When Hurricane Ian made landfall in Florida in 2022, roughly 25% of nonprofits in affected areas reported significant operational disruptions. Offices flooded. Staff couldn’t reach work sites. Case management systems went offline. For homeless shelters and social service agencies, the crisis extended beyond physical damage—they lost access to client records, intake systems, and the tools they needed to serve people at their most vulnerable moment.
For nonprofits, social service agencies, and homeless service providers, disasters come in many forms. Natural disasters like hurricanes and wildfires grab headlines. But ransomware attacks, prolonged power failures, and HMIS outages can be equally devastating to operations. In late 2025, U.S. nonprofits faced an average of 2,550 cyber-attacks per week—a 57% increase from the previous year.
This article covers how to build a practical approach to disaster planning and recovery that protects client data, keeps critical services running, and supports compliance with funders and regulators. The guidance comes from practical experience working with real agencies navigating these challenges every day.
Core Concepts: Disaster Planning, Recovery, and Continuity
Before creating a plan, it helps to understand the key terms and how they relate to each other. These concepts form the foundation for protecting your organization when disaster strikes.
Defining these terms in practical nonprofit language makes them actionable rather than abstract.
- Disaster: Any event that significantly disrupts normal business operations. For nonprofits, this includes natural disasters (hurricanes, wildfires, winter storms), public health crises (COVID-19), cyber incidents (ransomware, email compromise, system intrusions), and facility-level problems (burst pipes flooding a server closet, extended power outages).
- Disaster Recovery Plan (DRP): A documented set of steps to restore critical systems, data, and business processes after an incident. For a homeless services agency, this might include procedures for restoring HMIS access, recovering case management databases, and re-establishing secure VPN connections for remote staff.
- Business Continuity Plan (BCP): Focuses on how your organization keeps serving clients during and immediately after a disaster. This might mean shifting outreach staff to mobile devices, using paper intake forms temporarily, or relocating services to a partner agency.
- Incident Response Plan (IRP): Specifically addresses security and privacy incidents. If a staff member clicks a phishing link or someone reports unauthorized access to client records, the IRP guides immediate containment, investigation, and notification steps.
These three plans work together. The business continuity plan ensures business continuity during disruptions. The disaster recovery plan restores systems to resume normal business operations. The incident response plan handles security events that might trigger both.
Two additional terms matter for practical planning:
- Recovery Time Objective (RTO): How quickly a system must be back online. Example: “Our shelter intake system must be restored within 4 hours.”
- Recovery Point Objective (RPO): How much data loss is acceptable. Example: “We can accept losing no more than 1 hour of intake data.”
These metrics help prioritize which systems get restored first and how frequently backups need to run.
Common Disaster Challenges for Nonprofits and Social Service Agencies
Nonprofits face unique challenges that make disaster planning harder than it might be for large enterprises. Limited budgets, lean staffing, and reliance on grant-funded technology create real constraints. Understanding these challenges helps organizations develop realistic plans.
Staffing and Knowledge Gaps
Many nonprofits depend heavily on a single person—the “IT guru” or HMIS administrator—who holds all system knowledge. When that person is unavailable during a disaster (or affected by it personally), the entire organization struggles to manage basic technology tasks.
Research shows that Canadian nonprofits spend an average of only $21,000 annually on cybersecurity prevention, compared to $55,000 for similarly sized businesses. This gap leaves agencies more vulnerable when incidents occur.
Infrastructure and System Challenges
Common technical pain points include:
- On-site servers located in basements or closets vulnerable to flooding, fire, or theft
- Shared login credentials that make it impossible to track who accessed what
- Backups that exist but have never been tested—and may not actually work
- Fragmented systems where HMIS, electronic health records, donor CRM, and case notes all live in separate tools with different backup policies
Data and Compliance Pressures
Nonprofits handle sensitive information systems containing personally identifiable information (PII) and protected health information (PHI). A breach creates legal exposure under HIPAA, state privacy laws, and HUD data standards.
There’s also tension between responding quickly and maintaining compliance. HUD HMIS Data Standards under 24 CFR § 578.103 require auditable records showing who made entries, when, and what changed. Rushing to restore services without proper procedures can create compliance problems.
Reporting obligations add pressure. After an incident, organizations must typically notify funders, boards, CoC leads, and potentially affected clients—all while trying to restore operations.
Operational and Human Factors
Staff delivering emergency services face enormous stress during disasters. They may be working from temporary locations with limited tools while also dealing with personal impacts from the same event.
Communication breaks down quickly. When phones, email, and SMS systems are unavailable, reaching outreach workers, volunteers, and clients becomes nearly impossible.
During COVID-19, many nonprofits discovered they had no remote access plan. The shift to remote operations in March 2020 was chaotic for agencies that hadn’t prepared for staff to work from home.
Key Components of a Nonprofit Disaster Recovery Plan
A solid disaster recovery plan contains several building blocks. Each component serves a specific purpose and connects to real nonprofit scenarios rather than abstract corporate situations.
The key components include:
- Risk assessment and business impact analysis focused on programs and funding
- Asset and data inventory covering HMIS, case management tools, and critical documents
- Clear roles and responsibilities across executive leadership, IT, program managers, and communications
- Technology recovery strategies including backups, cloud services, and failover options
- Communication and stakeholder notification plan
- Training, drills, and ongoing plan maintenance
Risk Assessment and Business Impact Analysis
Risk assessment and business impact analysis form the foundation of practical disaster planning. This process helps you focus limited resources on what matters most.
Identifying Relevant Threats
Start by listing threats most relevant to your geography and operations:
| Location/Context | Primary Threats |
|---|---|
| Gulf Coast | Hurricanes, flooding, power outages |
| Northeast | Winter storms, blizzards, ice damage |
| California | Wildfires, earthquakes |
| Urban areas | Infrastructure failures, civil unrest |
| All locations | Phishing attacks, ransomware, vendor outages |
Map these potential threats to specific systems: HMIS, phone systems, email, file servers, electronic health records, and scheduling tools.
Conducting Business Impact Analysis
A basic BIA process includes:
- List critical business functions (shelter intake, crisis hotline, outreach scheduling, housing placements, HUD CoC reporting)
- Define acceptable downtime (RTO) for each service
- Define acceptable data loss (RPO) for each system
- Estimate potential impact of downtime on clients, staff, compliance, and funding
For example, missing HUD reporting deadlines in October could jeopardize CoC funding. Losing VOCA documentation could affect the next grant cycle. These concrete impacts help justify investment in recovery planning.
Program leaders and finance staff should participate in this process—not just IT. They understand the true operational downtime costs and grant obligations.
Asset and Data Inventory
Many nonprofits discover during a disaster that they don’t know where data lives or who manages which system. Building an inventory before problems occur prevents this confusion.
Creating Your Inventory
Document the following:
- Hardware: laptops, tablets, servers, network devices, phones—including locations and serial numbers
- Software: HMIS platforms, EHRs, donor CRMs, Office 365 or Google Workspace, case management tools
- Data locations: cloud services, local drives, shared network folders, external hard drives, paper files in on-site cabinets
Categorizing by Priority
Tier your assets to clarify recovery priorities:
| Tier | Description | Examples |
|---|---|---|
| Tier 1 | Mission-critical systems | HMIS, crisis hotlines, shelter management, EHRs |
| Tier 2 | Important but not life-safety | Donor databases, HR software, file shares |
| Tier 3 | Convenience systems | Internal wikis, non-critical websites |
Identify which systems are managed by partners (CoCs, state HMIS leads, managed service providers) versus in-house. Recovery responsibilities vary significantly based on who controls the infrastructure.
Roles, Responsibilities, and Decision-Making
Confusion over who is in charge can delay recovery by hours or days. Define roles clearly before an incident occurs.
Essential Roles
- Executive Lead (ED or COO): Declares disaster, authorizes emergency spending, approves public statements
- Incident Lead (IT director, operations director, or external partner): Coordinates technical response, liaises with vendors
- Program Liaisons: Representatives from major departments (shelter, outreach, housing, finance) who relay needs and updates
- Communications Lead: Manages internal and external messaging, board updates, funder coordination
Identify alternates for each role. The primary person may be on vacation, sick, or personally affected by the disaster.
Contact Information
Create a concise contact sheet with names, cell phone numbers, and alternate communication channels like Signal or WhatsApp. Store copies both online and offline. Update the list at least twice per year.
Technology Recovery Strategies (Backups, Cloud, and Failover)
Nonprofits can develop effective recovery strategies without enterprise-level budgets. The key is making deliberate choices about where and how systems are hosted.
Backup Strategies
Practical backup approaches include:
- Daily or hourly backups of HMIS databases (where the vendor allows)
- Cloud-to-cloud backups for Microsoft 365 or Google Workspace
- Offline copies of key reports, contact lists, and critical documents
- Retaining at least 30 days of backup history
- Testing restores at least twice a year
Testing is critical. Many organizations have discovered during an actual disaster that their backups were corrupted or incomplete. Regular restore tests catch these problems early.
Failover Options
Enterprise-style failover (hot standby data centers) may be unrealistic for most nonprofits. Practical alternatives include:
- Cloud-based phone systems that can reroute calls to staff cell phones
- Secondary internet connections at main shelter locations
- Pre-arranged agreements with partner agencies for temporary space or equipment
- Virtual machines hosted by managed service providers that can be activated during outages
Disaster-Recovery-as-a-Service (DRaaS) providers and managed IT services can host backups, manage restore processes, and monitor for issues. When evaluating these tools, ensure vendor SLAs align with your RTO and RPO requirements.
Communication and Stakeholder Notification Plan
Technology issues quickly become communications issues during disasters. Your team must coordinate among staff, clients, partners, boards, and funders—often when normal communication channels are unavailable.
Internal Communication Protocols
Define how to reach staff when email is down:
- SMS trees or phone chains
- Messaging apps (Signal, WhatsApp, Slack)
- Procedures for notifying staff of office closures and remote work expectations
- Security reminders to watch for phishing attempts that often spike during crises
External Communication Guidelines
Establish criteria for informing stakeholders about outages or data incidents:
- When to notify clients, partner agencies, and CoC leads
- Approximate timeframes for updates
- Who approves external communications
- Templates for common scenarios (system downtime notices, data incident notifications, service relocation announcements)
Pre-written templates save critical time during an actual event when stress is high and clear thinking is difficult.
Training, Testing, and Maintaining the Plan
A written continuity plan is only useful if staff know it exists and have practiced using it.
Testing Methods
Simple, realistic testing approaches include:
- Tabletop exercises (once or twice yearly): Walk through a scenario like a ransomware attack on the finance server or a regional power outage on a winter weekend
- Technical tests: Restore a single database from backup, simulate loss of internet at the main office, test phone failover to cell phones
After each exercise, conduct a brief debrief to capture what worked, what failed, and what needs to change in the plan or procedures.
Maintaining the Plan
Review the plan at least annually and after major changes such as:
- Switching HMIS vendors
- Moving to cloud services
- Relocating offices
- Implementing new cybersecurity controls
- Significant staff turnover in key roles
Practical Disaster Planning Steps for Nonprofits and HMIS Projects
Moving from concepts to action requires a phased approach. Organizations can make meaningful progress in small, manageable steps rather than trying to build a comprehensive plan all at once.
Phase 1: First 60–90 Days
Focus on the basics:
- Document your top three critical services
- Identify single points of failure (people, systems, locations)
- Verify that at least one reliable backup method exists for each Tier 1 system
- Create an initial contact list for key staff and vendors
Set specific, time-bound goals. For example: “By September 30, 2026, verify that nightly backups of client databases are running and test one restore.”
Phase 2: Next 3–6 Months
Build out the plan:
- Draft formal procedures for each component
- Clarify roles and alternates
- Run a tabletop exercise focused on a likely scenario (phishing attack, regional storm)
- Document lessons learned and update procedures
Phase 3: Ongoing
Integrate recovery planning into operations:
- Include disaster recovery considerations in new projects
- Require vendors to provide recovery and continuity information
- Review recovery planning in strategic planning processes
- Report to the board annually on readiness status
Technology partners experienced with nonprofit organizations can assist with assessments, technical design, and training during any of these phases.
Aligning Disaster Recovery with Funding, Compliance, and Governance
Disaster planning is not just an IT initiative. It connects directly to audits, grant renewals, and board oversight.
Compliance Connections
Recovery planning relates to requirements from:
- HUD HMIS Data Standards (auditable records, change logs)
- HIPAA (for agencies handling PHI)
- State privacy laws
- CDBG-DR grant requirements for organizations receiving disaster recovery funding
Documented policies and procedures can be referenced during monitoring visits and funding applications. Some federal funders specifically value risk management and continuity of operations in grant proposals.
Board Engagement
Present disaster planning to the board as a risk management and mission protection issue. Annual reporting should include:
- Current readiness status
- Results of any exercises
- Major plan updates
- Unaddressed gaps and resource needs
Working with Technology Partners and HMIS Leads
Most nonprofits rely on external partners for IT support, HMIS administration, cloud services, or specialized applications. Clear communication about recovery responsibilities is essential.
Clarifying Responsibilities
Contracts and MOUs should specify:
- Which party handles backups
- Who manages incident response
- Security monitoring responsibilities
- Communication to end users during outages
Questions for Vendors
Ask HMIS leads and technology vendors:
- Where is our data hosted? What are the data center’s disaster recovery capabilities?
- How frequently are backups performed?
- What is your guaranteed recovery time?
- How will you notify us of incidents affecting our data?
Effective coordination between a nonprofit, HMIS lead agency, and IT provider can significantly reduce operational downtime during outages.
Real-World Application: Disaster Recovery in Nonprofit and Social Service Settings
Understanding how disaster planning and recovery work in practice helps organizations prepare for their own situations.
Scenario 1: Ransomware Attack on a Homeless Services Agency
A mid-sized homeless services agency discovered ransomware on its on-premises file server in 2024. Staff noticed they couldn’t access shared files, and a ransom note appeared on several computers.
Because the agency had a disaster recovery plan, they followed documented procedures:
- The incident lead immediately isolated affected systems from the network
- Staff switched to paper intake forms (kept in pre-printed packets for this purpose)
- The IT partner was contacted and began forensic investigation
- Clean backups from two days prior were identified and restoration began
- The CoC lead and major funders were notified within 24 hours
- Full systems were restored within 72 hours with minimal financial loss
Without the pre-existing plan, recovery could have taken weeks. The agency’s tested backups were the difference between a manageable incident and a mission-threatening crisis.
Scenario 2: Extended Power Outage at a Domestic Violence Agency
A regional domestic violence agency faced a prolonged winter power outage that lasted five days. Their necessary infrastructure was designed for this scenario:
- Staff activated preplanned remote work procedures
- Cloud-based phone systems rerouted crisis hotline calls to staff cell phones
- Secure remote access to HMIS allowed case managers to continue housing placements
- Pre-printed client contact lists enabled welfare checks without system access
- Staff relocated to a partner agency’s offices for in-person work
The agency maintained critical services throughout the outage because they had practiced these procedures and stored resources offsite.
Scenario 3: HMIS Outage During HUD Reporting Period
During a critical HUD reporting period, the state HMIS system experienced an unexpected outage. Coordinated planning between the HMIS lead, technology consultant, and local providers enabled an effective response:
- Providers switched to documented alternate data entry processes
- Paper forms captured required data elements
- The HMIS lead provided regular status updates through an emergency communication channel
- Once systems restored, agencies used pre-agreed catch-up procedures to enter backlogged data
- HUD deadlines were met through coordinated post disaster decision making
The lessons from these scenarios apply broadly: tested backups, spare equipment, updated contact lists, and clear decision thresholds for invoking the plan all contribute to resilience.
Conclusion and Next Steps
Effective disaster planning and recovery protect clients, staff, data, and funding. Even resource-constrained nonprofit organizations can build strong resilience by focusing on core systems and simple, well-practiced procedures.
Disaster recovery is not a one-time project. It’s an ongoing practice tied to program planning, technology decisions, and governance. Organizations that invest in preparedness recover faster and maintain community trust through difficult times.
Immediate Next Steps
Consider taking these three steps in the coming months:
- This month: Schedule a 60-minute internal meeting to identify your top three critical services and current backup status
- This quarter: Assign an owner to draft or update your disaster recovery plan
- Within six months: Plan a simple tabletop exercise around a realistic scenario relevant to your operations
Organizations seeking to strengthen their technology infrastructure, improve cybersecurity posture, or develop practical disaster recovery plans can benefit from working with experienced technology partners who understand the unique needs of nonprofits, social service agencies, and HMIS environments.
Communities with disaster recovery plans tend to recover more quickly, efficiently, and equitably than those without, highlighting the importance of having guidance and procedures for long-term recovery in place before a disaster strikes. This preparation helps ensure recovery aligns with the community vision and addresses the needs of all stakeholders.
Local governments play a critical role, as they are responsible for planning and managing all aspects of their community’s recovery after a disaster. Since recovery often reaches frontline communities last, involving these communities in shaping an equitable recovery strategy is essential to foster resilience and fairness.
Disaster recovery preparedness is fundamentally about identifying a clear recovery management process and establishing protocols for recovery and reconstruction actions. The more recovery issues that can be thought through in advance, the greater the efficiency and quality of post-disaster decision-making.
An effective disaster recovery plan (DRP) does not stand alone. The most effective DRPs are developed alongside strong business continuity plans (BCPs), which typically take a broader look at threats and resolution options. Together, these plans ensure organizations can maintain critical business functions during a disaster and resume normal business operations as swiftly as possible.
A comprehensive communication plan is a vital component of disaster preparedness. It should include predefined messaging templates and utilize multiple channels to inform employees, customers, and vendors during a crisis. Effective disaster preparedness training also emphasizes developing communication strategies for both internal and external stakeholders to maintain coordination and trust throughout an incident.cies, and HMIS environments. The investment in preparedness pays dividends when—not if—the next disruption occurs.
Learn how to make the most of your HMIS data with Nutmeg Consulting today.