Business Continuity & Disaster Recovery for Nonprofits

Continuity vs. Disaster Recovery: Two Different Jobs

People use these terms interchangeably, but they answer different questions, and a good plan needs both.

DR is a subset of BC. You can recover every server in an hour and still fail your mission if staff cannot reach the building, payroll bounces, or vulnerable clients have nowhere to go. Plan for the mission first, then make sure the technology supports it.

Start With a Business Impact Analysis (BIA)

A Business Impact Analysis is the foundation of everything else. As Ready.gov puts it, a BIA “predicts the consequences of a disruption to your business” and gathers the information you need to build recovery strategies. You are answering three questions for each thing your nonprofit does:

1. Which functions are critical? Not everything is. Distinguish life-safety and mission-critical services (e.g., a shelter bed, a meals route, medication delivery) from things that can wait (e.g., the annual gala planning).
2. What is the impact if it stops — and does that impact grow over time? A missed payroll on day 1 is survivable; on day 14 you lose staff.
3. What is the maximum tolerable downtime (MTD)? The longest a function can be unavailable before the harm becomes unacceptable — to clients, to finances, to reputation, or to legal standing.

Download the free Ready.gov Business Impact Analysis Worksheet (PDF) and have each program lead complete one for their area. When you collect them, you get an organization-wide picture of what must be protected first.

Notice how the rankings fall out naturally: cold storage and meal distribution are protected first; the website can wait. The BIA is what stops you from spending your scarce recovery energy on the wrong things.

RTO & RPO in Plain English

Two acronyms drive every disaster-recovery decision. They sound technical, but the ideas are simple.

• RTO — Recovery Time Objective: the target time to get a function back up. “We need the case-management system running again within 4 hours.” RTO answers how long can we be down?
• RPO — Recovery Point Objective: the maximum amount of data you can afford to lose, measured backward from the moment of failure. An RPO of 1 hour means you must be able to restore to a point no more than an hour before the incident — so you must back up at least hourly. RPO answers how much work can we afford to redo?

Think of a flight you must catch. RTO is how long you can survive being stranded at the airport. RPO is how far back your last “save point” is — how much luggage you are willing to leave behind.

Your RTO must be shorter than the maximum tolerable downtime you found in the BIA — if MTD is 24 hours, an RTO of 36 hours fails. And your RPO sets your backup frequency: an RPO of one day is fine with nightly backups; an RPO of one hour is not.

Backups: The 3-2-1 Rule (and Why Offline Matters Now)

You cannot meet any RPO without good backups, and the canonical standard — cited by US-CERT/CISA in its Data Backup Options publication — is the 3-2-1 rule:

• 3 copies of any important file (the original plus two backups);
• 2 different media or storage types (e.g., a local drive and the cloud), so one failure mode does not take out everything;
• 1 copy stored offsite — physically away from your building.

Two rules nonprofits break constantly:

1. Untested backups are not backups. Schedule a restore drill at least twice a year. The first time most teams try, they discover the backup was incomplete, corrupted, or missing a key folder.
2. SaaS data is your responsibility. Cloud apps for donations, email, and files protect their infrastructure, not your data from your mistakes. If a staffer deletes a year of records or an account is compromised, you may need your own export to recover.

Incident-Response Basics

When something goes wrong at 2 a.m., nobody should be inventing a process. An incident-response plan (IRP) is a short, pre-agreed sequence so people act instead of freeze. For a cyber incident or data breach, the FTC’s “Data Breach Response: A Guide for Business” organizes the work into three moves:

1. Secure your operations. Take affected systems offline (do not wipe them — you may need them as evidence), change credentials, and assemble a response team that can include IT, legal, leadership, and communications.
2. Fix the vulnerability that allowed it, and verify the attacker no longer has access before you reconnect.
3. Notify the right people — affected individuals, law enforcement, and any regulators or funders your obligations require. The FTC guide even includes a model breach-notification letter you can adapt, and points people to IdentityTheft.gov.

One clear rule prevents a second disaster: do not pay a ransom on impulse. Federal guidance discourages paying because it does not guarantee recovery and funds further crime. Report ransomware to CISA and the FBI through the channels in the #StopRansomware Guide, and involve your insurer and counsel before deciding anything.

Emergency Communications & the Call Tree

In a crisis, the failure is almost never a lack of goodwill — it is that nobody knows who to call, on what number, in what order. A call tree (sometimes called a phone tree or notification cascade) solves this: one person notifies a small group, each of whom notifies the next, so the whole organization is reached in minutes without one person making forty calls.

Make the call tree work under real conditions:

• Store it offline. If the contact list lives only in the system that is down, it is useless. Keep a printed copy and an offline copy on key people’s phones.
• List two channels per person — phone and a non-work email or text — because the disruption may have taken out your normal channel.
• Name one spokesperson. Mixed messages erode trust faster than silence. Everyone else routes media and rumor to that person.
• Pre-draft holding statements. The National Council of Nonprofits emphasizes timely, honest communication after a disaster — a short “we are aware, here is what we know, here is what to do” holding statement buys you time to confirm facts.

Insurance That Actually Pays Out

Insurance is your financial recovery plan. Three coverages matter most for continuity, and nonprofits routinely carry the first while missing the other two.

• Property insurance covers physical damage to your building, equipment, and inventory. Most organizations have this — but check whether it covers flood (often a separate policy) and whether your contents are insured at replacement cost rather than depreciated value.
• Business interruption insurance replaces lost revenue and covers continuing expenses (rent, payroll) while you are shut down after a covered event. This is the coverage that keeps the lights on during recovery, and it is the one nonprofits most often lack. Confirm it is included and understand the waiting period before it pays.
• Cyber liability insurance covers the costs of a breach or ransomware event — forensics, legal notification, credit monitoring for affected clients, and sometimes business interruption from a cyber cause. Insurers increasingly require basic controls (multi-factor authentication, tested backups, staff training) as a condition of coverage.

Whatever your coverage, keep a current, photographed or video inventory of equipment and a copy of your policies in your offsite backup. Claims move faster when you can prove what you lost.

The Human Side: Staff Safety, Payroll & Vulnerable Clients

A continuity plan that protects servers but not people has its priorities backwards. Three human commitments belong at the top of every plan.

1. Staff and volunteer safety comes first. No data, building, or deadline is worth a life. Your plan should state, plainly, that in a life-safety emergency people evacuate or shelter first and account for one another before anyone thinks about operations. Maintain an up-to-date roster and a simple “all-accounted-for” check-in method.

2. Payroll continuity. Staff who are not paid cannot keep serving — and a missed payroll can trigger legal and trust problems quickly. Make sure more than one trusted person can authorize payroll, that you can run it remotely, and that the credentials and process are documented somewhere a backup person can reach in an emergency. This single point of failure — only the ED can pay people — sinks more small nonprofits in a crisis than any technical outage.

3. Preserve mission-critical services for vulnerable clients. For the people you serve, a disruption to your services is the disaster. Decide in advance, for each critical service:

• Who depends on it, and what happens to them if it stops for a day, a week, a month;
• A minimum viable version — e.g., a reduced meal route, a phone check-in instead of an in-person visit, a warm hand-off to a partner agency;
• Backup partners — a written, reciprocal agreement with a peer organization to cover each other’s clients in an emergency.

Continuity for a nonprofit is not really about the organization surviving — it is about the people who would have nowhere else to turn if you didn’t. That is what you are protecting.

A Worked One-Page Continuity Plan

A plan nobody can read in a crisis is a plan nobody will use. Capture the essentials on a single page, store it offline, and review it twice a year. Here is a filled example for a small community nonprofit — copy the structure and replace the contents with your own.

Build yours on the free Ready.gov Business Continuity Plan template (PDF), fill in the gaps with your BIA results, and you have a working plan in an afternoon — not a binder that gathers dust.

FAQ