looks small until it costs you something. Most advice about disaster recovery assumes a team that does not exist at your size. Here is the version that does not.

Security is a maintenance habit rather than a purchase, which is why it drifts. It is worth deciding this deliberately rather than inheriting whatever the last person set up.

What to keep

Ask how long you could be down before it really hurts. The cost of getting this wrong is rarely visible on the day it happens. The failure mode is not doing it wrong, it is doing it once and assuming it stays done.

What to drop

Process that exists to coordinate ten people is overhead when there are two of you. This is the sort of thing that compounds, quietly, in both directions.

Where to start

Practise the recovery at least once a year. None of that requires a large budget, only a decision and someone to own it. Budget a little time for it every quarter and it never becomes a project of its own.

The short version

The realistic threat for most small businesses is automated and opportunistic, not targeted. Three things worth confirming about disaster recovery before you move on:

• Someone can say what the current setup is without going to look
• That answer sets your budget — and you know whether that is true here
• There is a way to tell whether the last change to this helped

Most of the value here comes from doing the first two things, not all of them.