Business continuity after a fire, flood or theft

The physical risks are more common than people think

New Zealand businesses deal with a steady stream of physical events: flooding from heavy rain, water leaking from a tenancy above, fires that start in a neighbouring unit, earthquakes, and burglaries targeting laptops and screens. Businesses in Auckland and other regions have been locked out of their premises for weeks after weather events, even when their own office was not directly damaged, because the building was declared unsafe or power was cut for days.

None of these events needs to be a cyber attack to wipe out an office's IT. A server in a ground-floor comms cupboard, a NAS under a desk and a backup drive next to it can all be lost in one night. Planning for physical loss is therefore as important as planning for ransomware, and many of the same measures cover both.

Before it happens: what to have ready

Keep business data offsite: email and files in Microsoft 365 or Google Workspace with an independent backup, and an offsite copy of any server or NAS. Keep a current list of equipment with serial numbers and purchase details for insurance claims. Make sure phone numbers are on a cloud phone system or can be diverted quickly to mobiles, so calls do not simply ring out in an empty, flooded building.

Agree in advance where people will work if the office is unavailable. For most small offices that means working from home, so check that staff have suitable internet, that laptops can work fully outside the office, and that key software is reachable remotely. If some work cannot be done from home, such as printing large plans, identify a fallback such as a shared workspace or a friendly business nearby.

The first 24 hours

Safety comes first. Once everyone is accounted for, the person leading the response contacts staff with clear instructions, usually through a group text or personal mobiles. Notify your insurer early, as they may need to approve emergency spending on equipment or temporary premises. Divert phones, put a short message on the website or voicemail if needed, and tell key clients what to expect.

On the IT side, confirm that cloud services are reachable and that staff can sign in from home. If laptops were lost or stolen, change their users' passwords, revoke the device sessions and use device management to lock or wipe them remotely. Start ordering replacement devices for people who cannot work without them, prioritising the roles that keep money coming in.

Days two and three

With communication restored, focus on the systems the business earns from. If a server was lost, restore it from the offsite backup onto temporary hardware or a cloud virtual machine. Bring back line-of-business applications, reconnect accounting, and check that recent data is intact. Keep a simple log of what has been restored and what is still outstanding so everyone works from the same picture.

Watch out for scams during this period. Criminals sometimes target businesses they know are in trouble with fake supplier invoices or messages pretending to be from insurers. Any request to change bank details or pay urgently should be verified by calling a known number, not one from the message. Brief staff on this too, since the person who takes the call may not be the one leading the recovery.

Theft has its own extra steps

A burglary adds privacy and security concerns. Report the theft to the police and keep the reference number for insurance. Work out which devices held personal information and whether they were encrypted. Under the Privacy Act 2020, a breach that is likely to cause serious harm must be reported to the Privacy Commissioner and affected people told, so encryption on every laptop and desktop makes a big difference to the outcome.

Change passwords for any accounts that might have been saved on the stolen devices, review sign-in logs for unusual activity, and check whether paperwork, keys or access cards were taken too. If alarm codes or door access cards may be compromised, update them before restoring equipment to the site. Your insurer may also want evidence of the security measures in place, so photos and the police report are worth keeping together.

Returning to the office

When the premises are usable again, treat the return as a small project. Have network cabling and wireless checked after water or fire damage, replace any equipment that has been wet even if it seems to work, and get a registered electrician to confirm the power is safe before reconnecting anything. Restore the server to its permanent home only after the temporary setup has been retired cleanly.

Finally, hold a short review. What worked, what was slow, what was missing from the plan? Update the continuity plan, the equipment list and the contact details while the experience is fresh. A business that writes down its lessons recovers faster the next time, and may find some temporary arrangements, such as cloud phones or remote access, were worth keeping permanently.