At ZA Support in Hyde Park, we've worked with hundreds of small and medium-sized enterprises across Johannesburg who've faced real data loss, corrupted systems, and days without critical infrastructure. What we've learned is this: disaster recovery isn't complicated, but it does require intentional thinking. It's the difference between losing a week of work and losing a week plus R50,000 in emergency repairs.
This guide walks you through what disaster recovery actually means for a 15-person office in Johannesburg, what to prioritise, and how to build a plan that doesn't require you to sell the company to fund it.
What Disaster Recovery Really Means for Your SME
Disaster recovery (often abbreviated DR) is simply a documented way to get your business running again after something goes wrong. That something could be a hardware failure, a security breach, accidental deletion, a physical incident like a burst water pipe, or network failure.
For SMEs, this isn't about redundancy across three continents. It's about answering three specific questions: How long can your business operate without its systems? (This is your Recovery Time Objective, or RTO.) How much data can you afford to lose? (This is your Recovery Point Objective, or RPO.) And what's your budget to make this happen?
In our Hyde Park workshop, we've seen businesses lose everything because they confused "having backups" with "having a recovery plan." A backup is just a copy of your data sitting somewhere. A recovery plan is the tested, documented process to restore that backup to working systems when everything falls apart.
The distinction matters because when you're stressed and systems are down, you need to know exactly what to do — not figure it out as you go.
RTO and RPO: The Two Numbers That Actually Matter
Let's start with something concrete. Imagine your main file server fails on a Tuesday morning at 10 AM. Your RTO is how long you're willing to wait before you can access those files again. For a marketing agency, that might be two hours. For a bookkeeper, it might need to be 30 minutes. For a business that processes customer orders, it could be 15 minutes.
Your RPO is how much recent work you can lose. If your last backup was Monday at 5 PM, you've lost all Tuesday's work. If your RPO requirement is "no more than four hours of lost data," then you need backups running every four hours during business days.
These numbers drive everything else. They determine whether you need off-site backup, cloud storage, redundant systems, or all three. A business with a one-hour RTO and one-hour RPO will spend more than a business that can tolerate six hours and six hours.
We've helped more than 2,000 Johannesburg businesses define these numbers, and what's striking is how many haven't actually discussed them. You can't plan disaster recovery without knowing your own tolerances.
Off-Site Backup: Why Local Copies Aren't Enough
A backup sitting on a hard drive in your office is not a disaster recovery plan — it's optimism. If there's a fire, or a robbery, or the building floods during one of Johannesburg's summer storms, your backup disappears with your primary systems.
Off-site backup means copies of your critical data stored somewhere else. For SMEs, this typically means cloud storage — Amazon S3, Microsoft Azure, or services like Backblaze and Veeam that specialise in business continuity.
The cost is modest. You're looking at R300 to R1,500 monthly depending on data volume and backup frequency. What you get is this: if your office burns down, your data still exists. If ransomware encrypts your local systems, you have clean copies in the cloud. If an employee deletes three months of client records by mistake, you can restore from a specific point in time.
Load shedding in Johannesburg adds another dimension to this. When Eskom cuts power for four hours, your on-site systems go down. Cloud-based backups continue running because they're hosted in data centres with redundant power. This is a practical advantage we see regularly in our work with suburbs like Sandton, Rosebank, and the northern reaches of Johannesburg where outages are predictable.
Business Continuity: The Bigger Picture
Disaster recovery is sometimes confused with business continuity, and they're related but different. Disaster recovery is technical — restoring systems and data. Business continuity is the complete picture: how your staff keep working during the outage, what happens to customer-facing services, how you communicate with clients, and what alternative processes you can use.
For a 15-person office, this might mean: if your internet goes down, you switch to a mobile hotspot and work from the Cloud. If your phone system fails, you forward calls to mobiles. If your main office becomes inaccessible, you work from home or a partner location.
The documentation matters here. Have you told your team what to do if the office is unavailable? Do they know how to access files from home? Is there a decision-maker who's authorised to declare a disaster and activate the plan?
We've seen businesses lose a full day of productivity after a technical outage simply because no one knew who to call or what the backup procedures were. Writing it down takes three hours. Not writing it down costs thousands.
Building Your DR Plan: A Practical Process
Start by mapping what actually matters. Not everything deserves the same protection. Your accounting software, client databases, and operational systems need rapid recovery. That folder of old marketing campaigns from 2019 can wait 48 hours.
Create a simple spreadsheet: system name, criticality (high, medium, low), RTO, RPO, current backup method. Be honest about what you currently have. Most SMEs we work with discover they have gaps — systems that aren't backed up at all, or backups that haven't actually been tested.
Then run a cost-benefit analysis. A one-hour RTO costs more than a four-hour RTO. Decide which systems truly need the fastest recovery. For most SMEs in Johannesburg, two or three systems are truly critical. Everything else can wait a few hours.
Finally — and this is non-negotiable — test your recovery procedures. Don't assume your backup works until you've actually restored from it. We've consulted with businesses whose backups were corrupted for months without anyone noticing. Testing is the difference between a plan that's real and a plan that's theoretical.
If you need technical help with this assessment, we offer a comprehensive IT disaster recovery audit for a fixed fee of R599. We map your systems, review your current backup methods, identify gaps, and provide written recommendations. Contact us to schedule your assessment, or book online at zasupport.com/book.
Load Shedding and Disaster Recovery in Johannesburg
Eskom's load shedding has rewritten the disaster recovery calculus for Johannesburg businesses. When you can predict power cuts, you can plan for them. But most SMEs haven't integrated this into their DR planning.
UPS (uninterruptible power supply) units buy you time — usually 30 minutes to an hour — to shut down systems cleanly or switch to backup power. For a small office, a 2 kVA UPS costs around R3,500 to R6,000 and can keep your critical systems running through a load shedding session.
More importantly, cloud-based systems and off-site backups are more resilient to load shedding than on-premises infrastructure. When your internet connection drops, you lose local connectivity, but your cloud backups continue running in data centres outside the affected area.
Plan for load shedding specifically. Know which load shedding schedule applies to your location. Schedule your backups to run during periods when power is stable. If you're in a stage 4 or 6 environment, redundancy becomes even more critical.
The Role of Regular Maintenance and Monitoring
Disaster recovery isn't just about big incidents. Small failures compound. A hard drive that's running hot, a backup process that's silently failing, outdated software with security vulnerabilities — these create the conditions for larger disasters.
We've examined over 15,000 MacBooks and business computers in Johannesburg, and one pattern is consistent: regular maintenance prevents crises. Annual checks, software updates, storage reviews, and backup verification catch problems before they become disasters.
For businesses using Apple systems, liquid damage is a common risk in Johannesburg's summer weather. For businesses on older hardware, logic board repair failures often coincide with backup system failures because both indicate aging infrastructure that needs attention.
The discipline of regular monitoring costs very little — maybe two hours per month — but prevents the situation where disaster strikes and you discover your backup has been broken for three months.
Getting Help: When to Bring in Professionals
You don't need a dedicated IT person to manage disaster recovery. You need clarity about your systems, a documented plan, and the discipline to maintain it.
Where professional help typically makes sense: designing your backup architecture, setting up off-site replication, testing recovery procedures, and documenting your processes. For a small business, this is maybe 15–20 hours of work. We charge by the hour or offer fixed-fee assessments starting from R599.
We provide written recommendations, often including specific software or cloud service suggestions tailored to your business. Our experience working with hundreds of Johannesburg SMEs means we understand local challenges — power stability, internet reliability, compliance requirements, and budget constraints.
Warranty and Support
When we help you implement disaster recovery systems or recovery procedures, we provide written documentation covering everything we've recommended. Our work comes with support, meaning if you have questions about executing the plan, we're available to help — not at premium support rates, but as part of the service.
For businesses that choose ZA Support for ongoing IT support, disaster recovery planning is included. We monitor your systems, maintain your backups, and ensure your recovery procedures stay current as your business changes.
---
Frequently Asked Questions
Q: Do I need a disaster recovery plan if I use cloud storage like Google Drive?
Cloud storage alone isn't a complete disaster recovery plan — it's one component. Google Drive and Dropbox are excellent for file synchronisation and off-site copies, but they don't protect against ransomware (which encrypts both local and cloud files), accidental mass deletion, or account compromise. A complete plan includes versioning (the ability to restore older versions of files), access controls, and tested restoration procedures. Cloud storage is where your data lives; disaster recovery is how you get it back when things go wrong.
Q: How often should we test our disaster recovery plan?
At minimum, once per year. More realistically, after any significant system change — new software, new infrastructure, staff changes. We recommend a schedule: once per quarter for critical systems, once annually for everything else. Document the results of each test so you understand what works and what needs adjustment. A plan that's never tested is a plan that will fail when you need it.
Q: What's the typical cost of disaster recovery for a 15-person business?
Most SMEs spend R500 to R2,000 monthly on disaster recovery infrastructure — cloud backup, redundancy, monitoring. The initial setup might cost R2,000 to R8,000 depending on system complexity. Our assessment and planning service costs R599 and typically identifies where to focus your budget for maximum protection.
Q: Does load shedding require a different disaster recovery approach?
Somewhat. Load shedding is predictable, which is actually helpful for planning. You can schedule backups and maintenance during stable power windows. You might consider UPS units for critical systems, and you should definitely prioritise cloud-based systems that aren't affected by local power cuts. The main change is adding load shedding to your risk assessment — what's your plan for the predictable outages we have in Johannesburg?
Q: Can we manage disaster recovery ourselves, or do we need external help?
Most of the planning and discipline can be managed internally. Where external expertise helps: designing your backup architecture so it actually works, ensuring your procedures are complete and tested, and verifying that recovery can happen in your target timeframe. Many businesses benefit from one professional engagement to set things up properly, then maintain it themselves. Others prefer ongoing support. Both approaches are valid.
Q: How do we know if our current backup is actually working?
Test it. Restore a complete backup to a separate system (or a virtual machine) and verify everything works. Don't assume a backup is good because it completed without errors. We've seen backups that reported success but were corrupted or incomplete. A test takes a few hours and gives you absolute certainty. It's the most important part of disaster recovery planning.
WhatsApp us on 064 529 5863 to discuss your disaster recovery needs, or book online at zasupport.com/book to schedule an assessment.
