What Backup and Disaster Recovery Plan Does a Construction Company Need?

The Recommended Backup and Recovery Plan for a Construction Company

A construction company with 25–50 employees should use a layered backup and disaster recovery plan that protects Microsoft 365, accounting data, estimating files, local servers, critical workstations and important project documents stored outside its construction management platform.

A practical plan should include:

• Automated backups of critical systems and cloud data
• At least one protected backup copy that attackers cannot easily modify
• Daily monitoring for failed backup jobs
• Quarterly restoration testing
• Documented recovery priorities
• Defined recovery time and data-loss targets
• A written incident communication plan
• 24/7 technical escalation for major outages

The goal is not simply to confirm that backup software is running. The goal is to prove that the company can restore the systems, files and accounts required to continue bidding, managing projects, processing payroll and communicating with customers.

This guide uses a six-part framework to help construction companies build a recovery plan that works during ransomware, hardware failure, accidental deletion, cloud account compromise or a major office outage.

The Six-Part Construction Business Continuity Framework

1. Identify the systems and information the business cannot operate without.
2. Set recovery time and acceptable data-loss targets.
3. Back up cloud, server and endpoint data appropriately.
4. Protect backups from ransomware and unauthorized access.
5. Test restoration and document recovery procedures.
6. Create a broader business continuity and communication plan.

Construction companies should review this framework at least annually and after major changes to applications, offices, jobsites or staffing.

For industry-specific support, review 911 IT's construction IT services.

Why Construction Companies Need More Than Basic File Backup

Construction operations depend on a connected set of systems. A company may use one platform for project management, another for accounting, Microsoft 365 for email and collaboration, and specialized applications for estimating, drawings and markups.

Critical systems may include:

• Microsoft 365 email
• SharePoint and OneDrive
• Procore or another construction management platform
• Sage, QuickBooks or another accounting system
• Bluebeam files and tool sets
• Estimating databases and takeoff files
• Local file servers
• Payroll and human resources systems
• Network and firewall configurations
• Critical employee laptops

A single backup product may not protect every one of these systems. The recovery plan should identify which platform owns each type of information, what native recovery features exist and where an additional backup service is required.

Common Causes of Construction Data Loss

• Ransomware
• Accidental deletion
• Compromised cloud accounts
• Hardware failure
• Failed software updates
• Corrupted databases
• Employee mistakes
• Lost or stolen devices
• Fire, flood or power damage
• Cloud synchronization errors
• Malicious actions by insiders or former employees

A strong recovery strategy assumes that more than one of these events could occur and avoids depending on a single copy of important data.

Step 1: Identify Critical Systems and Business Processes

Begin by identifying which technology supports the company's most important operations.

Business Functions to Review

• Bidding and estimating
• Project management
• Payroll
• Accounts payable and receivable
• Banking and payment approval
• Customer and subcontractor communication
• Drawing and document access
• Scheduling
• Time tracking
• Field reporting

Create a Critical Systems Inventory

For each business function, document:

• The primary application
• Where the data is stored
• Who uses it
• Who administers it
• Whether it is backed up
• How quickly it must be restored
• What employees can do while it is unavailable

Example Critical Systems Matrix

Business Function	Primary System	Business Impact if Unavailable	Recovery Priority
Email and communication	Microsoft 365	Employees cannot communicate normally	Critical
Accounting and payroll	Sage or QuickBooks	Payments, payroll and reporting may stop	Critical
Project management	Procore or similar platform	Field and office coordination is disrupted	Critical
Estimating	Estimating and takeoff software	Bid preparation may be delayed	High
Drawings and markups	Bluebeam or Autodesk tools	Project documentation may be unavailable	High
Archived records	File server or cloud archive	Historical research is delayed	Medium

Not every system needs the same recovery speed. Prioritizing systems helps the company direct budget and technical resources toward the most important operations.

Step 2: Set Recovery Time and Data-Loss Targets

Every critical system should have two documented targets:

• Recovery Time Objective: How quickly the system should be restored after an outage.
• Recovery Point Objective: How much recent data the company can afford to lose.

Recovery Time Objective Example

If accounting must be available again within four hours, the recovery process, infrastructure and support agreement must be designed to meet that target.

Recovery Point Objective Example

If the company can tolerate no more than one hour of lost accounting activity, a backup that runs once each night is not sufficient for that system.

Example Recovery Targets

System	Example Recovery Time Target	Example Data-Loss Target
Microsoft 365 email	2–4 hours for major access issues	Up to 1 hour
Accounting and payroll	2–8 hours	15 minutes to 4 hours
Project management access	2–8 hours	Depends on vendor platform
Estimating files	4–8 hours	Up to 4 hours
Archived project files	1–3 business days	Up to 24 hours

These are planning examples rather than universal requirements. Each construction company should set targets based on bid deadlines, payroll schedules, contract requirements and the financial impact of downtime.

Questions Leadership Should Answer

1. How long can employees work without email?
2. How long can payroll or accounting remain unavailable?
3. What happens if estimators lose a full day of work?
4. Which active project records must be accessible immediately?
5. How much data can be recreated manually?
6. Which customers or contracts impose recovery requirements?
7. What is the estimated cost of four, eight or 24 hours of downtime?

Step 3: Back Up Every Important Data Location

Construction companies often assume that all important information is protected because applications are cloud-based. Cloud availability and backup are not the same thing.

Microsoft 365 Backup

Microsoft 365 may contain:

• Email
• Calendars
• Teams files
• SharePoint documents
• OneDrive files
• Contacts
• Shared mailboxes

An independent Microsoft 365 backup may improve recovery from accidental deletion, malicious removal, synchronization problems and compromised accounts.

The backup plan should define:

• Which users and shared mailboxes are protected
• Which SharePoint sites are included
• How often backup occurs
• How long data is retained
• Who can restore information
• Whether departed employee data remains protected

Accounting and Payroll Backup

Accounting data is among the most important information a contractor maintains.

The plan should determine:

• Whether the application is cloud-based or locally hosted
• Where the primary database is stored
• How frequently it is backed up
• Whether transactions can be restored to a specific point in time
• How the application will be accessed during an office outage
• Who can validate the restored data

Application-aware backup may be required to protect databases properly. Copying an open database file may not produce a reliable recovery copy.

Estimating and Takeoff Files

Estimators may store active work on laptops, local servers or application databases. The company should identify:

• Where active estimates are saved
• Whether local files synchronize to a protected location
• How application databases are backed up
• Whether custom templates and assemblies are protected
• How a failed estimating workstation will be replaced

Bluebeam and Drawing Data

Important items may include:

• PDF drawings
• Markups
• Tool sets
• Profiles
• Stamps
• Custom configurations
• Studio Session records where applicable

Employees should know which items are stored centrally and which remain on individual computers.

Local Servers and Shared Drives

Local servers may support file storage, applications, printing, authentication or legacy construction software.

A complete server backup should account for:

• System configuration
• Applications
• Databases
• Shared files
• User permissions
• Virtual machines
• Recovery to replacement hardware or cloud infrastructure

Critical Workstations

Most workstations should store files in approved cloud or server locations. However, some estimating, design or accounting computers may contain important local data or specialized configurations.

Identify whether those systems require:

• File backup
• Full-system imaging
• Configuration documentation
• Rapid replacement hardware
• Application installation packages and license information

Step 4: Protect Backups From Ransomware

Backups must be protected from the same attackers and administrative accounts that can affect production systems.

Use Multiple Backup Layers

A resilient strategy may include:

• Primary production data
• A local or rapidly accessible recovery copy
• An offsite or cloud backup
• An immutable or otherwise protected copy

Not every company needs the same design, but no critical system should depend on one easily modified backup location.

Separate Backup Administration

Backup administration should use:

• Separate administrative accounts
• Multi-factor authentication
• Restricted permissions
• Audit logging
• Alerting for configuration changes

An attacker who compromises a normal network administrator account should not automatically gain the ability to delete every backup.

Use Protected or Immutable Backup Copies

An immutable backup is designed so that data cannot be changed or deleted during a defined retention period. This can reduce the risk that ransomware or a compromised administrator removes recovery copies.

Monitor Backup Failures

Backup systems should generate alerts when:

• A job fails
• A device stops checking in
• Storage becomes full
• Protected data decreases unexpectedly
• Retention settings change
• A backup account is modified

Someone must be responsible for reviewing and resolving those alerts. An unread notification does not protect the business.

Keep Backup Credentials Secure

Backup passwords and recovery keys should not be stored in unsecured spreadsheets, email messages or handwritten notes left near equipment.

Step 5: Test Restoration and Recovery Procedures

The most important backup question is not “Did the job run?” It is “Can the company restore usable information within the required time?”

Quarterly Restoration Testing

A construction company should perform sample recovery tests at least quarterly for important systems.

Tests may include restoring:

• An email message
• A OneDrive file
• A SharePoint folder
• An accounting database copy
• An estimating file
• A server folder
• A complete virtual server
• A critical workstation configuration

Annual Disaster Recovery Exercise

At least once each year, perform a broader exercise that assumes a major system or location is unavailable.

Example scenario:

Employees arrive Monday morning and cannot access the accounting server. The server and its local storage have been encrypted. Payroll must be completed by noon, and three major vendor payments are scheduled for that afternoon.

The exercise should answer:

• Who declares the incident?
• Who contacts the IT provider?
• How is the affected system isolated?
• Which backup is selected?
• Where will the system be restored?
• How will accounting employees access it?
• Who validates the restored database?
• How will leadership and employees receive updates?
• When will cyber insurance, legal counsel or law enforcement be contacted?

Document Test Results

For every recovery test, record:

• The system tested
• The date
• The backup selected
• The time required to restore
• Whether the restored data was usable
• Problems discovered
• Corrective actions
• The person responsible

Testing turns backup from an assumption into evidence.

Step 6: Build a Complete Business Continuity Plan

Disaster recovery focuses on restoring technology. Business continuity focuses on keeping the company operating while restoration occurs.

Business Continuity Questions

1. How will employees communicate if Microsoft 365 is unavailable?
2. How will payroll be processed if accounting systems are offline?
3. How will field employees access current drawings?
4. How will project managers contact subcontractors and customers?
5. How will bids be completed during a system outage?
6. Where will office employees work if the building is unavailable?
7. Which vendors must participate in recovery?
8. Who is authorized to make emergency purchases?

Create Manual Workarounds

Temporary procedures may include:

• Emergency contact lists stored outside the primary system
• Printed or offline access to critical phone numbers
• Alternate payroll procedures
• Approved temporary communication channels
• Offline copies of active project information
• Temporary equipment replacement procedures
• Alternate office or remote-work locations

Define the Communication Plan

The plan should identify who communicates with:

• Employees
• Customers
• Subcontractors
• Vendors
• Financial institutions
• Insurance providers
• Legal counsel
• Government or regulatory contacts

Messages should be accurate and coordinated. Employees should not speculate publicly or provide unapproved information about a cyber incident.

Maintain Vendor and Account Information

Keep protected copies of:

• Internet provider contacts
• Software vendor contacts
• Cyber insurance information
• Banking contacts
• Cloud subscription details
• Hardware warranty information
• Administrative ownership records
• IT support escalation contacts

Critical recovery information should remain accessible when the primary network or Microsoft 365 environment is unavailable.

Backup Requirements for Microsoft 365

Microsoft 365 is a critical platform for many construction companies, but native retention and recovery features may not satisfy every business requirement.

Microsoft 365 Backup Checklist

• Exchange Online mailboxes are protected.
• Shared mailboxes are included.
• OneDrive data is backed up.
• SharePoint sites are protected.
• Departed employee data is retained appropriately.
• Restores can be performed at the item, folder and account level.
• Backup administration requires multi-factor authentication.
• Restoration tests are performed.

Questions to Ask About Cloud Backup

1. How frequently is Microsoft 365 backed up?
2. How long is data retained?
3. Can a single email or file be restored?
4. Can an entire mailbox or OneDrive account be restored?
5. Does the service protect Teams and SharePoint data?
6. How are former employees handled?
7. Who is authorized to perform restores?
8. How is the backup platform protected?

Backup Requirements for Procore and Other Cloud Applications

Cloud construction platforms manage their own infrastructure, but the construction company still needs to understand data ownership, retention and export options.

Questions to Ask the Application Vendor

1. How is customer data protected?
2. What recovery options are available after deletion?
3. How long is deleted information retained?
4. Can project information be exported?
5. Which data is included in an export?
6. How are closed projects retained?
7. What happens if the subscription ends?
8. Are third-party backup or archiving options available?

The company should avoid assuming that every project record can be restored indefinitely through the platform.

Document the System of Record

Define whether Procore or another platform is the official location for:

• Drawings
• RFIs
• Submittals
• Daily logs
• Photos
• Change orders
• Contracts
• Project correspondence

When information is split between Procore, email, SharePoint and local computers, the recovery plan must address every location.

Backup Requirements for Accounting and Estimating Systems

Accounting and estimating platforms may be cloud-hosted, server-based or installed on individual computers. The recovery method depends on the application architecture.

Accounting Backup Checklist

• The database location is documented.
• Backups are application-aware when required.
• Backup frequency matches the data-loss target.
• Copies are stored outside the production server.
• Recovery credentials are protected.
• Restored data is validated by an accounting user.
• Vendor support information is documented.

Estimating Backup Checklist

• Active estimate files are stored in an approved location.
• Templates, assemblies and databases are protected.
• Local-only files are identified.
• Replacement workstation requirements are documented.
• Software licenses and installation files are available.
• A sample estimate has been restored successfully.

How to Prepare for Ransomware

Ransomware can encrypt servers, workstations, shared files and synchronized cloud data. Recovery requires more than reinstalling antivirus software.

Ransomware Recovery Preparation

• Use endpoint detection and response.
• Require multi-factor authentication.
• Restrict administrator privileges.
• Patch systems consistently.
• Protect backups from deletion.
• Document system dependencies.
• Maintain incident response contacts.
• Test full-system recovery.
• Coordinate with cyber insurance requirements.

Do Not Restore Before Containment

Before restoring systems, the response team should determine:

• How the attacker gained access
• Which accounts were compromised
• Which systems remain infected
• Whether backup credentials were exposed
• Whether data may have been stolen

Restoring too early can allow the attacker or malicious software to compromise the recovered environment again.

911 IT's cybersecurity services help reduce ransomware risk through layered device, account and email protection.

How to Prepare for an Office Outage

A fire, flood, extended power failure or internet outage may make the main office unavailable even when cloud services remain operational.

Office Continuity Checklist

• Employees can work remotely from managed devices.
• Multi-factor authentication is enabled.
• Critical applications can be accessed securely.
• Phone services can be redirected.
• Emergency contact information is available.
• Accounting and payroll have alternate procedures.
• Replacement device options are documented.
• Leadership has a communication plan.

Backup Internet Connectivity

Companies that depend heavily on cloud systems should consider secondary internet service or cellular failover at the main office.

The decision should consider:

• Cost of downtime
• Availability of alternate providers
• Number of employees
• Cloud application dependence
• Phone system requirements
• Expected failover performance

How Much Does Backup and Disaster Recovery Cost?

Pricing depends on the amount of protected data, number of servers, Microsoft 365 users, retention period, recovery speed and level of monitoring.

Costs may include:

• Per-user Microsoft 365 backup
• Per-device or per-server backup
• Cloud storage
• Local backup appliances
• Disaster recovery infrastructure
• Monitoring and management
• Recovery testing
• Emergency recovery labor
• Cybersecurity and incident response services

Questions to Ask About Pricing

1. Which systems and users are included?
2. How much storage is included?
3. How long is data retained?
4. Are restoration requests included?
5. Is emergency recovery labor included?
6. Are quarterly recovery tests included?
7. What happens when storage usage increases?
8. Are replacement hardware or cloud computing costs separate?
9. Does the service include 24/7 monitoring?
10. Which costs apply during a declared disaster?

Managed IT for a construction company with 25–50 employees may commonly range from approximately $100–$275 per user per month. Backup, disaster recovery, storage and major recovery projects may be included or priced separately depending on the agreement.

Backup Versus Disaster Recovery Versus Business Continuity

Service	Primary Purpose	Example
Backup	Create recoverable copies of data	Restore a deleted accounting file
Disaster recovery	Restore systems and infrastructure	Recover a failed or encrypted server
Business continuity	Keep the company operating during disruption	Process payroll while the main office is unavailable

A complete plan includes all three. Backup alone does not explain how employees will work, communicate or meet project obligations during an extended outage.

Common Construction Backup Mistakes

1. Assuming Cloud Applications Are Fully Backed Up

Cloud platforms have availability and retention features, but those features may not meet every recovery requirement.

2. Backing Up Only the Server

Important information may also exist in Microsoft 365, estimating laptops, cloud applications and mobile devices.

3. Storing Every Backup on the Same Network

Ransomware or hardware damage may affect both production data and local backup copies.

4. Never Testing Restoration

A successful backup notification does not prove that files or systems can be restored.

5. Using One Administrator Account for Everything

Compromising one account should not provide access to production systems and every backup copy.

6. Ignoring Former Employee Data

Email, OneDrive files and application records may need to be retained after an employee leaves.

7. Failing to Define Recovery Priorities

Without priorities, the IT team may restore less important systems before accounting, payroll or active project information.

8. Forgetting Application Configurations

Files alone may not restore custom templates, databases, licenses and system settings.

9. Operating Without a Communication Plan

Employees, customers and vendors need coordinated updates during a major outage.

10. Assuming the IT Provider Covers Every Recovery Cost

Review the agreement for storage limits, project labor, emergency work and replacement infrastructure.

Construction Backup and Recovery Checklist

Inventory and Planning

• Critical systems are documented.
• Business owners are assigned.
• Recovery time targets are defined.
• Acceptable data-loss targets are defined.
• System dependencies are recorded.

Backup Coverage

• Microsoft 365 is protected.
• Accounting data is protected.
• Estimating files and databases are protected.
• Local servers are protected.
• Critical workstation data is protected.
• Network configurations are backed up.

Security

• Backup administration uses separate accounts.
• Multi-factor authentication is enabled.
• Protected or immutable copies exist.
• Backup failures generate alerts.
• Access is reviewed regularly.

Testing

• File restoration is tested quarterly.
• Cloud data restoration is tested.
• Accounting recovery is validated.
• Full-system recovery is tested where appropriate.
• Results and corrective actions are documented.

Business Continuity

• Emergency contacts are available offline.
• Leadership communication roles are assigned.
• Alternate work procedures are documented.
• Cyber insurance contacts are current.
• The complete plan is reviewed annually.

A 30-Day Backup and Recovery Improvement Plan

Week 1: Identify Critical Systems

• List Microsoft 365, accounting, estimating and project systems.
• Identify where important data is stored.
• Assign a business owner to each system.
• Rank systems by recovery priority.
• Document current backup coverage.

Week 2: Address Immediate Backup Gaps

• Add unprotected Microsoft 365 data.
• Confirm accounting database backups.
• Protect local estimating files.
• Review backup administrator accounts.
• Enable multi-factor authentication.

Week 3: Test Restoration

• Restore an email message.
• Restore a SharePoint or OneDrive file.
• Restore an accounting backup to a test location.
• Document recovery times.
• Correct failed or incomplete backups.

Week 4: Build the Continuity Plan

• Set recovery time and data-loss targets.
• Create an emergency contact list.
• Document employee communication procedures.
• Define temporary business workarounds.
• Schedule quarterly tests and an annual recovery exercise.

Questions to Ask a Backup and Disaster Recovery Provider

1. Which Microsoft 365 services will be backed up?
2. How will you protect our accounting and estimating data?
3. Are local servers and critical workstations included?
4. How frequently does each backup run?
5. How long is data retained?
6. Are any backup copies immutable or otherwise protected?
7. Who monitors backup failures?
8. Is monitoring available 24/7?
9. How often will restoration be tested?
10. Are test results documented?
11. How quickly can critical systems be restored?
12. Where will systems run during a major hardware failure?
13. Are emergency recovery services included?
14. Which costs apply during a declared disaster?
15. Can you help create and test a business continuity plan?

Frequently Asked Questions

What should a construction company back up?

At minimum, evaluate Microsoft 365, accounting data, payroll information, estimating files, local servers, critical workstations, project documents stored outside the main construction platform and network configurations.

Does Microsoft 365 need a separate backup?

Many companies use an independent backup to improve recovery from accidental deletion, compromised accounts, synchronization problems and retention limitations. The correct approach depends on the company's recovery and retention requirements.

Does Procore back up project data?

Cloud application vendors manage their own infrastructure, but customers should still review deletion recovery, retention, export and account-termination policies. The company should know how project records can be retrieved outside normal application access.

How often should backups run?

Backup frequency should match the amount of data the company can afford to lose. Critical accounting or operational systems may require backups several times per day, while archived information may require less frequent protection.

How often should backup restoration be tested?

Test representative file and cloud restorations at least quarterly. Perform a broader disaster recovery exercise at least annually.

What is an immutable backup?

An immutable backup is protected from modification or deletion during a defined retention period. It can reduce the risk that ransomware or a compromised administrator destroys recovery copies.

Is backup the same as disaster recovery?

No. Backup creates copies of data. Disaster recovery restores systems and infrastructure. Business continuity keeps employees and operations functioning while recovery occurs.

How long should backups be retained?

Retention depends on operational, contractual, legal and insurance requirements. Companies may need a combination of short-term recovery points and longer-term archives.

How quickly can a server be restored?

Recovery time depends on the backup design, system size, hardware availability, network speed and recovery platform. The required target should be documented before selecting a solution.

How much does managed backup and disaster recovery cost?

Pricing depends on users, servers, data volume, retention and recovery requirements. A construction company with 25–50 employees may commonly budget approximately $100–$275 per user per month for managed IT services, with backup storage, disaster recovery infrastructure or major recovery work included or priced separately.

Why Construction Companies Work With 911 IT

911 IT helps construction companies protect critical systems, verify recoverability and prepare for technology outages across offices and jobsites.

Construction clients receive access to:

• Microsoft 365 backup
• Server and workstation protection
• Accounting and application backup planning
• Backup monitoring and alerting
• Recovery testing
• Ransomware-resistant backup strategies
• Disaster recovery planning
• Business continuity planning
• 24/7 support and escalation
• Strategic technology guidance

Review 911 IT's business continuity services for backup and disaster recovery support. Companies that need broader technology management can also review managed IT services.

“They are always available and can take care of any need we have right away. I never panic anymore when something isn't working right. I just call anyone on the team, and they pleasantly take over.”

Rhonda, Office Administrator, Construction Industry

To assess your Microsoft 365, accounting, server and project data recovery plan, schedule a discovery call. You can also contact 911 IT for additional information.