Hurricane-Season Disaster Recovery Checklist for Houston, Galveston, and Beaumont (2026 Edition)

Backup Verification

• Confirm 3-2-1-1-0 backup rule is in place: 3 copies, 2 media, 1 off-site, 1 immutable, 0 verification errors
• Test-restore at least one critical VM and one critical SaaS dataset to confirm recovery time
• Verify off-site backup location is outside the storm risk zone (Dallas, Austin, AWS us-east-2 Ohio, Azure South Central US Dallas — all acceptable)
• Document RTO and RPO per critical system

Cloud-First Redundancy

• Identify any business-critical service still running on a single Houston-based server
• Move email, file sharing, and CRM to cloud platforms with multi-region resilience (Microsoft 365, Google Workspace, Salesforce)
• For on-premises workloads that must remain local, configure cloud DR replication (Azure Site Recovery, Veeam Cloud Connect, Datto SIRIS replication)

Power and Connectivity

• UPS battery health check on critical equipment
• Generator fuel inspection and contract refresh
• Cellular hotspot inventory for emergency connectivity
• Cellular failover for key locations (Cradlepoint, Peplink)

Communications and Decision Authority

• Update emergency contact roster (personal cell, alternate email, family backup)
• Identify clear succession of decision authority if leadership is displaced
• Pre-stage communication templates (customer notice, employee notice, vendor notice)
• Test mass notification system (everbridge, AlertMedia)

• Run a full backup of all critical systems (forced, off-schedule)
• Verify cloud DR replication is current
• Check that off-site backups completed in the last 24 hours
• Activate remote work plan: VPN, M365, RDP all tested by every team member
• Issue laptops and chargers to anyone who normally uses a desktop
• Send first customer / vendor communication: 'Tracking storm, will update by [time]'
• Document storage room equipment elevation status

• Final forced backup
• Power down non-critical equipment
• Elevate equipment in flood-prone areas
• Disconnect non-essential power to limit surge damage
• Final customer communication: 'Office closed [date], remote operations active, contact via [channel]'
• Confirm key personnel are accessible and have power/connectivity at their evacuation location

• Daily check-in with all employees (safety first, IT second)
• Monitor backup completion and replication health from off-site
• Maintain customer communication at agreed cadence
• Document any incidents or anomalies for post-event after-action

• Inspect physical premises before powering on equipment (water damage, electrical safety)
• Power up incrementally; test each system before bringing dependents online
• Run integrity checks on databases (DBCC CHECKDB on SQL Server, etc.)
• Verify backups resumed normally post-event
• After-action review within 30 days; update DR plan accordingly

Cyber insurance and business interruption insurance both reference DR program maturity. Document everything: pre-storm checklist completion, evacuation timing, restoration timing, costs, lost productivity. This documentation supports both insurance claims and future planning. See our cyber insurance prerequisites guide for related context.

• Houston managed IT
• Galveston managed IT
• Sugar Land managed IT
• The Woodlands managed IT (better elevation, but still wind exposure)
• Clear Lake / Bay Area

For broader continuity context: Cloud services, incident response, and the first 72 hours playbook (cyber-focused but the IR mindset transfers).