Blogs on IT Support and Cybersecurity for Small Business

Only 26% of Canadian businesses had written cyber security policies in place in 2023, according to Statistics Canada. For everyone else, the question of what Lower Mainland businesses should restore first gets answered mid-outage, with every department insisting its system matters most.

That is a hard moment to make a calm decision. Phones are ringing, the team is idle, and the person who knows where the backups live may be on holiday. A recovery order written in advance turns that scramble into a checklist.

Recovery Is a Sequence, Not a Switch

Most people picture recovery as a single event: the systems were down, and then they were back. In practice, systems return one at a time, and each one depends on something underneath it. An accounting platform is useless if nobody can sign in, and signing in is impossible while the internet connection is still out.

That dependency chain is why order matters. Restore the wrong system first and staff will sit in front of a working application they cannot reach. Put the right foundation back first and everything above it returns faster.

Ransomware raises the stakes on sequence. Statistics Canada found that 13% of Canadian businesses impacted by a cyber incident in 2023 were hit with ransomware, and 88% of those victims did not pay. For many, that means the road back runs through their own backups, one system at a time.

Three Numbers That Set the Order

The Canadian Centre for Cyber Security (the Cyber Centre) recommends that every IT recovery plan define how much disruption the organization can tolerate. Three measures do most of the work, and none of them require technical training to understand.

• Maximum tolerable downtime: how long a process can stay unavailable before it causes significant harm to the business.
• Recovery point objective: how much data you can afford to lose, measured as the gap between the last good backup and the outage.
• Recovery time objective: how quickly a system needs to be running at the minimum level its owner expects.

These numbers are business decisions, not IT settings. An office manager knows that invoicing can slip a day. The controller knows whether payroll runs this Friday, and leadership knows which client deadlines carry penalties.

Once each process has its tolerances written down, the restore order largely sorts itself. Whatever has the shortest tolerable downtime goes near the top, and anything that can wait a week drops to the bottom.

Dependencies Hide in Plain Sight

Cloud services change the recovery picture, but they do not remove it. A cloud accounting platform may be running perfectly while your office has no internet, or while every staff account is locked after a password reset. From the desk of an employee, that looks the same as an outage.

Hybrid environments add another layer. Many organizations across the Lower Mainland run a mix of cloud applications, a server or two in a back room, and specialized software tied to a single workstation. Each piece has its own path back, and those paths often cross in ways nobody has written down.

The fastest way to expose those links is to ask the same questions about every system before anything goes wrong:

• Where does it run: in the office, in a data centre, or in a cloud service?
• What does it need before it works, such as internet, sign-in, or another application?
• Where is its backup, and when was a restore last tested successfully?
• Who is the vendor contact, and is that number written somewhere outside the network?
• Which staff member can confirm it is working properly once it returns?

A label printer that only works from one computer, or a licence server nobody remembers, can quietly hold up an entire department.

Running the Payroll Versus Email Test

So which wins, payroll or email? It depends on the calendar. On the day before payroll runs, the payroll system may be the most urgent thing in the building, yet two weeks later it can comfortably wait while client communication comes back.

That is why a single fixed ranking rarely holds up. A better approach for working out what Lower Mainland businesses should restore first is to group systems into tiers, then note the specific dates that move something up a tier.

Tier One: The Foundation

Nothing else works without these. Internet connectivity, user sign-in, and the secure backup copies themselves sit at the base. Security tools that confirm the environment is clean belong here too, since restoring onto a compromised network only restarts the problem.

Tier Two: The Work That Pays the Bills

These are the systems tied directly to revenue and client commitments. For a professional services firm, that might mean document management and time tracking. In construction or manufacturing, it could be project files, scheduling, and the estimating software crews rely on. A non-profit might put donor records and program scheduling in this tier instead.

Tier Three: What Can Wait a Day

Some systems feel urgent but rarely are. Archived files, internal wikis, and reporting dashboards can usually stay offline while core work resumes.

A typical tier list for a 40-person professional office in the region might look like this:

• Tier one: internet and firewall, sign-in accounts, verified clean backups, and endpoint security.
• Tier two: email, phones, the practice management or accounting system, and shared client files.
• Tier three: archives, intranet pages, analytics, and nonessential applications.
• Date-driven exceptions: payroll moves to tier one in the two days before each pay run, and accounting moves up at month-end and ahead of tax filing deadlines.

Details will differ for every company. The structure is what makes the decision fast.

The Step That Comes Before Any Restore

Speed can work against recovery. After a cyber attack, restoring files onto systems that are still infected can hand the attacker a second chance.

The Cyber Centre's ransomware guidance sets out a clear order of operations. Affected devices are isolated first, then the point of entry is identified and closed before anything reconnects to the network. Backups get scanned for malware before they are used, and passwords across systems and accounts are reset because attackers often keep stolen credentials for later.

Those copies need protection long before an incident. The Cyber Centre advises keeping backups encrypted and stored offline, since anything connected to the network can be infected along with everything else. A recovery order means little if the copies it depends on are compromised.

Before any tier-one system comes back, a short checklist helps:

• Confirm affected devices are disconnected from the network.
• Identify how the attacker got in and close that gap.
• Scan backup files for malware before restoring from them.
• Reset passwords on all systems, devices, and accounts.
• Record what was found, since insurers and investigators may ask.
• Bring tier-one systems back in order, confirming each one works before starting the next.

Not every outage is an attack. A failed server, a flooded office, or a lengthy power cut skips the forensic steps but still follows the same tiered order.

Who Decides, and Where the Plan Lives

According to the Cyber Centre, a recovery plan should document what needs to be recovered, when, where, and by whom. That last part is often missing. A clear answer to what Lower Mainland businesses should restore first only helps if someone has the authority to act on it.

Each tier needs an owner who can approve its restoration and confirm it works. That person does not need to be technical. They need to know what "working" looks like for their team, so IT knows when to move on to the next system.

Where the plan is stored matters as much as what it says. The Cyber Centre recommends keeping response plans available offline, because a document saved on the encrypted server is no help during the outage. A printed copy in the office and another with a senior leader covers most situations.

The Cyber Centre also recommends a communications plan for key stakeholders, plus training so employees understand their roles and the order of operations during an unplanned outage. When staff know which systems return first and roughly when, they can give clients a useful update instead of a guess. A short, honest message to clients on day one earns far more goodwill than silence.

Where Insurance Fits In

Insurance belongs in this conversation but cannot replace it. Statistics Canada reported that 22% of Canadian businesses carried cyber risk insurance in 2023. Among those policies, 44% covered restoration of software, hardware, and data, and 39% covered business interruption. A policy may help with recovery costs, but it will not tell the team which system comes back first.

Recovery is also getting more expensive. Statistics Canada found that total spending on recovery from cyber incidents doubled between 2021 and 2023, even as the share of businesses impacted declined. The agency notes this may mean the consequences of each incident are becoming more severe.

Building the List in an Afternoon

A recovery order does not need to be a binder. For most small and mid-sized organizations, a working first version can come together in one focused session with the right people in the room.

• List every system the business uses, including cloud services, phones, and line-of-business software.
• Ask each department head how long their process can be down before it causes serious harm.
• Note the dates that change priorities, such as payroll, month-end, and seasonal peaks.
• Sort systems into three tiers and name an owner for each.
• Print the plan and store copies outside the office network, including one with a senior leader at home.
• Walk through it once with the team, reading each step aloud without enacting it.

The Cyber Centre describes several ways to test a plan, from a simple read-through to a full simulation. Even the read-through tends to surface gaps, such as a vendor contact nobody has or a password that lives in one person's head.

Plans also age. New software, a new office, or staff turnover can quietly reshuffle priorities, so the list deserves a fresh look whenever the business changes and at least once a year.

The Order Is the Plan

Knowing what Lower Mainland businesses should restore first is less about technology than about priorities leadership already understands. The hard part is settling them while things are quiet and writing them where the team can find them.

When the next outage arrives, the difference shows up in the first hour. One team argues about where to start. The other picks up a sheet of paper and begins at line one.

Sources:

• Statistics Canada, "Impact of cybercrime on Canadian businesses, 2023," The Daily: www150.statcan.gc.ca/n1/daily-quotidien/241021/dq241021a-eng.htm
• Canadian Centre for Cyber Security, "Developing your IT recovery plan (ITSAP.40.004)": cyber.gc.ca/en/guidance/developing-your-it-recovery-plan-itsap40004
• Canadian Centre for Cyber Security, "Ransomware: How to prevent and recover (ITSAP.00.099)": cyber.gc.ca/en/guidance/ransomware-how-prevent-and-recover-itsap00099

October is Cybersecurity Awareness Month, so there’s hardly a better time to talk about the harsh realities of devastating ransomware attacks or other business IT failures… malicious or benign. While updating passwords and enabling two-factor authentication are critical first steps, your last line of defense is always a bulletproof recovery strategy—starting with the 3-2-1-1 backup rule.

Modern cybercriminals have shifted their tactics. Instead of immediately encrypting live production servers, sophisticated attackers now quietly compromise secondary backup archives first; stripping away your ability to restore systems independently. If your enterprise data configurations allow backup logs or files to be altered or deleted, a single breach can permanently destroy your operational records and force costly, catastrophic downtime.

A main server hardware failure right before a critical business event can stop operations entirely. In a traditional reactive IT setup, a dead server means waiting days or weeks for new hardware, re-installing applications, and attempting to restore data from manual backups.

With a proactive data resilience strategy, that same hardware failure becomes a minor temporary shift rather than a business disaster.

Power failures account for 45% of all major corporate infrastructure disruptions, according to research from the Uptime Institute. This risk is highest in distributed environments like retail storefronts, logistics hubs, and satellite offices.

When a server or critical network switch loses power unexpectedly, it cannot perform a controlled shutdown sequence. That abrupt drop in power causes severe technical damage, including corrupted databases, degraded storage drives, and fried motherboard circuitry.

Many business owners assume their company files are completely safe until an unexpected event proves otherwise. Sudden hardware failure, accidental deletion by an employee, or a malicious cyberattack can compromise your files at any moment. Operating without a recovery plan risks everything you have built. If your files disappear tomorrow, your daily operations will halt, and recovering that lost information on your own can be nearly impossible.

Imagine walking into the office to find the file infrastructure and internal applications are inaccessible. Every directory contains a text file explaining that your data has been encrypted. This is the result of a zero-day ransomware attack that bypassed standard antivirus definitions.

Most business owners I talk to have some form of backup. Maybe it's an external drive plugged into a server, or perhaps everything is saved in the cloud. While these are great starts, they often have a single point of failure. If your office has a fire, that external drive is gone. If a user accidentally deletes a folder and it syncs to the cloud, that data might be gone before you notice.

To make a backup "trustworthy," we use a framework called the 3-2-1-1 Rule. It sounds like a football play, but it’s actually a recipe for peace of mind.

That “checkmark” signaling a successful backup is less a guarantee of safety and more of a dangerous illusion. Many business owners might be under the impression that their data is safe simply because they got the email confirming that files have been copied to the cloud. But this is far from the truth, and you need to understand that there’s a significant difference between “having” a backup and “restoring” a backup.

We view data as our most valuable non-liquid asset. For years, the 3-2-1 backup strategy served as the industry’s fiduciary standard for data protection, a reliable safeguard against hardware failure and human error. However, the threat landscape has fundamentally shifted. Modern ransomware now specifically targets backup repositories to strip away an organization's leverage. To maintain true operational continuity in 2026, the traditional model must evolve into the 3-2-1-1 rule.

Do you know exactly how much a disaster incident could cost your business? You might think of IT as your reactive safety net, only taking action when something goes wrong or breaks, but here’s the problem… By the time your server crashes, or your office is underwater, or you’re dealing with a ransomware attack, it’s already too late.

It’s easy to think of IT as a money sink. No matter how much you spend, there’s always some issue that surfaces, requiring a considerable investment on your part. But what if we told you that you don’t have to worry about IT issues?

With the right approach, you can transition from the traditional reactive method of IT maintenance to proactive IT solutions, designed to save you money.

Building a gingerbread house is a perennial tradition in many, many households. Those with experience know that precise, careful preparation leads to a successful, long-lasting final product, while rushing and cutting corners usually leave you with a crumbling, fragile mess.

Much of the same can be said of your business’ data. This essential operational resource is terrifyingly susceptible to a litany of threats and issues that could easily bring your processes tumbling down… hence, why the 3-2-1 Backup Rule is a core element of successful business continuity.

Let’s take a moment to consider the recipe for a reliable, disaster-proof backup, and how it aligns with the process of making a gingerbread house.

Remember tape backup? For some SMBs who have moved on, this form of data backup is a clunky and frustrating relic of the past. But if you aren’t remembering it and are instead still dealing with it, you might be experiencing some operational frustrations of your own. Today, we want to cover a better solution—one that takes the unpredictability out of business continuity.

It is remarkable how much more capacity our data storage tools have than they had upon their initial invention, and how much data we’ve amassed in that time. The first-ever commercial hard drive was the size of two refrigerators, and held a mere five megabytes of data. For context, that’s about five photographs. Today, hard drives hold exponentially more data, and it is critical that you are doing everything you can to protect this data from any circumstance, from fire, severe weather, or cyberattack.

So, are you? Too many business owners aren’t sure… but there’s a way you can be. 

What would you do if your entire infrastructure were impacted by ransomware all at once? Do you have a contingency in place to address this risk, or are you going to “wing it” in the face of such a threat? The smart answer is that you’ll be prepared, and a data backup and disaster recovery solution (or BDR) plan will help you do just that.

You know your business needs data backup, but do you understand why? Simply put, your business is at risk of total annihilation if it doesn’t have a plan in place to recover lost data, and you don’t want that impending doom hanging over your head. If you’re wondering where to get started, here are three types of data that you should absolutely prioritize with your backups.

That said, you want to back up all data if you can, but these are three that we think are especially important to consider.

We need to talk about something that is as exciting as watching water boil, but it might just save your entire business one day: backing up your data.

I know, I know. You're busy doing your thing, closing deals, and you’re busy. The last thing on your mind is where your files are outside of your server. The truth is, it’s not very interesting, but it sure is important.

To keep your business running smoothly, even if something goes wrong—like a power outage, cyberattack, or other disaster—you need a reliable way to protect your data. That’s where data backup comes in. It’s important to make sure your backup is thorough and trustworthy so you can recover if things go south.

Have you ever accidentally deleted a file or had your computer crash? It’s a frustrating experience, right? Now, imagine if a major disaster—like a fire or data breach—struck and wiped out all your critical data. That’s where disaster recovery steps in to save the day.