Disaster recovery is the discipline of restoring systems and data after a disruptive event — ransomware, hardware failure, vendor collapse, fire, flood. Where business continuity asks how operations keep running during the disruption, disaster recovery asks how the technology comes back, in what order, and how fast.
For an employer the ordering question has a clear answer that generic IT plans routinely miss: the systems that pay people come first, because wage deadlines are legal deadlines and they do not move.
The two numbers that define everything
Every recovery plan reduces to two figures per system.
Recovery time objective — how long the system can be down before the damage is unacceptable. For payroll, the honest answer is measured against the next pay date, not in abstract days.
Recovery point objective — how much recent data can be lost. A payroll restore that is missing the current cycle's changes — new hires, banking updates, final timecards — produces a run that is wrong in exactly the ways that generate claims.
Neither number is chosen by IT. They are business decisions with legal consequences, and the exercise of setting them per system is what converts a backup pile into a recovery plan.
Priority order for an employer
- Payroll and its inputs — the platform, the register, banking instructions, and the time data feeding it
- Time and attendance, both to run payroll and because record gaps resolve against the employer in disputes
- Email, since most coordination and vendor contact runs through it
- HRIS — emergency contacts, employment records, and the data other systems key from
- Benefits platforms, where enrollment windows and carrier deadlines continue regardless
Writing the order down matters because during an incident everything feels urgent, and recovery capacity is finite. The plan is what stops the loudest voice from setting the sequence.
The vendor-hosted complication
Most workforce systems are vendor platforms, which splits recovery into two distinct scenarios employers tend to blur.
The vendor is down. Their recovery arrangements govern, and the employer's leverage is whatever the contract says about recovery commitments and notification. Those terms are worth reading before signing rather than during an outage — and the employer still needs its own fallback for payroll, because the wage deadline is the employer's regardless of whose system failed.
The employer's access is down — compromised accounts, corrupted integrations, or the employer's own environment encrypted while the vendor hums along. Here the employer's plan governs: alternate access paths, independent copies of critical data, and credentials that survive the incident.
The independent copy is the hinge in both scenarios. A periodic export of the payroll register and essential HR records, stored encrypted and apart from production credentials, is what makes any fallback executable.
Ransomware changed the assumptions
Traditional recovery assumed a clean restore onto trusted infrastructure. Ransomware breaks both halves: backups are targeted deliberately, and restoring onto a still-compromised network re-encrypts the restored data.
The adjustments: at least one backup copy offline or immutable, with credentials separate from production; version depth, because the newest backup may already be poisoned; and a recovery sequence that validates the environment before restoration rather than after. Evidence preservation belongs in the sequence too — the instinct to wipe and rebuild destroys the logs that determine what data was accessed, which is the question the breach analysis depends on.
Testing is the difference between a plan and a hope
The recurring discovery in real incidents is that the plan describes a recovery nobody has performed. The restore takes four days, not four hours; the export job stopped running in March; the one person who knows the procedure is unreachable.
The test regimen that catches this is modest: restore something real quarterly, time a full recovery of the priority systems once, and run one tabletop a year with the named people walking through the realistic scenario — which for most employers is ransomware in the week of a pay run, not a regional catastrophe.
Each test failure found in an exercise is one that will not be found on a payday.
Employer's Guardian helps employers build payroll continuity and recovery priorities into their operations through payroll management services.
This article provides general educational information, not legal, tax, or insurance advice. Pay-timing requirements vary by jurisdiction and continue to apply during outages.
