Backup and Business Continuity for Nonprofits

A burst pipe, a long power outage, or a failed server can stop a nonprofit as quickly as a cyberattack. Business continuity planning helps you keep serving people while you fix the problem. Backups sit at the center of that plan, but they are only one part of it.

Start with what your mission cannot lose

Begin by listing the services you provide and the systems each one depends on. For example, a youth program may rely on attendance software, a shared drive, and a phone line for parents.

Then ask two questions for each system.

How long can you operate without it? How much recent data can you afford to lose? The answers become your recovery targets, and they guide how much to spend on protection.

In addition, note seasonal pressures. A system that can wait a week in summer may become critical during a year-end giving campaign or a major event.

Back up cloud data, not just servers

Many nonprofits assume the cloud backs itself up. In reality, most cloud providers focus on keeping their service available. Restoring data you deleted, overwrote, or lost to an attacker usually falls to you.

So include Microsoft 365 or Google Workspace, your fundraising database, case management system, and accounting platform in your backup plan. For each one, find out what the vendor keeps, for how long, and how you would get it back.

Also, check who owns each account. If a former employee set up a cloud service with a personal email address, you may lose access when you need it most.

Follow the 3-2-1 rule

A reliable backup strategy keeps three copies of important data, on two different types of storage, with one copy offsite. Ideally, at least one copy also stays immutable or offline, so no one can alter it.

Next, automate everything you can. Manual backups to an external drive tend to stop when the person who ran them leaves or gets busy. Also, monitor backup jobs daily, so failures do not go unnoticed for months.

Finally, remember that a backup only counts if you can restore it. Schedule regular restore tests, and time them, so you know whether you can meet your recovery targets.

Business continuity checklist for nonprofits

Use this list to find gaps in your current plan. Then assign an owner and a target date to each missing item.

• Recovery priorities ranked for every program and system
• Automated backups for servers, laptops with local files, and cloud apps
• At least one offsite, immutable backup copy
• Restore tests completed and timed on a regular schedule
• Admin passwords and vendor contacts stored in a shared, secure vault
• Staff able to work from home if the office closes
• Backup internet, such as a second provider or cellular failover
• Battery backup on network equipment and servers
• Contact tree for staff, volunteers, board, and key partners

Reduce key person risk

Many small nonprofits rely on one person who knows how everything works. Often that person is a longtime office manager or a volunteer who “does the computers.” If they leave or get sick, critical knowledge leaves with them.

To reduce this risk, document how systems connect, who the vendors are, and where licenses live. Also, keep admin credentials in a shared password vault rather than a notebook. That way, more than one trusted person can act in an emergency.

Keep people working during a disruption

Continuity depends on people as much as data. If your building closes, staff need laptops, secure access, and a way to reach clients.

For instance, forward the main phone line to cell phones, and keep a cloud copy of client contact lists. Likewise, decide ahead of time how you will tell donors and partners about delays. Finally, run a short drill so staff know the plan before they need it.

After any disruption, hold a short review. Note what worked, what slowed you down, and what to change, then update the plan while details stay fresh.

How WEBIT helps

WEBIT designs backup and business continuity plans around your programs, not just your hardware. We offer image-based server backup with offsite storage, and our Security Advanced add-on includes Microsoft 365 backup. Our password vault add-on also helps remove key person risk.

In addition, our regular health assessments include a review of backup status, so problems surface early. Learn more about our managed IT services, or see pricing.

Key takeaways

• Business continuity starts with ranking which programs and systems matter most.
• Cloud apps need their own backups, because providers focus on uptime.
• The 3-2-1 rule, with one immutable copy, protects against most data loss.
• Shared documentation and a password vault reduce reliance on one person.
• Drills help staff keep serving clients when the office or systems go down.