top of page
Search

What Belongs in a Written Disaster Recovery Plan for a Texas Business

Writer: Dane Gray
Dane Gray
Nov 3
5 min read

Updated: Nov 4

Every business says it has backups. Far fewer have a written plan that says what happens next: who makes the call, which systems come back first, where people work, and how you tell customers. When the power is out, the server won't boot or ransomware has locked the shared drive, nobody wants to be making that up on the spot.

Texas adds its own reasons to write it down. Ice storms and grid emergencies, Gulf hurricanes that push heavy rain far inland, flash flooding and long summer heat all show up in Brazos Valley business continuity plans. This guide walks through what belongs in a written disaster recovery plan, section by section, so you can build one your team can actually follow.

Backup, disaster recovery and business continuity: what's the difference?

  • Backup is the copy of your data.

  • Disaster recovery is the plan and the tools for getting systems back after an outage, attack or disaster.

  • Business continuity is the bigger picture: how the business keeps serving customers while systems are being restored.

A written disaster recovery plan sits in the middle. It turns your backups into a set of steps. If you're still working out the backup side, start with our guide to business backup services; the same building blocks apply to Texas offices.

1. Who's in charge, and how to reach everyone

The first page of the plan should answer one question: who declares a disaster and who does what?

  • A named decision-maker and a backup for that person.

  • Phone numbers for staff, your IT provider, your internet and phone carriers, your bank, your insurer and key vendors, stored somewhere other than the systems that might be down.

  • A way to reach everyone if email is offline, such as a group text or a call tree.

2. A list of your systems, in priority order

List every system the business runs on: Microsoft 365 email and files, line-of-business apps, accounting, phones, the internet connection, printers and scanners, and any equipment in the office. Then rank them.

For each one, write down two things:

  • How long can we go without it? That's your recovery time objective.

  • How much recent work can we afford to lose? That's your recovery point objective.

Those two answers decide how each system should be backed up and how quickly it needs to be restored. They also tell you whether you need a ready-to-go recovery site or something simpler, which is the question our hot, warm and cold site guide helps you answer.

3. Where the backups are, and how to restore them

Write down what is backed up, where each copy lives and how to get it back:

  • An on-site copy for fast restores.

  • An off-site or cloud copy, away from your building.

  • At least one copy that can't be changed or deleted, so ransomware can't reach it.

  • A separate backup of Microsoft 365 data. Microsoft keeps the service running, but your data is your responsibility. See Does Microsoft 365 Back Up Your Data?

Include the restore steps themselves, or at least who performs them and where the instructions are kept.

4. Texas scenarios: power, storms and the building

Generic plans skip the events most likely to hit a Texas office. Write a short section for each:

  • Power loss and grid emergencies. Which equipment is on battery backup, what shuts down safely, and how long you can run. If you have a generator, who starts it and what it powers.

  • Severe weather and flooding. Where equipment sits in the building, whether anything is on the floor of a flood-prone room, and when to move or shut it down before a storm.

  • Loss of the building. Where people work if the office is closed: from home, at another location, or from a recovery site.

  • Internet and phone outages. A backup internet connection, how phones forward to mobiles, and what to do if your carrier is down. If your office still depends on copper phone, fax or alarm lines, note what replaces them.

5. A ransomware and cyberattack section

A cyberattack needs different steps from a storm, because the systems may still be running and the attacker may still be inside.

  • Who to call first: your IT provider, your cyber insurer's hotline and your bank.

  • How to isolate affected computers without wiping the evidence.

  • Which backups are known to be clean, and how to check before you restore.

  • Who decides about notifying customers, and who handles the legal side. Texas law sets requirements for notifying people when certain personal information is exposed.

A plan that matches what your insurer expects also makes claims easier. Many cyber insurance applications ask whether you have a written, tested plan like this one.

6. How you'll talk to customers and staff

Draft short messages ahead of time: a note to staff, a customer notice and a voicemail greeting. Decide who approves them and where they'll be posted if your website or email is down.

7. Testing and keeping the plan current

A plan nobody has tested is a guess. Build these into the calendar:

  • Test restores of files and whole systems on a regular schedule, with the results written down.

  • A tabletop exercise where the team walks through a scenario, such as "the office lost power before a big storm" or "the shared drive is encrypted."

  • Reviews after any big change, like a new office, a new key system or a change in staff.

A documented, tested plan also supports a written cybersecurity program, which can matter under Texas law. Our explainer on Texas SB 2610 covers how.

Get help writing your plan

24uNet helps businesses in Bryan, College Station and across Texas build disaster recovery plans that match how they actually work, then tests them with the team. Our business continuity services cover backup, recovery and planning, and our Texas cybersecurity program ties it into the rest of your security. Contact us to start with a review of what you have today.

FAQ

What should a disaster recovery plan include?

Contacts and decision-makers, a ranked list of systems with recovery goals, where backups live and how to restore them, steps for specific scenarios like power loss, storms and ransomware, communication templates, and a testing schedule.

What's the difference between a disaster recovery plan and a business continuity plan?

A disaster recovery plan covers restoring IT systems and data. A business continuity plan covers how the whole business keeps operating, including people, locations and customers, while that happens.

Does a small Texas business really need a written plan?

Yes. Written steps mean the plan works even when the person who knows the most is unavailable, and insurers and larger customers increasingly ask to see one.

How often should we test our disaster recovery plan?

On a regular schedule and after any major change. Test restores show the backups work; tabletop exercises show the people and steps work.

What disasters should a Texas business plan for?

Power and grid emergencies, ice storms, hurricanes and heavy rain, flooding, extreme heat, internet outages and cyberattacks such as ransomware.

Can 24uNet help write our plan in Bryan–College Station?

Yes. We help Brazos Valley businesses document, test and update their disaster recovery plans.

References

 
 
 

Comments

bottom of page