Disaster Recovery & Incident Response For Accidental Techies

Tony Martignetti
Hello and welcome to Tony Martignetti Nonprofit Radio, big nonprofit ideas for the other 95%. I'm your aptly named host and the podfather of your favorite hebdomadal podcast. I'm traveling for several weeks, so my audio is not going to sound as good as it usually does on the road with my laptop. But the, uh, the quality is still there. It's just that the, the, the substance, of course, still high quality. It's just the sound quality, not so good. Oh, I'm glad you're with us. I'd suffer the effects of urethral incontinence if I had to leak the idea that you missed this week's show. Here's our associate producer Kate with what's up this week.

Kate Martignetti
Hey Tony, here's what's up. Disaster recovery and incident response for accidental techies. Our conversations from the 2026 Nonprofit Technology Conference continue with your DR and IR plan. Cyberattacks, hardware failure, or human error can cause big problems but get minimized when you have the right plan in place. Amanda Bache helps you keep calm when everything crashes by working ahead of time to identify your critical systems, create actionable response steps, test your plan, and maintain resilience. She's with Paths For Families. On Tony's Take Two.

Tony Martignetti
Under pressure.

Kate Martignetti
Here is Disaster Recovery and Incident Response for Accidental Techies.

Tony Martignetti
Welcome to Tony Martignetti Nonprofit Radio coverage of the 2026 Nonprofit Technology Conference. We're wrapping up our day 2 coverage with Amanda Bache. Amanda is IT Support and Operations Specialist at Paths For Families. Amanda, welcome to Nonprofit Radio.

Amanda Bache
Thank you for having me.

Tony Martignetti
I'm glad you're with us. Your topic is Disaster Recovery and Incident Response Essentials for Accidental Techies. That's great. So you obviously do not need to be a tech person to understand what to do in case of disaster. Or bad incidents. Could you just give us an overview before we get into it deeper?

Amanda Bache
Incident response and disaster recovery, you want to be prepared for anything from floods, fires, anything that can happen to your agency or your house. And also incident response like cybersecurity and ransomware. So you want to be prepared for either of those incidents and have a policy so you're not making the decisions on the fly and in the panic.

Tony Martignetti
Okay. You want us to keep calm during these?

Amanda Bache
Yes.

Tony Martignetti
All right, thank you. Thanks for that, like, 30,000-foot overview. So let's dive in a little bit. Yeah, so it's not all bad actors, like you said, floods, fires, right? Technology fails. You may have heard rumors about that from time to time. Hardware fails. Correct. Okay, okay. But it could also be bad actors. Yes,

Amanda Bache
definitely. That will— the cybersecurity. That's— we're going to tie that into bad actors with cybersecurity, and then the incident response.

Tony Martignetti
Okay. Okay. Would you like to talk about the cybersecurity first? Is that the best way?

Amanda Bache
Or we can talk disaster recovery. And then there's another plan called business continuity. Business continuity is kind of where you want to keep all of your business essentials in one place.

Tony Martignetti
Yeah.

Amanda Bache
And basically, I call it a table of contents of any incident policies you may have.

Tony Martignetti
All right.

Amanda Bache
And you want to just think about like, what are you going to do in a disaster, what you're going to do in an incident response, and then what you need to do to get back online.

Tony Martignetti
Okay. Okay. So let's start with disasters.

Amanda Bache
Yes.

Tony Martignetti
I don't know. We wake up and there's a flood.

Amanda Bache
Yes.

Tony Martignetti
Right? I mean, it happens.

Amanda Bache
Yes.

Tony Martignetti
There's a fire. All right. So what do we need to be thinking about in our disaster recovery plan so that we're not Panicked, and we are— well, we're still gonna be a little panicked with a fire or flood, but we're not as panicked as we would be if we had no plan.

Amanda Bache
The first thing you want to think about is how you're gonna communicate with other staff and how you're gonna make sure everybody's safe.

Tony Martignetti
Communication,

Amanda Bache
that's the biggest thing, is we want to make sure they're safe. If obviously we're gonna call people or email them, but it might be the internet might be down, like wireless communications could be down. In which case, you can create like a meeting spot. And we— so we have 2 offices in Maryland, and we created a park, or designated a park in between the 2 offices. And within a certain time frame after that incident, we all go and meet at the park in person in order to make sure we're actually all physically safe, and to see if anybody needs any support. Okay. Another piece of advice I give everybody is buddy system. So, if you have somebody that lives near you, Go check on them. Like, does anything, you know, do they need anything? Are they physically okay? And then the last piece is we have to have 2 forms of communication, like emergency contacts for somebody. And this is also good for our remote workers who might work in another state. And let's say a hurricane has hit Texas before and we have a worker in Texas. We couldn't reach her because she was out of power. So we were able to contact family that she had in the area, and they were able to confirm that she was okay. She just had lost power. So it's a way to also include remote employees who are not physically in the state that you are in.

Tony Martignetti
Okay, and those forms of contact, that includes other people? Yeah. I thought you were talking like cell and email.

Amanda Bache
Yeah, but like cell and email might be down, so then you got to think of an alternative way to make sure everybody is safe.

Tony Martignetti
Okay, so there's an alternative contact person?

Amanda Bache
Yes.

Tony Martignetti
For everybody on the team? Yes. Okay, okay. And who's managing our disaster recovery and incident recovery plan?

Amanda Bache
The plans are made for the people. Like, they help avoid confusion and panic. But basically, the agency will develop the plan. The IT team, like our IT team, is developing the plan. But we're help— like, especially disaster recovery, we're including everybody else's feedback. Because we want to make sure, like, what do you think you might need in a disaster? Like, what do you think would help you? So disaster recovery, we are including like other staff people and their feedback because we want to make sure like, what do you need and what can we do to help you?

Tony Martignetti
Because part of it— well, you just talked about safety and communications. Yes. How can we make sure you're safe? Yes. And how can we get in touch with you?

Amanda Bache
Yeah. And that's the other thing is how do we keep people safe? Not only how do we communicate with people, but how do we keep people safe? So one of the things that we talk about is like if there's an incident in an office location or your home, Evacuate if you need to, and then shelter in place. People don't think about that, so we actually lay it out in the plan. And so, like, shelter in place, turn off any, like, white lights, any music-producing or, you know, noise-producing things. And, like, if you can, move heavy furniture in front of a door to protect yourself. Not necessarily from, like, an active shooter, but it could be fire, it could be anything else. And then the other thing we want to think about is also sending emergency alerts out. So if you're in an office and let's say there's something going on in the office, you want to alert somebody who might be coming into that location and say, hey, there's a fire in the office. Don't— everybody stay away from this location. Because somebody just could come into that office and not know.

Tony Martignetti
How do you do that? Emergency communication?

Amanda Bache
Sometimes via email, or you could do like group text. Or like WhatsApp text or Teams if you have that information. Sometimes like we've had somebody call somebody else and be like, I can't talk, I can't send this out, can you alert the other staff that this is going on? It was just a power outage. We had a power outage in the office. Obviously, she couldn't get anything out because everything died on her. And so like, can you let everybody know don't come in because we have a power outage? Yeah. And then we also say follow local law enforcement. Instructions. So if they're on scene, they take priority and they're going to be the ones that help do that.

Tony Martignetti
Do you practice these?

Amanda Bache
We haven't, but we are going to start. I call them like fire drills.

Tony Martignetti
Yeah, yeah, we walk in and there's a— all of a sudden there's— you're just— you came into a fire.

Amanda Bache
Yeah.

Tony Martignetti
And you were just told to evacuate. All right, so do it and let's carry out the plan.

Amanda Bache
Yeah, that's the same thing we used to do in elementary school, like fire drills, because you thought we'd never know. Yeah. And then the next thing we talk about in disaster recovery is how do we return to work? How do we do the work we do if something might be going on? So we always tell everybody, be flexible. Like, understand. And if we can get a message out to clients, just explain to them, like, hey, there's been a fire. Our staff is affected. If we can't, then we'll just, like, maybe remote work. Everybody just shifts to all remote work. Or they— we can work from an alternative location. So if your office has had a fire, you can maybe go to a local library and work at your library in order to get the work done. And then you always want to have your leadership— obviously, they know what's going on— and ensure that they have clear communication out to the staff what to expect. Like, everybody can remote work. OK, the office is going to be reopening. Everybody can come back. And so it's just making sure that everybody Okay.

Tony Martignetti
Do you have point people for each of these communications? Like, even the emergency communications? Is there somebody designated and then there's a secondary, or it's—

Amanda Bache
We haven't thought about that, but that's a really great idea. But if whoever's in the office, if there is something going on—

Tony Martignetti
The primary person might not be there.

Amanda Bache
Yeah. So it's like, if there's a fire in the office and there's a person there, then obviously they're the point contact to get the information out.

Tony Martignetti
I was thinking more like routine, like coordinating, communicating with the staff. The office is going to reopen in 3 days.

Amanda Bache
Yeah, that would typically be like the senior leadership and like the CEO. Like, I know our CEO, like when we recently had a snowstorm, an ice storm, we actually did shut down for a while. And she was communicating out via emails, hey, we're going to be closed for 2 days. Hey, everybody can take a 2-hour delay. So she was kind of the one that was like leading the charge and letting everybody know about that.

Tony Martignetti
Okay. Okay.

Amanda Bache
Yeah.

Tony Martignetti
What else besides safety communications? What else belongs in this disaster recovery plan?

Amanda Bache
It's just everybody just has to remain flexible and remain calm. And the more you can do that, the better everything will be. And then like, just every— just take your time getting back to normal. Be safe about it. If you don't feel comfortable coming back yet, just communicate with that. And I feel like at that point, Everything's great. The only other thing I recommend is with all of your policies like this, disaster recovery and incident response, make hard copies for all of your offices. And all of like your IT and leadership have printed copies in their homes in case the internet goes down and we can't get to it.

Tony Martignetti
I can't access my plan.

Amanda Bache
Yeah, then we're in big trouble. Like, oh, well, what do we do? Well, I don't know. It's in SharePoint. Yeah, it's the plan in the cloud and we can't get to the cloud.

Tony Martignetti
All right.

Amanda Bache
Yeah.

Tony Martignetti
Okay. Excellent. I was thinking of something, but it's escaped me. I'll think of it. What— so distinguish this again between disaster recovery now and incident response.

Amanda Bache
Yes. So the way that disaster is like you're recovering from a disruption, a major disruption that has happened with your agency. The incident response plan is now Something has happened, now how are we gonna fix it? And that's gonna be a lot more involved than disaster recovery. So the first thing you want to think about—

Tony Martignetti
I'm sorry, before we get to incident response, I thought of the thing I was thinking about. Okay, cool.

Amanda Bache
Disaster recovery.

Tony Martignetti
Yeah. We're gonna be remote maybe for a week. We had a fire, flood, whatever. What if everybody doesn't have the tech at home that they need to do the work remotely, and their laptop was In the flood.

Amanda Bache
Yeah, I mean, it's something we'll definitely work with staff on. Thankfully, our office, we all have laptops and we all work from home, but if need be, we would make sure they have what they needed to get the work done. Like, again, if you have a buddy system or if there's a way we can FedEx you something, if you live externally but something happened and you need us to send you a new laptop because yours burned up or something, we can obviously FedEx and get you what we need.

Kate Martignetti
It's time for Tony's Take 2.

Tony Martignetti
Thank you, Kate. I'm feeling under pressure with my book. The editor is the next step, and she needs enough time with it before we get it to the graphic designer who also needs time with it. And this is This is all just feeling, uh, a little stressful, a little, uh, you know, like deadlines are imminent. I've got to finish my part within the next like 7, 8, 8 days or so, and there's still a fair amount to do. So that's why I say feeling under pressure, like the, uh, Queen and David Bowie song from 1981. Yeah. Under pressure. That's all I'll sing, uh, trust me. So just, uh, sharing that, you know, book publishing, self-publishing is, uh, still fun and I'm enjoying it. Uh, it's, it's a challenge, but I'm up to it. It's just, uh, feeling under pressure for the next week or so. And that's Tony's Take 2. Kate?

Kate Martignetti
Well, if singing doesn't work out, at least you'll have a book.

Tony Martignetti
Singing is not likely to work out, so the book better do very, very, very well.

Kate Martignetti
We've got just about a buttload more time. Here's the rest of Disaster Recovery and Incident Response for Accidental Techies with Amanda Bache.

Amanda Bache
Please. Incident response, it's like, what are you going to do when something happens? So the first thing I like to lay out in my incident response plan is identify what your 3 tiers are for your software. So tier 1 would be the most critical software, and that can't go down. Like, you can't function as an agency if it goes down. And so our example would be email, Our website, like our phone system, things like that, because we need to be able to get in the clients and get the support out. Tier 2 would be something that can go down for a small amount of time for a small disruption, but has to come up in order for us to function a little bit. So our example would be like Zoom and Teams, because that's how we do our video calls and our trainings. Yeah. Mm-hmm. And then tier 3 is some, like, things that can go down, but they don't need to come up right away, and you can find workarounds. So such as like FedEx.com, Stamps.com, like if we need to send something out, we can just get in our car and take it to there. So you want to start by thinking about what are the most critical things first. So when you do have an incident or a disaster, you know what you need to bring online first, second, and third.

Tony Martignetti
Okay.

Amanda Bache
Yeah. So with an incident response—

Tony Martignetti
Yes, what else?

Amanda Bache
Yeah, so you want to think about— the first thing you want to think about is who is going to be on the team. You have to have an incident response team. Like, who is going to be on the team to help run the plan when something goes wrong?

Tony Martignetti
Who ought that be?

Amanda Bache
Yeah, great question. So that— you could— it can vary depending on the agency and who wants to know. See, on ours, we have about 5 people. But you could have up to like 6, 7, or 8 people. So one instance is the IT manager and IT lead. They're going to be the person that kind of liaisons between all of the members of the team, kind of making sure everything's getting done, we're on track with things, things like that. You can have your IT support and IT vendors. So like we use a managed service provider, and we also have an MDR vendor. So we would include them because they need to know what's going on.

Tony Martignetti
What's MDR?

Amanda Bache
I can't remember right now. What do they do? So they monitor all of the backend, like the vendors and stuff, and all of our security. Okay. It's blanking on me right now.

Tony Martignetti
That's okay. All right. They manage your backend. They watch your butt.

Amanda Bache
Yeah. And they'll alert us if somebody is logging in from Sweden or something. So they just kind of help monitor our logins and what's going on. Okay. And then you, if you have communications and PR team, so if you need to get anything out to the media, you want to have somebody on your team if you need to do that. You want to have legal counsel, so in case there is law enforcement involved or anything, we want to have legal involved in case you need legal advice. Okay. You'll have HR in case there's any staff or personnel issues that are going on. And then The biggest thing is cybersecurity insurance and vendor. So just a little caveat, I highly recommend everybody has cybersecurity insurance because they will help you along the way. And like, we did have an incident 3 years ago, but we, we didn't know what to do. Bad actor? Yeah, so somebody clicked an email, signed in, and then they got their credentials and they were able to log in as that person. And I caught it. I called the person. I'm like, did you send this email? And they were like, no, I'm at my son's karate practice. I'm like, oh. So I called my managed service provider. I'm like, we have a problem. What do we do? And they were like, okay, well, let's call the cybersecurity insurance company. So, and we did. They helped us hire a forensic investigator. Hmm. They helped craft the message that we sent out to the clients, help with like the client's credit reports, like credit monitoring. They crafted what we needed to put out for social media, and thankfully it was just a small fee deductible that we had to pay, and that was it. But if the agency does not have cybersecurity insurance, they could go bankrupt paying for all of that. And like I said in my session, I probably wouldn't be here if we didn't have cybersecurity insurance. So always include them in the team too, because They took off running, and they did it all, which was great, because we didn't know what we were doing.

Tony Martignetti
Also, the reputation to risk. Yeah. Your public communications, they helped you craft.

Amanda Bache
Oh, it was perfect. They kind of did everything. But it was like we just kind of went from— but I highly recommend, if you're going to take one thing away, have cybersecurity insurance. Because without them, it's going to cost tens of thousands, if not hundreds of thousands of dollars to recover from something. Yeah.

Tony Martignetti
More on incident response?

Amanda Bache
Yes. What else? Yeah, so you want to establish clear communication. So again, essential communication is key, depending on the urgency. So like when we had our incident, I picked up the phone and called, which is not our norm these days to actually physically call somebody. But if I had sent her an email, she may not have seen it till the next day, and the bad actor could have been like in the system for even longer. than it was. So like, think about that as well. And then you also kind of want to think about documentation. That's the next biggest thing I want to say about any type of plan and policy. If you ever have a disaster or an incident response, you want to document everything. So think about how you're going to document and like how you're going to report, how you're going to train staff to report an incident. Yeah. And like set up logs. Like it could be a Word document or an Excel, and they could just be like, like the who, the what, the when, the where, the why. Just like Tina Smith reported a phishing email and she's not sure if it's a real thing or not. So we're just gonna document it. It's better to have it documented than not sure. Which kind of leads us into the next stage of the, like, what I call the life cycle. of an incident response plan.

Tony Martignetti
Yeah.

Amanda Bache
It kind of goes in a circle, but then it can kind of jump around the circle a little bit, which I'll talk about. So the first thing you want to do is preparation, which is creating your incident response plan, creating the team, getting those documentation ready, those logs ready, like, and then explain, train the staff, like, what phishing emails look like. Do the cybersecurity training with staff so they understand what they're looking at, how to report it. And you also want to tell them who to report it to. Like, in our incident, like, you're gonna report it to, like, me and my boss. Like, we have a little form, and then we'll take it from there, and then we'll contact you, and then we'll see if it's a real incident or not. So that's part of the preparation, is like training everybody. And I always say at that point, you're gonna hope and pray you don't go any further than that.

Tony Martignetti
Okay.

Amanda Bache
But then the next stage is what I call detection and analysis. So, we've gotten an alert from somebody that they think there's an incident. We're gonna investigate everything, whether it's like, oh, I've got a phishing email, I'm not sure what it is, or, hey, there's somebody that's locked my computer out and I have ransomware. So, we're at that point, we're going to investigate it. We're going to document the call or the, like, the report. And then we're gonna like take a look and see like, okay, this is just a phishing email. Thanks for not clicking this. Great job detecting, you know. And then at that point, we'll go back.

Tony Martignetti
Training paid off.

Amanda Bache
Yeah, exactly. Gold star. And then at that point, we're gonna go back to the preparation. So it's kind of like a bouncing around circle. And then if at that point, if we realize it's an actual incident, like, like this, we had hacked and we had bad actor in her email. We, at that point, it's detection, it's containment, eradication, and recovery. So there's 3 steps in that part of the plan. Containment, we want to contain that incident. So like we want to make sure like the bad actor is getting out of that person's email. So we like reset the password, reset multifactor, and we were like looking at how this could happen.

Tony Martignetti
Plus you have a team or a vendor who can help with forensics.

Amanda Bache
Exactly. Check them out.

Tony Martignetti
Yeah. See where they've been.

Amanda Bache
And then the backing, because we were like, Okay, we know this happened, but how did this happen? So again, we had the forensic investigator. They looked into how it happened. And then, so that's containment. And then eradication is how are we going to fix this? So it could be like patch on a software since your computer's screwy, like somebody got in. So eradication is maybe we need to reimage the computer. Maybe we need to start from scratch. Maybe we just need to remove the software. Right. And then once we've done all of that, recovery is we want to make sure that everything is working as it should, but we also want to make sure other staff are not experiencing that same incident. Mm-hmm. So like, it was an email that got sent out to everybody. I was like, this looks weird, but we wanted to make sure that other people didn't click that same email that caused that. So we were like, is everybody okay? Did you— you know, everybody's doing everything and that's You know, you should be doing. Sure. And then from that, it's like, it's a full-blown incident. We've contacted everybody. We've done the plans. And now everything's hopefully back to normal. And then what you want to do is you want to have a post-incident recovery meeting. So once after the incident has completed, you're going to get your incident response team together. together, and you're going to have like a follow-up meeting about it. And my biggest advice is that we're here to learn what happened from beginning to end, but we're not here to blame anybody for what they did or what they clicked or, you know, if they didn't do something right. We're here to learn about the process, whether it worked or not. So in that meeting, you'll want to talk about like the timeline from beginning to end. Like, All right, like, this person caught it, we reported it, then we did this, then we did that. And given that also, you want to also review all the documentation logs that we have. So who did what, when, where, who talked to whom, and like, we want to make sure everything is like, the i's are dotted and the t's are crossed, because if law enforcement has us have to get involved, they're going to want our logs. Right. So, they would want to know what happened from A to Z and all the details in between. And then you want to figure out what worked well, what didn't work well, and then you kind of want to like go back and review the plan. And like

Tony Martignetti
learn from what went well and didn't.

Amanda Bache
Yeah, like, is this working as it should? And then if it didn't, go back and tweak the plan. Just start small. That's like my old biggest advice is start small. Even if you have a one-page incident response plan, start small and then go from there. As you know, you kind of not just hope that anybody has to go through with it, but just start small with one page and then kind of build on that and figure out what's needed at that point. Okay.

Tony Martignetti
Okay.

Amanda Bache
Yeah.

Tony Martignetti
You had wanted to talk a little about business continuity.

Amanda Bache
Yeah. So business continuity is— I call that the umbrella of all the disaster recovery and incident response plans. In there, I talk about the tiers that I mentioned earlier about the software system.

Tony Martignetti
Tier 1, 2, 3, most critical.

Amanda Bache
And you also want to lay out what disasters you're actually going to cover, or what incidents you want to cover in the disaster recovery and incident response. So it's like the umbrella term. So are we going to cover natural disasters, active shooters? Really be linear about everything that we want to cover. and have policies for, because that way somebody knows like, oh, if there's an active shooter in our office, okay, that's in the disaster recovery plan. So it's kind of like your table of contents of like, where do we find this? Where, like, if there's an incident or there's a disaster, where do I go? So it's like, that's your umbrella and holds all the information on there. The other thing that I get questions about a lot is how do we get buy-in from leadership and board about needing these plans? Yeah. The best way to describe that and get the buy-in from them is explaining the risks, like what could happen if we don't have this plan. And the answer is, you are making decisions on the fly in a panic and crisis mode, and they may not be the most ethical and responsible thing. You're just running around like a chicken with its head cut off because you don't know what to do. And you also want to explain to them what's going to happen. without it because it's going to be a hot mess. And so, that's a big question that I get all the time is like, how do I get buy-in? Because nobody's like, we don't need these. I'm like, yeah, we really do. And so, we didn't have a plan when we had our incident and leadership was like, oh, we were okay. We survived and everything went fine. I'm like, no, it didn't really.

Tony Martignetti
Tiny incident.

Amanda Bache
Yeah.

Tony Martignetti
You're talking about the one that you— Yeah. You reported? Yeah. That was pretty small in the scale of disasters and incidents.

Amanda Bache
Yeah, but it was like, they don't need a plan. I'm like, it was a little crazy because I didn't know who to call. I didn't know what to do. We had to call a friend's because like, we called Matt. It was a little crazy. And so we were like, no. I was a little panicked. And if I had had a plan, I would have been like, okay, open the book. All right, this, I do this. Okay, you do that. So it's really helpful to have like How are we going to keep our business running when there's a problem?

Tony Martignetti
Yeah, that's a good way to stop, I think. Yeah. How are we going to continue business? Because there are people counting on us. Well, people, animals, the environment, whatever, whatever, whatever our work is, there's, there's someone or something counting on us.

Amanda Bache
Yeah,

Tony Martignetti
we got to continue.

Amanda Bache
Yeah.

Tony Martignetti
Amanda Bache, IT Support and Operations Specialist at Paths For Families. Where's Paths For Families?

Amanda Bache
Oh, we are located in Maryland, DC, and Virginia.

Tony Martignetti
Okay.

Amanda Bache
Yeah.

Tony Martignetti
Thank you very much.

Amanda Bache
Thanks for sharing. Thank you for having me. I really appreciate it.

Tony Martignetti
You're welcome. Thank you. And thank you for being with Tony Martignetti Nonprofit Radio coverage of the 2026 Nonprofit Technology Conference in Denver.

Kate Martignetti
Next week, more from 26 NTC with Branding your giving programs, and donor retention. If you missed any part of this week's show,

Tony Martignetti
I beseech you, find it at tonymartignetti.com.

Kate Martignetti
Our creative producer is Claire Meyerhoff. I'm your associate producer, Kate Martignetti. The show's social media is by Susan Chavez. Marc Silverman is our web guy, and this music is by Scott Stein.

Tony Martignetti
Yeah! Thank you for that affirmation, Scotty. Be with us next week for Nonprofit Radio, Big Nonprofit Ideas for the Other 95%. Go out and be great.