Peak Hurricane Season: A Texas IT Continuity Checklist

Local history makes the case.

• Harvey, 2017. Rising Lake Houston water is estimated to have flooded roughly sixteen thousand homes and more than three thousand businesses in the area. Every business in Kingwood Town Center took water, and most were disrupted for about a year.
• The rain beat every drainage system. Nederland recorded 60.58 inches during Harvey, the official rainfall record for a tropical cyclone in the continental United States.
• Imelda, 2019. A storm that never became a hurricane dropped 43.39 inches southwest of Beaumont and inundated more than 5,000 homes in Jefferson County. Category ratings measure wind; Texas gets wrecked by water.
• May 2024. Lake Houston flood levels surpassed Imelda, with Lake Conroe releases peaking at 71,835 cubic feet per second, second only to Harvey. Not a named storm at all.
• Beryl, July 2024. A Category 1 landfall cut power to about 2.26 million CenterPoint customers, and more than a million were still dark three days later.

The threat is not the hurricane category. It is water in the building, power out for a week, and staff who cannot reach the office. Our Kingwood managed IT and Houston managed IT practices are built around exactly that risk profile.

This is the highest-value hour you will spend all week. A green dashboard tells you a job completed. It does not tell you the data is usable, the application will start, or that anyone knows the sequence to bring it back. Backup software reports on itself, which is a conflict of interest.

• Restore something real, to somewhere real. Take your most business-critical system, restore it to an isolated location, log in, run a report, and confirm last night's transactions are present.
• Time it with a clock. What you measure is your actual recovery time. The gap between that and what you assumed is your exposure. If those terms are unfamiliar, read RTO and RPO differences in disaster recovery.
• Test the credential path. Recoveries stall because the admin password lives in a vault that authenticates against the domain controller you are restoring. Keep a sealed, offline break-glass credential.
• Spot check files. Open five random documents from the restored set, because silent corruption never shows up on a dashboard.

Never done this end to end? Disaster recovery testing covers the methodology.

The 3-2-1 rule that CISA and NIST still endorse as a baseline is three copies of your data, on two media types, with one copy off site. The phrase doing all the work is off site, and a hurricane demands a strict reading of it.

• Geographic separation, not just a different room. A NAS in the closet, a second server in the same building, or a replica twenty minutes away all sit inside the same storm footprint. Harvey's rain field covered the entire southeast Texas metro.
• Check the actual cloud region. Confirm the region string in your console, not what the vendor said at signing. Plenty of Houston businesses find their backup target is in Texas.
• Verify immutability. Backups deletable with production credentials are not backups, and object-locked copies also blunt post-disaster ransomware.
• Know who can authorize a restore. If your provider needs a ticket from one named contact and that person is evacuating, you have a single point of failure made of paperwork.

A properly designed disaster recovery as a service posture answers separation and immutability structurally.

Adjusters work from evidence. Your memory three weeks after a flood is not evidence, and neither is a spreadsheet written from recollection.

• Walk the server room, IDF closets, and every workstation with your phone camera. Wide shots for context, then close shots of asset tags, serial numbers, and model plates.
• Capture network gear specifically. Switches, firewalls, access points, UPS units, and patch panels get under-claimed because nobody photographed them.
• Push the photos off site immediately. Images of destroyed equipment stored on a destroyed device help no one, and a door frame in frame gives the adjuster a water-line reference later.
• Update the asset inventory the same day. Purchase dates and costs turn a photograph into a claim line item.

Do the power math honestly

Most small-business UPS units are sized to survive a flicker and shut down gracefully, not to run a rack. Beryl left over a million Houston-area customers dark for days.

• Measure real runtime under real load. Three-year-old cells commonly deliver a fraction of their rated minutes.
• Confirm graceful shutdown actually triggers. The UPS agent must be installed, licensed, and reachable on every host, virtualization stack, and NAS.
• If you have a generator, start it under load and check fuel. Verify the transfer switch and the fuel contract. Generators fail on the day because they are only ever tested unloaded.

Stage the work-from-anywhere posture

• Confirm remote access works from outside your network today. Test from a phone hotspot, not office Wi-Fi.
• Check that MFA is not tied to the office. Hardware tokens in a submerged desk drawer are a lockout event.
• Send laptops and chargers home early. Equipment that leaves before the storm does not need to be claimed after it.
• Publish an out-of-band channel and print the contact tree. If email is down, everyone needs to already know where to look.

Cloud-first architecture makes most of this trivial, which is why cloud services and continuity belong in one conversation.

Redundant internet is the least verified control in small business IT.

• Ask whether your two circuits share a physical path. Two providers reselling the same last-mile fiber, or entering through the same conduit, are one circuit with two invoices.
• Test failover by unplugging the primary. Confirm the firewall cuts over, DNS follows, and VoIP survives instead of dropping every call.
• Configure cellular fallback in advance, SIM activated and failover rule tested. Buying an LTE modem during an evacuation is not a plan.
• Know your phone forwarding path. Cloud voice can redirect the main line to mobiles, but somebody has to know the portal login.

Managed IT services with automated 24/7 monitoring catch the circuit that quietly failed over three months ago and never failed back.

Technical readiness fails on human ambiguity. The most common post-event finding is not a missing backup. It is three people who each assumed someone else made the call.

• Name one decision-maker and one alternate, in writing. Not a committee. A person, plus a named backup who takes over if the first is unreachable for a defined interval.
• Define triggers, not judgment calls. Pre-agree the conditions: a mandatory evacuation order for your zone, a river gauge forecast above a stated stage, or an outage exceeding UPS runtime. Triggers survive stress; opinions do not.
• Settle graceful shutdown versus ride it out ahead of time. If systems are cloud-hosted and staff are remote, powering down on-premises gear cleanly is almost always right. If customers depend on on-site systems hourly, document that decision before the wind arrives.
• Set a failover cutoff time. Cutting over at 2 a.m. mid-storm with nobody available is worse than cutting over at 4 p.m. the day before.
• Physically unplug, do not just power off. Surges during restoration destroy more equipment than the storm does.
• Elevate what you can. Moving a switch and UPS off the floor takes ten minutes and has saved entire networks.

A virtual CIO relationship exists in part to make these calls unambiguous before they are urgent.

Do not power on water-exposed equipment

People break this rule within an hour of walking back in, turning a recoverable loss into a total loss plus an injury.

• NEMA's guidance is explicit: electrical equipment exposed to water can be extremely dangerous if re-energized without proper reconditioning or replacement. Do not plug in anything submerged or sprayed until a qualified party evaluates it.
• Floodwater is contaminated. Silt, sewage, and salts corrode boards and contacts long after the surface looks dry, leaving electronics including surge protective devices non-functional or hazardous.
• Drives are a separate question from the chassis. A soaked server should not be booted, but its drives may be recoverable. Bagging a wet drive for a lab preserves options; powering it up destroys them.
• Let the building be cleared first. Energized panels and standing water are a fatal combination.

Document everything for the claim

• Photograph before you move anything, including the water line and equipment in place.
• Keep every receipt for replacement hardware, temporary connectivity, cloud overage, and after-hours labor, and keep the damaged equipment until the adjuster releases you in writing.
• Log downtime with timestamps. Business interruption claims are built on duration, and reconstructed timelines are weaker than contemporaneous ones. See the real cost of IT downtime.

If you have one afternoon before the next system organizes, do these four things in order:

• Run one real restore of your most critical system and time it. This surfaces more problems than any other single action.
• Verify the off-site copy is outside the storm footprint and cannot be deleted with production credentials.
• Write down who is authorized to call a shutdown or failover, their alternate, and the specific triggers. One page. Print it.
• Photograph your equipment and push the photos off site so the insurance conversation starts from evidence.

To have someone else pressure-test the picture, the free IT assessment returns a plain-English read on where your continuity posture is thin. Businesses with an internal IT person often pair it with co-managed IT so there is depth behind one individual during an evacuation. If your provider has never run a restore test with you, switching IT providers covers how to evaluate that. And since storms are followed by phishing aimed at distracted staff, keep cybersecurity in the same plan.

How far in advance should we start the 72-hour checklist?

Begin when your area enters the five-day forecast cone, not when a watch is issued. Restore testing, hardware photography, and remote access checks take longer than expected and need staff who will soon be handling their own storm preparation.

Is a backup in a Dallas data center far enough away from Houston?

For a hurricane, generally yes, since Dallas sits well outside a Gulf landfall footprint with a different power and flood profile. What matters is that the copy is outside the same storm and immutable, so ransomware cannot reach it either.

Should we shut down our servers or leave them running?

If your critical workloads are in the cloud and staff can work remotely, shut down gracefully, unplug from the wall, and elevate the hardware, since surge damage during power restoration causes heavy losses. If customers depend on on-premises systems hourly, decide in advance rather than improvising.

Our server got wet but it looks fine. Can we turn it on?

No. NEMA guidance is that water-exposed electrical equipment can be extremely dangerous if re-energized before reconditioning or replacement, and floodwater contaminants corrode components invisibly. Leave it off, photograph it, and send the drives to a recovery lab.

What is the most common continuity failure you see after a Texas storm?

Backups that reported success but had never been restored, followed closely by unclear decision authority. Both are fixable in an afternoon, and both are far cheaper to fix beforehand than to discover during a recovery.

LayerLogix provides managed IT, cybersecurity, and business continuity support across the Texas Gulf Coast and beyond, with 20+ Years Experience and 100% Texas-Based Support. That includes the flood-exposed San Jacinto and Lake Houston corridors through our Kingwood and Humble coverage, the wider metro from Houston and The Woodlands, and the coastal and western suburbs including League City and Katy. Automated 24/7 monitoring watches your systems continuously, with business-hours support and after-hours emergency response when a storm turns an alert into a real decision. Reach the Greater Houston team at 713-571-2390, or contact us before the next system forms.