Most disaster planning stops at one question: do we have backups? For most small businesses the answer is yes, and the conversation ends there.
Here is the question that rarely gets asked. When the worst day comes, who can actually get in?
Picture a Tuesday. Your email stops working. A folder you need is gone. You call the person who set things up two years ago and get voicemail. Then you open the backup console and it asks for a sign-in you do not have. The account belongs to someone who no longer works here, and the phone number tied to it went with them.
The backup is fine. It has been fine the whole time. You just cannot reach it.
Recovery starts with a login, not a file
Every recovery step runs through an account. Email. The backup console. Your domain name. Your accounting software. Your own workstation. Before you restore a single file, you have to prove you are allowed to.
So the first thing a bad day takes is usually not your data. It is your access.
Having a backup and recovering from one are two different skills. Of the organizations hit by ransomware in the last year, only 54% restored their data from backups, the lowest rate in the six years one major survey has tracked it. The copy existed. Getting back to it is the hard part.
This is not a corner case, either. Microsoft tells organizations to keep at least two dedicated emergency sign-in accounts, cloud-only and not tied to any one person, for exactly this reason. Their guidance lists the ways it goes wrong: the person with top-level access leaves, everyone's phones are unavailable, a cell network is down, or nobody can complete the code prompt that was set up as a security step. When that happens, a business is locked out of the very tools it needs to recover.
The account only one person has
Almost every small business has one of these.
It might be the Microsoft 365 account that owns everything. It might be the registrar where the domain name lives, which is really where your email lives. It might be the login to the backup system. It might be the router.
One name on it. Nobody else can see it. And if the recovery codes were written down, they were written down in a document stored on the server that just went down.
That is not security. That is a single point of failure with a friendly face.
Your phone is now load-bearing
Most two-factor setup sends a code to a phone. That works right up until the phone is lost, broken, dropped in a lake, or the number is quietly moved onto someone else's device. That last one is called a SIM swap, and the FBI logged 971 complaints about it in 2025, with reported losses in the millions.
Those are only the cases someone reported. Behind each one is a person who could not receive the text that would have let them back in.
If your only way to prove who you are is a text message to one phone, then your recovery depends on that phone surviving the same bad day as everything else.
What to do before you need it
You do not need new software for most of this.
- List every account the business cannot run without. Email, domain, backup, banking, payroll, and whatever you would need on day one. - For the most important ones, create a second way in that does not belong to any single person. Microsoft's version is a separate emergency account. Yours may look different, but the idea is the same. - Keep the recovery codes somewhere that is not on the network you are trying to recover. Paper in a locked drawer beats a file on the server. - Give a second person the ability to get in, and make sure they know they have it. - Then test it. Sign in with the spare account on a boring day, while nothing is wrong, and fix what does not work.
CISA makes the same point for small businesses: back up your data using the 3-2-1 approach, and know how to reach your critical files even when you have no internet connection.
A backup you cannot reach is not a backup. It is a rumor.
The uncomfortable part is finding this out during an emergency. The good part is that it is a short list, and you can work through it on a quiet afternoon, before you ever need it.