Disaster recovery for SMEs: what happens after a fire, flood or theft

Most companies think of ransomware when they hear "backup". But a fire in the server room, a flood on the ground floor or the theft of a laptop with critical data is just as devastating — and much harder to anticipate. Unlike ransomware, these events give no warning. One day everything works; the next, there's nothing left to restore.

The physical threats companies systematically ignore

Cyber threats get all the attention, while physical risks are almost ignored in SME IT planning. Here's what actually happens:

• Fire: a short circuit in the fuse box, coffee spilled on the UPS or a fire starting elsewhere in the building — equipment is completely destroyed, including the NAS if it's in the same office.
• Flood: a burst pipe on the floor above or an unexpected flash flood can affect everything in the office — computers, NAS devices, switches, all of it.
• Theft: a stolen laptop means lost data, but also a potential GDPR incident if the device wasn't encrypted — with the obligation to notify the data protection authority within 72 hours.
• Catastrophic hardware failure: hard drives 5 years old or more have a significant failure rate. RAID is not backup — if the RAID controller fails, every drive in the array becomes inaccessible at once.
• Power cuts and surges: without a proper UPS, a power surge can burn out equipment, including the NAS, in seconds.

According to the IBM X-Force Threat Intelligence Index, 25% of incidents that lead to permanent data loss are physical, not cyber. A figure systematically ignored in conversations about IT security for SMEs.

Why local backup alone doesn't protect you from physical disasters

The scenario we see most often at small businesses: "We have a backup on an external drive in the cupboard." Sounds good until you realise the cupboard is in the same office as the computers. A fire, a flood or a major theft doesn't distinguish between the server and the backup drive if they're in the same physical space.

• The NAS in the same office as the server = destroyed by the same fire or flood
• An external drive next to the computer = stolen with the computer or burnt in the same fire
• A backup drive in the cupboard = same cupboard, same room, same physical risk

The 3-2-1 rule exists for exactly this reason: at least 3 copies of the data, on 2 different types of media, with at least 1 copy in another physical location or in the cloud. If you don't have at least one offsite copy, you don't really have a backup for physical disasters.

What "disaster recovery" means compared with simple backup

The two concepts are often confused, and that confusion costs dearly when an incident happens:

• Backup means you have copies of the data. That's all.
• A Disaster Recovery Plan (DRP) means you have a documented plan: where you restore from, in what order, who is responsible, how long it takes, and what happens to staff while systems are offline.

Without a plan, "we have a backup somewhere" turns, under the pressure of a real disaster, into a chaotic search for where exactly the copies are, who has the credentials and which hardware needs buying first. Lost hours quickly turn into days, and days into massive costs.

Real scenarios and how proper backup solves them

The components of a disaster recovery plan for an SME

A disaster recovery plan doesn't have to be a 100-page document. For an SME with 5–20 employees, it needs to cover 6 essential things:

1. An inventory of critical data: what has to be restored first — the client database, invoices, accounting — and what can wait a few hours or days.
2. Encrypted offsite backup: a copy in the cloud (Wasabi, Backblaze B2) or at a second physical location completely separate from the office.
3. RPO and RTO defined in writing for each category of data: how much data you can afford to lose (RPO) and how quickly you need to resume work (RTO).
4. Step-by-step restore procedures: not "we'll figure it out when it happens", but a ready document, accessible to and understood by at least two people in the company.
5. Clear responsibilities: who calls the provider, who buys new hardware, who communicates with clients and partners while systems are offline.
6. An annual test (at least): a full restore from backup in a test environment, to check that the plan works — not just that the backups technically run.

What it costs not to have a disaster recovery plan

Without a plan and without offsite backup, a fire or major theft means permanent data loss. There's no recovery. Client data, invoices, contracts, the company's entire operating history — gone for good. That's the scenario that closes companies down.

With offsite backup and a documented plan, the same event means a few hours of downtime, full recovery and business as usual. The difference between closing down and carrying on.

For an SME with 8 employees and monthly turnover of €60,000–80,000, 2 weeks of downtime means roughly €40,000–50,000 in lost revenue, excluding the cost of hardware recovery and IT consultancy.

Also read our article on the 3-2-1 backup rule to understand how to structure your layers of protection properly, and what a ransomware attack costs for a comparison with cyber threats.