Property managers live in a world of constant small emergencies: a burst pipe at midnight, a lockout on a holiday, a furnace that dies during the first cold snap. Most managers handle those calmly because they've planned for them.

Technology emergencies deserve the same planning. When your property management software, payment portal, or email goes down, tenants can't pay rent, maintenance requests pile up, and owners start asking questions.

Here's what a property management disaster recovery plan should include.

Start With the Systems That Keep Properties Running

List every system your company depends on. For most property managers, that includes:

• Property management software for leases, rent rolls, and accounting.
• Tenant payment portals and bank connections.
• Maintenance request systems and vendor dispatch.
• Email and phones, including after-hours lines.
• Shared files such as lease documents, inspection photos, and owner reports.
• Access control systems for keyless entry or gate codes, if you manage them.

Know What Your Software Vendor Covers

Most property management platforms are cloud-based. That's helpful, but it doesn't mean recovery is entirely someone else's job. Ask your vendor:

• How often is our data backed up?
• How quickly can you restore it if something is deleted or corrupted?
• Can we export our data regularly as an extra safeguard?
• What is your typical uptime, and where do you post outage updates?

Then fill the gaps. Files stored on office computers, shared drives, or personal laptops usually need their own backups.

Protect Tenant and Owner Data

Property managers hold sensitive information: Social Security numbers from rental applications, bank account details, income verification, and background check results. A disaster recovery plan should make sure that information is:

• Backed up securely, with encryption.
• Stored in at least one location that ransomware can't reach.
• Restorable only by authorized people.

Ransomware is one of the most likely "disasters" a small business will face. Our guide on what every small business must do to prevent ransomware covers the prevention side.

Plan for Rent Day

The worst possible time for a payment system outage is the first few days of the month. Your plan should answer:

• How will tenants be notified if the portal is down?
• Will late fees be waived for outage-related delays?
• Can tenants pay another way, and how will those payments be recorded?
• Who reconciles payments once systems return?

Deciding these things in advance keeps staff from making inconsistent promises under pressure.

Keep Maintenance Moving

Emergency maintenance doesn't stop because software does. Keep an offline list of:

• Every property address and key contact.
• Preferred vendors for plumbing, electrical, HVAC, and locksmith services.
• After-hours phone procedures.
• Access instructions for properties where it's appropriate to store them securely.

Update this list monthly and store it where on-call staff can reach it, such as a secured mobile device.

Communication Plan

Decide in advance how you'll reach:

• Staff, if email is unavailable.
• Tenants, through text alerts, posted notices, or a backup email account.
• Owners, who will want to know whether their properties and funds are safe.

Set Recovery Targets

Use two simple measures:

• Recovery time objective: how quickly each system must be working again. A payment portal might need hours. An archive of old leases might wait days.
• Recovery point objective: how much recent data you could afford to lose and re-enter.

A Property Management Disaster Recovery Checklist

• Inventory of critical systems and vendors.
• Confirmed vendor backup and recovery commitments.
• Separate backups for local and shared files.
• Ransomware-resistant backup copy.
• Rent-day outage procedures.
• Offline maintenance contact list.
• Tenant, staff, and owner communication plans.
• Annual test and review.

Be Ready Before the Next Emergency

Property managers already know that preparation turns emergencies into routine work. The same is true for technology. Maise Technology helps real estate and property management companies build practical plans through our disaster recovery services and business continuity services.

Ready to make sure your portfolio can weather a technology outage? Schedule A 15 Minute Discovery Call.

Ask the owner of a small accounting, engineering, or consulting firm whether they're prepared for a disaster, and the answer is often, "We have backups."

That's a good start. But backups and business continuity aren't the same thing. Knowing the difference can determine whether a firm is back to work in a few hours or struggling for weeks.

The Short Version

• Backup is a copy of your data.
• Disaster recovery is the process of restoring your systems and data from those copies.
• Business continuity is your plan for keeping the firm operating and serving clients while recovery happens.

Think of it like a spare tire. The backup is the spare. Disaster recovery is changing the tire. Business continuity is figuring out how you'll still make your client meeting on time.

Side-by-Side Comparison

Why Backups Alone Fall Short

Restoring takes longer than expected

A backup might contain everything you need, but restoring several hundred gigabytes of files and a practice management database can take a day or more. During that time, staff can't work normally.

Backups don't tell people what to do

When systems go down, someone has to decide whether to send staff home, how to contact clients, and which deadlines need extensions. A backup can't make those decisions.

Backups can be compromised

Ransomware often targets backups first. If your only backup is connected to the same network with the same passwords, it may be encrypted along with everything else.

Some things aren't backed up at all

Firms are often surprised to learn that certain cloud applications, email archives, or software configurations aren't included in their backup.

What Business Continuity Adds

A business continuity plan for a small professional firm usually covers:

• Critical functions: client deliverables, deadlines, billing, and communication.
• Recovery targets: a recovery time objective (how fast each system must return) and a recovery point objective (how much data you can afford to lose).
• Alternate work arrangements: remote work, a backup location, or loaner laptops.
• Communication: how to reach staff and clients if email is down.
• Decision authority: who declares an emergency and who speaks to clients.
• Vendor contacts: software providers, internet carriers, and your IT partner.

A Realistic Scenario

An eight-person accounting firm loses its server to a hardware failure on March 30, two weeks before a major tax deadline.

Firm A has backups only. The backups are intact, but nobody has tested a full restore. A replacement server takes three days to arrive, and restoring data takes another day. Staff spend most of a week unable to work.

Firm B has backups and a continuity plan. Its plan includes cloud-based recovery that runs critical systems temporarily in a hosted environment. Staff are working remotely by the afternoon. The partners notify a few clients about short delays, and the firm meets its deadlines.

Both firms had backups. Only one had a plan. Downtime affects more than productivity, as we explain in the real cost of IT downtime.

Questions to Ask Your IT Provider

• What exactly is included in our backups, and what isn't?
• How long would a full restore take?
• Is at least one backup protected from ransomware?
• When did we last test a restore?
• Can critical systems run temporarily in the cloud if our office equipment fails?

Build Both

Backups are essential, but they're the foundation, not the whole house. Maise Technology helps firms build complete plans through our business continuity services and disaster recovery services.

Not sure whether your firm has backups only or a real continuity plan? Schedule A 15 Minute Discovery Call and we'll help you find out.

Yes. Every nonprofit that depends on technology to serve people, raise money, or meet reporting requirements needs a disaster recovery plan. It doesn't have to be long or expensive. For most small and mid-sized nonprofits, a few pages that answer "what do we restore, how, and who does it?" will cover the essentials.

Below is a plain-language explanation of what a nonprofit disaster recovery plan includes and a starter checklist you can use this week.

Why Nonprofits Can't Skip This

Nonprofits often assume disaster recovery is for big corporations. In reality, nonprofits may have less room to absorb a disruption. Consider what would happen if you lost:

• Your donor database the week before a year-end giving campaign.
• Program attendance records needed for a grant report.
• Client case notes used to coordinate services.
• Access to email and files after a ransomware attack.

Disasters don't have to be dramatic. A failed hard drive, a deleted folder, or a compromised email account can do serious harm when there's no plan to recover.

Disaster Recovery vs. Business Continuity

These terms are often used together:

• Disaster recovery focuses on restoring technology and data.
• Business continuity focuses on keeping your mission and services going while technology is being restored.

A food pantry might keep serving families with paper sign-in sheets (continuity) while its database is restored from backup (recovery). Both matter.

Two Key Terms, Explained Simply

Recovery time objective (RTO): How long can a system be down before it seriously hurts your work? Your donation platform might need to be back within a day. Your archive of old newsletters could wait a week.

Recovery point objective (RPO): How much recent data could you afford to lose? If you back up nightly, you might lose up to a day's work. If that's too much for your case management system, it needs more frequent backups.

What a Nonprofit Disaster Recovery Plan Includes

1. A list of critical systems such as email, donor database, accounting, case management, and shared files.
2. Recovery priorities showing what gets restored first.
3. Backup details describing what's backed up, how often, and where.
4. Contact information for staff, board leaders, IT support, and key vendors.
5. Roles explaining who makes decisions and who does the work.
6. Manual workarounds for continuing programs without systems.
7. A testing schedule to confirm the plan works.

Starter Checklist

Use this list to get from "no plan" to "basic plan" quickly:

• ☐ List every system your organization depends on.
• ☐ Rank each one as critical, important, or can wait.
• ☐ Confirm each critical system is backed up.
• ☐ Confirm cloud services (like Microsoft 365 or Google Workspace) have a backup plan beyond the provider's own recycle bin.
• ☐ Store at least one backup copy where ransomware can't reach it.
• ☐ Restore one file or record to prove backups work.
• ☐ Write down who to call and who decides.
• ☐ Keep a printed copy of the plan and key contacts offsite.
• ☐ Share the plan with your executive director and board chair.
• ☐ Schedule a review once a year.

Frequently Asked Questions

Our files are in the cloud. Isn't that enough?

Not always. Cloud providers keep their systems running, but they may not protect you from accidental deletion, a compromised account, or ransomware that syncs encrypted files. A separate backup adds an important safety net.

How much does disaster recovery cost?

It depends on how many systems you have, how much data you store, and how fast you need things back. Many nonprofits can meet basic needs with modest investments, especially when they prioritize the most important systems first.

Do funders care about this?

Increasingly, yes. Some grant applications and insurance carriers now ask about data protection and continuity planning.

We serve youth or students. Does that change anything?

Organizations that work with young people often hold sensitive information such as attendance, guardian contacts, and permissions. Recovery planning should prioritize protecting and restoring that data. Our IT services for education page discusses related considerations.

Start Small, Start Now

A one-page plan you can actually follow beats a perfect plan that never gets written. Start with the checklist above, then build from there.

Maise Technology helps mission-driven organizations plan for disruptions through our disaster recovery services. Learn more about our work with nonprofits on our IT services for nonprofit organizations page.

Have a question about getting started? Get In Touch.

Utah medical practices face a familiar mix of disaster risks. Winter storms knock out power along the Wasatch Front. Spring runoff can flood lower-level offices. Wildfire smoke and summer heat strain equipment. And like practices everywhere, Utah clinics face a growing threat from ransomware.

Any of these events can make your electronic health record unavailable. When that happens, a practice still has patients in the waiting room, prescriptions to manage, and appointments to keep. A strong disaster recovery plan is what keeps a bad day from becoming a bad month.

What HIPAA Expects

The HIPAA Security Rule includes a contingency plan standard. Covered entities must have a data backup plan, a disaster recovery plan, and an emergency mode operation plan. The rule also addresses testing those plans and identifying which applications and data are most critical.

For a small practice, that doesn't mean a binder the size of a phone book. It means having clear, written answers to how you'll protect patient data, restore systems, and keep caring for patients during a disruption.

Five Ways to Strengthen Your Practice's Recovery

1. Know where your patient data actually lives

Many Utah practices now use cloud-based EHRs. That shifts some backup responsibility to the vendor, but not all of it. You still need to know:

• How often your EHR vendor backs up data, and how quickly they can restore it.
• Whether local systems, such as imaging, lab interfaces, or scanned documents, are backed up separately.
• What happens if your office internet goes down even though the EHR is working fine.

2. Protect at least one backup from ransomware

Ransomware attackers deliberately look for backups to delete or encrypt. Keep at least one backup copy that's offline, immutable (meaning it can't be changed), or otherwise isolated from your everyday network.

3. Plan for internet outages, not just disasters

For cloud-based practices, a cut fiber line can be as disruptive as a server failure. A backup internet connection, often a cellular option, can keep the front desk and providers connected through common outages.

4. Prepare an EHR downtime kit

Every practice should have a simple downtime kit that staff can use when the EHR is unavailable:

• A printed or offline copy of the day's schedule, updated each evening.
• Paper encounter forms and prescription pads where permitted.
• A list of key phone numbers for pharmacies, labs, and referral partners.
• Instructions for entering paper records once systems return.

5. Test the plan

Testing doesn't have to interrupt patient care. Try restoring a single file or a test database after hours. Run a short tabletop exercise during a staff meeting: "It's 8 a.m. and the EHR is down. What do we do?" You'll quickly find gaps.

Setting Recovery Targets

Two terms help practices decide how much protection they need:

• Recovery time objective (RTO): how long a system can be down before patient care or operations are seriously affected.
• Recovery point objective (RPO): how much data you could afford to lose and re-enter, measured in time.

A practice might decide the EHR needs to be back within four hours, while the shared drive for administrative documents can wait a day. Those decisions guide what kind of backup and recovery tools make sense.

Regional Considerations for Utah Practices

Utah practices should consider risks specific to their area:

• Earthquake planning: The Wasatch Fault runs beneath many Utah communities. Store offsite or cloud backups somewhere that wouldn't be affected by the same local event.
• Winter weather: Plan for staff who can't get to the office and for providers who may need secure remote access.
• Multi-location groups: Practices with clinics in Salt Lake, Davis, Weber, and Cache counties should decide whether one location can temporarily support another.

A Utah Practice Disaster Recovery Checklist

• Written backup, disaster recovery, and emergency mode plans.
• At least one ransomware-resistant backup copy.
• Confirmed EHR vendor recovery commitments.
• Backup internet connection.
• EHR downtime kit at every location.
• At least one test per year, documented.

Keep Caring for Patients When Systems Fail

Disasters rarely give advance notice. The practices that recover fastest are the ones that planned on a calm day. Maise Technology helps healthcare organizations build recovery plans through our disaster recovery services. You can learn more about our healthcare work on our IT services for healthcare organizations page, and about our local support on our Salt Lake City managed IT services page.

Want to review your practice's recovery readiness? Schedule A 15 Minute Discovery Call.

This article is for general information and is not legal advice regarding HIPAA compliance.

Most disaster recovery plans are written from the office out. They start with email, file servers, and accounting software, then add production systems at the end as an afterthought.

For a manufacturer, that order is backwards. The production line is what generates revenue. A disaster recovery plan should start there and work outward.

This guide walks through how to build a disaster recovery plan around production, including two terms every plant leader should understand: recovery time objective and recovery point objective.

Two Numbers That Shape Your Plan

Recovery time objective (RTO)

RTO is how long a system can be down before the impact becomes unacceptable. If your scheduling system can be offline for four hours before shipments start slipping, its RTO is four hours.

Recovery point objective (RPO)

RPO is how much data you can afford to lose, measured in time. If you back up your quality records nightly and a failure happens at 4 p.m., you could lose almost a full day of entries. If that's unacceptable, you need a shorter RPO and more frequent backups.

Put simply: RTO is how fast you need it back. RPO is how much you can afford to redo.

Step 1: Map Your Production-Critical Systems

Walk the floor with operations, maintenance, and quality leaders. List every system production depends on. Most plants find more than they expect:

• ERP and MRP systems for orders, materials, and scheduling.
• Machine programs stored on CNC controls or engineering workstations.
• PLC programs and HMI configurations.
• Quality management and inspection data.
• Label printing and shipping systems.
• Barcode scanners and inventory tracking.
• Network equipment that ties it all together.

Step 2: Set RTO and RPO for Each System

Not every system needs the same recovery speed. A simple worksheet helps:

These numbers are examples. Your targets should come from real conversations about customer commitments and production costs. Downtime has costs beyond the obvious; we break them down in the real cost of IT downtime.

Step 3: Match Backups to Your Targets

Once you know your RTO and RPO, check whether your backups can actually meet them. Questions to ask:

• How often is each system backed up?
• Where are backups stored, and is at least one copy protected from ransomware?
• Are machine programs and PLC files included, or only office data?
• How long does a full restore actually take?

A common surprise: backups exist, but restoring a large ERP database takes 12 hours, far longer than the 4-hour target. That gap is what the plan needs to close.

Step 4: Plan for Manual Operations

Some disruptions will outlast your best recovery targets. Decide in advance how the floor can keep working without systems:

• Print the next shift's schedule each day.
• Keep paper travelers and inspection forms on hand.
• Store copies of critical machine programs where they can be loaded locally.
• Know who can authorize running without the ERP.

Step 5: Assign Roles and Communication

During a disaster, confusion wastes more time than technology. Your plan should name:

• Who declares a disaster and starts the plan.
• Who contacts customers about delays.
• Who works with IT and vendors on recovery.
• How employees get updates if email is down.

Step 6: Test, Then Test Again

An untested plan is a guess. Start small. Restore one machine program from backup. Time a database restore on a test system. Run a tabletop exercise where leaders walk through a ransomware scenario. Each test reveals gaps you can fix while the stakes are low.

Common Mistakes to Avoid

• Backing up office data but not machine programs.
• Storing every backup on the same network as production.
• Setting RTOs without checking how long restores actually take.
• Writing the plan once and never updating it after equipment changes.

Build the Plan Around What Matters

A production-first disaster recovery plan protects revenue, customer relationships, and your team's ability to keep working when things go wrong. Maise Technology helps manufacturers build and test plans through our disaster recovery services. Learn more about how we support plants on our IT services for manufacturing companies page.

Want help setting realistic RTO and RPO targets? Schedule A 15 Minute Discovery Call.