Disaster recovery plan: why a Senegalese SME cannot do without it in 2026
In 2024-2025, several major Senegal incidents reminded of the importance of Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP / PRA): 18h Sonatel regional outage 2023, 2-day Dakar fiber backbone cut 2024, ransomware on local banking provider 2024 (11 days down), commercial data center fire 2025.
A SME without plan faces 3 outcomes: 1) improvise in panic (often disastrous), 2) pay ransom or emergency provider at extreme rates, 3) close permanently (40% of SMEs victims of major disaster without plan close within 12 months).
I helped 9 Senegalese SMEs structure their BCP/DRP. Here is the method.
H2: BCP vs DRP — understanding the difference
BCP (Business Continuity Plan). Global plan: how company continues to function during disaster. Covers all aspects: HR, premises, suppliers, client communication, IT, finance.
DRP (Disaster Recovery Plan / PRA). BCP subset, IT-focused: how to restore IT systems after disaster. Technical procedures, RPO/RTO, IT teams, providers.
For 10-50 employee SME: a single combined BCP/DRP document of 15-30 pages is enough. No need for 200-page library like in large groups.
H2: Identify critical functions (criticality matrix)
| Function | Impact if 24h down | Impact if 7 days down | Criticality |
|---|---|---|---|
| E-commerce site | 50-200 K FCFA loss | 350 K-1.5 M FCFA + reputation | CRITICAL |
| Business email | Client communication blocked | Total commercial shutdown | CRITICAL |
| Accounting (Sage / Ciel) | Manageable | Impossible month-end closing | HIGH |
| CRM | Manageable | Lost opportunities | MEDIUM |
| IP telephony | Support blocked | Catastrophic | CRITICAL |
| Shared drive | Manageable | Very handicapping | HIGH |
| HR / Payroll | Manageable | Critical month-end | MEDIUM to HIGH |
| Vitrine site | Image | Image | MEDIUM |
For each function: define RPO / RTO based on criticality. CRITICAL functions deserve RPO ≤ 1h and RTO ≤ 4h. MEDIUM can support RPO 24h and RTO 48h.
H2: Technical recovery architecture
Level 1 — Classic 3-2-1 backup. For basic SMEs (RTO 24-48h). Restoration from local or cloud backup. Low cost, low complexity.
Level 2 — Automated cloud snapshots. Microsoft 365 / Google Workspace / Wasabi / S3 have integrated snapshots. Partial restoration in 15-60 min. Ideal for digitized SMEs.
Level 3 — Continuous replication (Veeam, Datto, Zerto, AWS Backup). For critical functions. RPO 15 min, RTO 1-4h. Monthly cost: 80,000-280,000 FCFA by volume.
Level 4 — Backup site (DR site). Replicated infrastructure ready to activate. Very expensive (5-25 M FCFA / year). Reserved for SMEs with strong continuity requirement (high-volume e-commerce, fintech).
For majority of Senegalese SMEs: levels 1 + 2 combination is enough. Level 3 for identified critical functions. Level 4 only if revenue totally depends on availability (e-commerce > 500 orders/day, fintech).
H2: Crisis communication plan
Before the crisis.
- VIP client distribution list, key suppliers, employees (personal phones + WhatsApp + personal email)
- Prepared message templates (3 versions: short outage, long outage, major disaster)
- Identified backup channel: if email down, use WhatsApp; if Sonatel down, secondary operator (Free / Expresso)
- Designated spokesperson (CEO or CFO) + backup
During the crisis.
- Communicate AS SOON as we know: "We are experiencing an incident, team mobilized, next update in 1h"
- NEVER say "we don't know" without context: say "investigation underway, facts confirmed at T+1h"
- Regular updates (every 1-2h) even without news
- Public status: status.yourdomain.sn page (Uptime Robot, Statuspage, Cachet)
After the crisis.
- Public post-mortem communication within 7 days (transparency reinforces trust)
- Client compensations if relevant
- Internal lessons learned within 30 days
- Update BCP/DRP accordingly
H2: Semestrial exercises — the rule to stay operational
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
A written BCP/DRP never tested is fiction. Minimum practices:
Quarterly tests (by team).
- Partial backup / restoration (one folder)
- Test restoration on backup infra
- Email failover (SMTP failover)
Semestrial exercises (whole company).
- Table-top simulation: "Imagine tomorrow the data center burns. What do we do?". 2h guided discussion by realistic scenario.
- Verify distribution lists up to date
- Crisis communication test (send test message to VIP list)
Annual exercises (real).
- Complete DR: total simulation, restoration on alternative infra, measure real RTO vs target
- Optional external audit by cybersecurity consultant
H2: Recent Senegal examples — lessons to learn
Case 1 — Dakar law firm (2024). Ransomware via booby-trapped Word macro. 100% of file server encrypted. Local backups also encrypted (no air-gap). Fortunately: Backblaze offsite backup intact. Restoration in 4 days (real RTO). Total cost: 12 M FCFA (productivity loss + restoration + forensic audit + hardening).
Case 2 — Dakar fashion e-commerce (2024). OVH France server down 11h following OVH network incident. No recovery plan. Site unavailable 11h, direct loss ~280 K FCFA + temporary SEO loss. Could have been avoided with Cloudflare CDN + dynamic maintenance page.
Case 3 — Almadies medical practice (2025). Physical theft of main NAS server (nighttime office theft). Patient data lost. Fortunately: secondary NAS backup in another room + Wasabi cloud backup. Recovery in 36h. Would have been catastrophic without 3-2-1 backups (medical data loss + likely CDP fine).
Case 4 — Bel-Air logistics SME (2024). Partial office fire, server room affected. No cloud backup, only external hard drives in same building. 100% data lost. Permanent closure 6 months later.
FAQ
How much does a BCP/DRP cost for a 20-employee SME?
Initial realization: 1.5-4 M FCFA (audit, drafting, initial tests). Annual maintenance: 350,000-850,000 FCFA (updates, exercises, new employee training). Technical tools (backup, monitoring, replication): 280,000-650,000 FCFA / month (cf cloud backup article).
How many pages for an SME BCP/DRP?
Typically 15-30 pages. Content: criticality matrix, RPO/RTO by function, restoration procedures, communication plan, emergency contacts, backup providers, exercise log. Living document, updated 1-2 times per year.
Should we certify our BCP/DRP?
Not mandatory for Senegalese SMEs. ISO 22301 (business continuity) is useful only if responding to international tenders requiring this certification. Certification cost: 5-15 M FCFA. For majority: focus on solid uncertified BCP/DRP.
Which backup providers to identify?
1) Cloud backup (Backblaze, Wasabi, AWS), 2) Backup hosting (OVH, Hetzner, Scaleway, or local Senegalese: Sonatel Cloud, Solid IT, Atos Senegal), 3) Reactive cybersecurity consultant (intervention within 4h in case of incident), 4) Data lawyer (CDP notification if personal data breach).
What if an incident happens before we have a BCP?
1) Isolate affected systems (disconnect from network), 2) Preserve evidence (don't reboot, don't overwrite), 3) Call Senegal or international reactive cybersecurity consultant, 4) Notify CDP within 72h if personal data affected, 5) Communicate to clients/partners with measure, 6) Post-incident: start BCP/DRP project as priority.
Let's talk about your case
If you want to build a BCP/DRP for your Senegalese SME, we can design this end-to-end mission (audit, drafting, exercises, training). WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
