Most small businesses now run on SaaS — accounting, email, CRM, files, all hosted by someone else. That is efficient, but it quietly shifts disaster recovery from your server room to a set of assumptions you may never have tested. Here is how to build a DR plan that fits a cloud-first business.

Key takeaways
  • Disaster recovery is about restoring service and data after an incident, not just preventing one.
  • Define an RPO and RTO for each critical system so recovery expectations are explicit.
  • SaaS providers restore their platform, not necessarily your deleted or corrupted data.
  • Independent backups of your SaaS data are the missing piece in most cloud DR plans.

What disaster recovery actually means

Disaster recovery (DR) is the set of plans and tools that get your business operating again after a disruptive event — ransomware, accidental deletion, account compromise, provider outage or simple human error. It is the recovery half of business continuity. Crucially, DR assumes something will go wrong and asks: how fast can we come back, and how much will we lose.

Start with RPO and RTO

Two numbers anchor every DR plan. Your Recovery Point Objective (RPO) is how much data you can afford to lose, measured in time. Your Recovery Time Objective (RTO) is how long you can afford to be down. Set them per system — payroll might tolerate less loss than your CRM. If you have not read it yet, our guide to RPO and RTO walks through setting them honestly.

The cloud-first blind spot

Here is the trap. When your critical systems are SaaS, it is tempting to assume the provider's resilience is your DR plan. It is not. Providers protect their platform from their failures. They generally will not restore data you deleted, corrupted, or lost through a compromised login — that falls under the shared responsibility model. So your DR plan has a hole exactly where your most important data lives.

A practical framework

  1. Inventory your critical systems and the data each holds.
  2. Assess impact — what breaks if each is unavailable or lost.
  3. Set RPO and RTO for each.
  4. Ensure independent backups of SaaS data you cannot otherwise restore.
  5. Document the runbook — who does what, in what order, with what access.
  6. Test by restoring — an untested plan is a hypothesis.

Close the gap

For accounting specifically, an independent daily backup of your Xero file — encrypted, retained and point-in-time restorable — turns the cloud blind spot into a covered one. It is the difference between a DR plan that reads well and one that works.