Hurricane disaster recovery plans for business data and IT

When Hurricane Ida came ashore in 2021, the National Hurricane Center reported that all power was lost in Jefferson and Lafourche Parishes, and Pointe Coupee Parish, just northwest of Baton Rouge, lost power across about half its area. For many organizations the building survived. What they couldn’t do for days or weeks was open their files, run payroll or answer the phone, which is the gap a hurricane disaster recovery plan exists to close.

That plan covers your data, computers and phones. We have been in Baton Rouge since 2003, and our owner, Chad Odom, was the technician on site for our clients through Katrina and Ida.

How a hurricane stops work when the office stays dry

A storm doesn’t have to flood your office to shut you down. The usual IT damage comes from what happens around the storm:

• Power outages that outlast your battery backups.
• Internet and phone outages when carrier lines and cell towers go down.
• Water from roof leaks and wind-driven rain, which ruins anything sitting on the floor.
• Power surges when utilities restore service or a generator is connected improperly.
• Staff who evacuate to other cities and can’t reach the office for days or weeks.

Any one of these stops work, and they tend to arrive together.

In the spring: build and test the plan

The National Weather Service says the best time to prepare is before the season begins on June 1. For your IT, that means working through these steps:

1. List your critical systems: email, files, line-of-business software, accounting, phones, and anything clients or patients depend on.
2. Set a recovery time objective and a recovery point objective for each one. Those two numbers drive every other decision.
3. Move what you can to the cloud. Microsoft 365 email and files keep running when your building has no power, and a hosted phone system can ring on staff cell phones or laptops.
4. Back up everything that stays on site, with a local copy for fast restores and an encrypted cloud copy stored well outside the Gulf Coast.
5. Back up Microsoft 365 data too. Microsoft keeps the service running, but deleted or encrypted data still needs its own backup.
6. Write down contacts for staff, your IT provider, carriers, landlord and insurance agent, and keep a copy outside your email system.
7. Restore a few files and one full system, then run a short tabletop exercise: the office is closed for two weeks, now what?

Our guide to the essentials of a business continuity plan covers the wider business side, including vendors and client communication.

When a named storm is in the forecast

This is the part we run for our clients. Once a named storm threatens the area, we send each client a notice and a checklist, verify their backups and the off-site copy, run controlled shutdowns and UPS checks, and confirm that remote work and cloud failover are ready. Our clients’ off-site backup copies are stored in the US.

Inside your office, most of the rest takes an afternoon:

• Make sure every employee can sign in remotely with MFA working on their phone, and send laptops home with the people who need them.
• Forward the main phone lines or record a storm greeting.
• Photograph equipment and serial numbers for insurance claims.
• Lift computers and network gear off the floor and away from windows, and cover them with plastic if a roof leak is possible.
• Shut servers down cleanly before the power goes, then unplug equipment to protect it from surges.
• Tell clients how to reach you and where you will post updates.

A battery backup only buys minutes, so the controlled shutdown matters. We monitor our clients’ UPS units remotely, so we can see their status before and during a storm. Our post on UPS battery backup explains what one can and can’t do.

After the storm

Check power and equipment before turning anything on

Don’t power on equipment that got wet. Have your IT provider inspect it first. When power returns, bring up the network, then servers, then workstations. If you are on a generator, use proper surge protection and battery backups so dirty power doesn’t damage equipment.

Restore in priority order

Follow your list. Communication comes first, then the systems that bring in revenue or serve patients and clients, then everything else. If on-site equipment is a loss, restore critical systems from backup to the cloud or to replacement hardware while the insurance claim works its way through.

Watch for post-storm scams

The FTC warns that scammers take advantage of weather emergencies with fake contractors, fake charities and people posing as government agencies. Invoice and payment-change fraud also rises when everyone is distracted. Verify any request to change bank details by calling a number you already have, and remind staff that IT will never ask for their password by text.

Plan for a long recovery

Some recoveries run for months. After Ida, we supported a nonprofit’s disaster case management program for 18 months, with devices, systems, staff onboarding, reporting and HR support. Our post on what your IT partner should do when disaster hits covers that longer stretch.

What HIPAA expects, and why other offices with sensitive records should follow it

The HIPAA Security Rule requires covered entities and business associates to have contingency plans for emergencies, including natural disasters, that damage systems holding electronic protected health information. It requires a data backup plan, a disaster recovery plan and an emergency mode operation plan, so critical processes that protect patient data keep running. Testing the plan and ranking which applications matter most are addressable.

Accounting firms, financial businesses, law firms and nonprofits face similar questions from regulators, cyber insurers, funders and clients. A written, tested plan is the answer they want to see.

Common gaps in hurricane plans

• Backups that run every night but have never been test-restored.
• A backup drive in the same office as the server it protects.
• Contact lists that exist only in email.
• Staff without laptops, remote access or MFA before they evacuate.
• A single internet connection with no second carrier or cellular failover.
• No plan for when the one person who knows everything is unreachable.

None of these cost much to fix, but they need fixing in May, before a storm enters the Gulf. Book an intro call and we’ll go through how your organization would come back from a direct hit, or help you write a plan through our business continuity and disaster recovery services.

Sources: National Hurricane Center, Tropical Cyclone Report: Hurricane Ida (2021); National Hurricane Center, Tropical Cyclone Climatology; National Weather Service, What to Do Before the Tropical Storm or Hurricane; eCFR, 45 CFR 164.308 (HIPAA administrative safeguards); FTC, Dealing with Weather Emergencies.