Disaster recovery plan template for small business
A disaster recovery plan template is a fill-in document that lists your critical systems, who does what, where your backups are, and the steps to get everyone working again after an outage or cyberattack. The free template on this page is three pages long, in eight sections, with a filled-in example for a 20-person engineering firm.
I'm Igor Dobrovolskiy, founder of As-Built IT in Raleigh. Before starting the company, I helped lead the technical recovery after a cyberattack across about 90 locations, which is where I learned what a recovery plan is actually for.
Most small firms do have a disaster recovery plan. It lives in Gary's head, it has never been written down, and Gary is on a plane right now (he always is, when it matters).
So let's get it out of Gary's head and onto paper. Download the free disaster recovery plan template (PDF), then read on for what to put in each section.
On this page: The 8 sections · Contacts · Critical systems · Backups · The first hour · Working while down · Review · Business continuity · Questions
What goes in an IT disaster recovery plan template
An IT disaster recovery plan template needs eight things: the basics, contacts, critical systems, backups, roles, first steps, a way to keep working, and a review log. Big organisations' templates run long, which is great if you have a department whose whole job is reading them.
For comparison, the University of Southern California's template covers recovery sites, phone carriers and staff training calendars. Ours is built for a firm of 5 to 50 people.
Sample disaster recovery plan: a made-up 20-person engineering firm
To make the template less abstract, the grey example text in it belongs to a made-up 20-person engineering firm with one office, a file server and a lot of Revit. No real firm was harmed in the making of this example.
Sections 1 and 2: plan basics and emergency contacts
Section 1 names the plan owner, a backup owner, and where copies are kept. Keep one printed and one in the cloud, because a plan saved only on the server that just died is a beautifully formatted paperweight.
- Plan owner and backup plan owner, by name
- IT support's phone number, written down, not “in my phone somewhere”
- Internet provider and building manager
- Key software vendors, like your Autodesk reseller
Section 3: critical systems, in recovery order
Section 3 is the heart of the plan: every system the firm relies on, ranked by what has to come back first. For each one, write the longest it can be down and how much recent work you could live without losing.
Those are the sample firm's answers, not a rule. The jargon versions are RTO and RPO, explained in backup and disaster recovery, explained. Spoiler: Gary's head has an RTO of one holiday.
Left: recovery order, most urgent first. Right: the backups section, where you prove the copies exist.
Section 4: your backups, and when they were last tested
Section 4 lists what's backed up, where the copies live, how you know the backup ran, and when someone last restored from it. That last column is the one most firms leave blank, and it's the only one that proves anything.
Servers and file storage, Microsoft 365, staff laptops and project archives all belong on the list. If you want those backups run and tested for you, that's what our backup and disaster recovery services do.
Sections 5 and 6: who does what, and the first hour
Section 5 names who decides it's a disaster, who leads the recovery, and who talks to staff and clients. Section 6 is the first hour, written as steps simple enough to follow while your heart rate does a drum solo.
- If ransomware is suspected, disconnect the affected computers from the network
- Call the plan owner and IT support, even if it might be nothing
- Work out what's affected and what still works
- Tell staff what to do, and what not to touch
- Restore systems in the order from section 3
- Check restored files open and save before everyone starts again
- Tell clients early about any deadline at risk
- Write down what happened, when, and what you'd change
Section 7: working while systems are down
Section 7 answers three questions: where staff will work, how they'll reach the files they need, and which deadlines are at risk. For a design firm, the third one matters most, because the submittal date does not care about your server.
Section 8: testing and reviewing the plan
Section 8 is a short log of when the plan was reviewed and when a restore was last tested. Review it whenever your people, systems or offices change, and fix whatever surprised you.
A plan that's never reviewed slowly fills with phone numbers for people who left and servers you sold. It's like a fridge, basically: open it occasionally, or something in there will become a science project.
Business continuity and disaster recovery: do you need two templates?
A business continuity and disaster recovery plan template simply combines the two: continuity keeps the firm working, and recovery gets the systems back. For a small firm, one document covering both is plenty, which is why sections 6 and 7 of our template do both jobs.
What I learned about recovery plans the hard way
The cyberattack recovery I helped lead, across about 90 locations, was mostly about coordination: rebuilding the network, restoring connectivity and helping people get back to work, in the right order.
At a construction company of about 75 people hit by ransomware mid-project, bringing the most urgent systems back first is what kept the projects moving. That's section 3 of the template, done under pressure.
A recovery plan doesn't stop the bad day. It stops the bad day from also being a confused day.
Recovery plan mistakes we see most often
- The plan only exists in one person's head
- The only copy is saved on the server that just failed
- No recovery order, so everything is “most urgent”
- Contact numbers that went stale two hires ago
And the classic: a lovely plan, written once, never tested. Gary wrote that one. We've talked to him.
Disaster recovery plan template questions
What is a disaster recovery plan template?
A fill-in document that lists a business's critical systems, contacts, backups, roles and recovery steps, so the business can get working again after an outage, a failure or a cyberattack.
What should a disaster recovery plan include?
Plan basics, emergency contacts, critical systems in recovery order, backup details, who does what, first steps, how staff keep working, and a testing and review log.
Is there a free disaster recovery plan template PDF?
Yes. Download our free disaster recovery plan template, a three-page PDF for small firms, with a filled-in example.
How long should a small business disaster recovery plan be?
In our view, a few pages is enough for a firm of 5 to 50 people, as long as it covers contacts, recovery order, backups and first steps. A short plan people actually read beats a long one nobody opens.
How often should a disaster recovery plan be tested?
Whenever your people, systems or offices change. The University of Southern California's template schedules its plan tests annually.
Where to go from here
Download the free template, fill it in, and print a copy. If your firm is in Raleigh or the Triangle, see how our backup and disaster recovery services run the backups and recovery behind it, or book a free 30-minute call.
And please, let Gary see the finished plan. He deserves a holiday without his phone ringing.
About the author
Igor Dobrovolskiy founded As-Built IT in Raleigh in 2026 after 15 years in IT, including helping lead the technical recovery after a major cyberattack at a global enterprise. He would like every firm to have a recovery plan, even if the first draft is on a napkin.