Disaster Recovery: A Roadmap for NYC Nonprofits

It also covers lost service capacity, delayed contracts, disrupted payroll, unavailable records, interrupted communications, and board decisions made without current data.

A NYC nonprofit disaster recovery plan checklist must therefore address the organization as an operating system. Facilities are one component. The plan also needs decision authority, technology recovery, client communication, vendor dependencies, cash controls, insurance records, staff safety, and the sequence for restoring programs.

The local planning environment provides a usable structure. The Human Services Council offers an Emergency Plan template and worksheets. Nonprofit New York separates emergency planning, disaster recovery, and business continuity into three phases. NYC Emergency Management operates Partners in Preparedness for public, private, and nonprofit organizations. These resources reduce the cost of starting. They do not remove the need for organization-specific analysis.

The three phases: emergency, recovery, continuity

Disaster planning fails when all post-incident activity is placed under one heading. The first hours, the first operating period, and full restoration require different decisions.

Nonprofit New York’s framework distinguishes three phases:

The phases overlap. They are not a linear project schedule. A shelter-in-place order may end while technology systems remain unavailable. A facility may reopen while the organization cannot process invoices or access case records. Recovery status must be tracked by function rather than declared for the organization as a whole.

Emergency planning is a control problem

The emergency phase begins with authority. The plan should identify the person who can suspend operations, close a site, authorize emergency purchases, move services, approve public statements, and contact government partners. Titles alone are insufficient. The plan needs primary and alternate assignments.

A practical emergency authority matrix includes:

• Incident lead and alternate.
• Facilities and safety lead.
• Staff accountability lead.
• Technology and data lead.
• Finance and procurement lead.
• Program continuity lead.
• External communications lead.
• Board liaison.
• Legal, insurance, or compliance contact.

The matrix should state the conditions under which each role activates. It should also define the escalation path when the primary contact is unavailable. A disaster plan that depends on one executive is a single-point-of-failure document.

The first operational record should be an incident log. It should capture the time of the event, decisions made, people contacted, expenses incurred, service interruptions, and unresolved risks. This record supports later insurance claims, grant reporting, contract discussions, board oversight, and corrective action.

Disaster recovery is a prioritization problem

Recovery cannot restore every function at once. The organization needs a ranked list of services and dependencies.

A useful prioritization model separates:

1. Services with direct safety or statutory consequences. These may include shelter, food distribution, medical support, crisis response, residential care, or mandated reporting.

2. Services tied to contractual or funding requirements. An interruption can affect reimbursement, performance metrics, or renewal decisions.

3. Services that support other programs. Intake, scheduling, payroll, case management, transportation, and language access may not be visible to clients but can block delivery.

4. Functions that can be deferred without creating immediate exposure. Routine events, noncritical meetings, and selected administrative projects usually belong here.

Each priority should have a minimum operating requirement. “Resume case management” is not a recovery target. “Restore access for six authorized case managers, recover the current client roster, establish a secure intake method, and document offline activity” is a target that can be tested.

Business continuity is a governance problem

Business continuity extends beyond restarting programs. It covers the conditions for sustainable operation after the immediate incident.

The board and executive team should review:

• Whether reserves can cover the interruption period.
• Which restricted funds can or cannot be used.
• Whether emergency procurement controls remain active.
• How deferred revenue and interrupted deliverables will be handled.
• Whether payroll, benefits, and contractor payments are protected.
• Which contracts require notice of interruption.
• Whether compliance deadlines need extensions or alternate submission methods.
• How the organization will report recovery status to funders and the board.

Fiscal health affects recovery speed. An organization with low unrestricted liquidity may need to reduce programs even when demand rises. A continuity plan should map available cash, restricted balances, receivables, emergency credit, insurance coverage, and expected public payments. The goal is not to produce a forecast with false precision. The goal is to identify the point at which service restoration becomes financially unsustainable.

A disaster plan is not complete when it describes an emergency. It is complete when the organization can identify its first service, first payment, first decision, and first compliance deadline after the interruption.

Building the NYC nonprofit disaster recovery plan checklist

The Human Services Council’s Emergency Plan template covers preparedness, emergency action, continuity of operations, and plan sustainability. Its value is structural. It gives an organization a way to place operational details into a single planning system instead of distributing them across emails, policy folders, and individual memory.

The template should be adapted to the nonprofit’s service model, sites, workforce, technology, and funding structure. A food pantry, residential provider, arts organization, legal services group, and youth program will not have the same recovery sequence.

A working checklist should include the following components.

1. Organization profile and operating assumptions

Record the legal name, locations, program sites, executive contacts, board leadership, major vendors, funders, government contracts, insurance contacts, and after-hours numbers. Include the assumptions that shape the plan:

• Which services operate seven days a week?
• Which programs require physical access?
• Which services require licensed or credentialed staff?
• Which data must be available within hours?
• Which activities depend on city transportation, public buildings, or external referrals?
• Which functions can be performed remotely?
• Which functions require secure onsite equipment?

The plan should include a maintenance owner. Without ownership, contact lists and vendor information become stale. A quarterly review is a practical baseline for high-dependency organizations. Smaller organizations can align updates with board meetings, contract cycles, or budget review.

2. Critical functions and recovery objectives

For each critical function, define:

• Maximum tolerable interruption.
• Minimum staffing level.
• Required technology.
• Required records.
• Required physical space.
• External dependencies.
• Alternate method of delivery.
• Person authorized to restart the function.
• Evidence that the function is operating.

The maximum tolerable interruption should be expressed in operational terms. “As soon as possible” cannot guide resource allocation. A program may require same-day contact with clients, while monthly reporting may tolerate a longer delay. These distinctions drive the recovery order.

3. People and staffing

A continuity plan must account for staff absence, not only facility closure. The workforce may be affected by transportation disruption, caregiving responsibilities, illness, housing loss, or communication failure.

The plan should identify:

• Minimum staffing by program.
• Cross-trained backups for finance, payroll, technology, and compliance.
• Remote work requirements.
• Access to secure systems from alternate locations.
• Supervisor authority during an incident.
• Contractor and volunteer roles.
• Staff check-in method.
• Rules for approving overtime or emergency shifts.

Cross-training has a measurable management value. If only one person can submit payroll, access the donor database, or upload a required report, that process is not resilient. It is dependent on an individual.

4. Data, technology, and records

The technology section should name systems rather than categories. “Back up data” is not a plan. The organization should know which platform contains client records, donor data, payroll information, contract files, grant reports, board minutes, and financial statements.

For each system, document:

• System owner.
• Vendor and support contact.
• Authentication method.
• Backup frequency.
• Recovery location.
• Authorized users.
• Manual fallback.
• Data restoration test date.
• Privacy and security constraints.

Offline procedures require the same discipline. If paper intake forms are used during an outage, the plan must state where they are stored, who can access them, how they are secured, and how records are entered after restoration. Duplicate records create compliance exposure if reconciliation is not assigned.

A recovery plan should also define the minimum technology environment. The organization may not need every application to resume limited service. It may need secure email, payroll, a client contact list, a payment method, and a method for documenting service delivery. That minimum set should be tested.

5. Finance and procurement

Emergency spending often exposes weak segregation of duties. The plan should preserve basic controls while allowing decisions to move at incident speed.

Document:

• Who can authorize emergency purchases.
• Spending thresholds.
• Required backup documentation.
• Alternate payment methods.
• Bank and payroll contacts.
• Access to accounting records.
• Rules for cash handling.
• Reconciliation responsibility.
• Board notification thresholds.
• Insurance and reimbursement documentation.

Overhead ratios do not predict recovery capacity by themselves. They also do not show whether an organization can absorb a two-week interruption. Unrestricted cash, receivables, vendor terms, payroll obligations, and program restrictions provide more direct information about short-term resilience.

6. Communications

The communications plan needs separate internal and external protocols. Staff require instructions on reporting status, work location, assignments, and safety. Clients require information on service availability, alternate locations, eligibility changes, and contact methods. Funders, agencies, vendors, and board members require different levels of detail.

The plan should identify:

• Primary and backup communication channels.
• A staff notification tree.
• Client communication languages.
• Approved spokespersons.
• Message approval authority.
• Public statement procedures.
• Contact methods when email is unavailable.
• Rules for protecting personal and client information.

The Human Services Council operates HSAlert, an emergency communications system for nonprofit decision-makers. It is designed to provide updates related to contracting, service delivery, and volunteer management during disasters. A nonprofit’s own communication tree should sit alongside external alert systems, not replace it.

Local resources and the limits of external frameworks

New York City nonprofits do not need to develop every planning element from zero. The local resource environment offers templates, planning guidance, and preparedness programs.

Human Services Council

The Human Services Council’s Emergency Plan materials address four areas:

• Preparedness.
• Emergency action.
• Continuity of operations.
• Plan sustainability.

The worksheets can support a planning team, but the team must populate them with operating facts. The document should reflect actual sites, actual systems, actual contracts, and actual staffing constraints. Generic language conceals dependencies.

HSC’s 2021 Human Services Recovery Taskforce report also provides context for the pressures facing human services organizations after disruption. The relevant management lesson is that recovery does not occur at the level of a single organization alone. Nonprofits depend on public contracting, referral networks, transportation, suppliers, volunteers, and shared facilities. The plan should identify these network dependencies.

Nonprofit New York

Nonprofit New York’s guide on disaster planning, emergency preparedness, and business continuity provides a broader planning framework. Its three-phase structure is useful because it prevents the common error of treating the first response as the entire recovery process.

The framework should be connected to board management. Directors need visibility into:

• The organization’s critical services.
• The recovery order.
• Cash exposure.
• Contract and compliance obligations.
• Executive succession during an incident.
• The status of testing and corrective actions.

Board oversight does not require directors to manage the incident. It requires a defined reporting cadence and a clear threshold for escalation.

NYC Emergency Management

NYC Emergency Management’s Partners in Preparedness program is open to public, private, and nonprofit organizations. Organizations complete five preparedness activities to become active partners and receive a program seal.

The seal is not government approval or certification of the organization’s business continuity plan. It demonstrates participation and a commitment to preparedness. The distinction matters. A seal cannot substitute for a tested recovery process, board review, or documented corrective action.

The program can still function as a useful external benchmark. Completing its five activities gives an organization a structured entry point. The management value comes from completing and testing the activities, not from displaying the seal.

NYC-specific risk: flooding, infrastructure, and service dependency

Flooding is identified by NYC Emergency Management as the most common and costly natural disaster for small businesses and organizations in New York City. A nonprofit plan that treats fire, cyberattack, severe weather, and flooding as interchangeable will miss the infrastructure effects of each event.

Flooding can affect:

• Ground-floor program areas.
• Electrical equipment.
• Elevators and accessibility routes.
• Storage rooms and paper records.
• Transportation access.
• Building entry.
• Nearby partner sites.
• Vendor delivery routes.
• Staff commuting patterns.

The organization should map the physical location of critical assets. Data backups, paper files, medication, food inventory, portable equipment, and emergency supplies should not all depend on one vulnerable room.

Facility risk and service risk are separate

A site can remain open while service delivery fails. The building may have power, but a vendor may be unable to deliver supplies. A program may have staff, but no access to a scheduling system. A partner referral network may be unavailable even when the nonprofit’s own site is operating.

The risk register should therefore include both facility exposure and dependency exposure.

This table is not a substitute for a risk assessment. It identifies the level at which the assessment should operate.

Mitigation is cheaper than restoration

The estimated $6 return for every $1 invested in hazard mitigation provides a planning benchmark. It should not be treated as a guaranteed budget outcome for every nonprofit. The practical point is resource allocation.

Mitigation may include moving records above flood exposure, testing backups, maintaining alternate payment authority, cross-training finance staff, securing a second communication channel, or arranging an alternate program site. Each measure reduces a specific recovery dependency.

The plan should assign an owner and a test date to each mitigation action. An untested backup is an assumption. An alternate site without access instructions is a name on a page. A vendor agreement without a contact and activation procedure is not a recovery control.

Emergency supplies and the Go Bag standard

NYC Emergency Management’s Ready New York guidance recommends a Go Bag with copies of important documents in a waterproof container, extra keys, cash in small bills, and a medication list. Emergency supply kits also use a baseline of one gallon of drinking water per person per day.

For nonprofits, the individual Go Bag should be supplemented by an organizational continuity kit. Its contents depend on the service model, but may include:

• Printed emergency contacts.
• Site access instructions.
• Staff and vendor contact trees.
• Copies of insurance and lease information.
• Banking and payroll escalation contacts.
• Portable chargers and power banks.
• Basic first-aid supplies.
• Flashlights and batteries.
• Paper forms for critical services.
• Secure storage for sensitive documents.
• Small-bill cash under documented controls.
• Keys, access cards, and equipment instructions.

The kit should not become a shadow archive of unrestricted sensitive data. Keep only the records required for immediate operations. Label the custodian, storage location, review date, and replacement schedule.

A plan that includes supplies but does not define custody creates a new control problem. The organization needs to know who checks expiration dates, who replaces depleted materials, and who can access the kit during an incident.

Testing the plan: from document to operating control

The first test should not be a full-scale disaster simulation. It should target one dependency with a defined success condition.

Useful exercises include:

1. Contact-tree test. Measure how long it takes to reach staff, board officers, vendors, and emergency contacts. Record failed numbers and unconfirmed responses.

2. Technology recovery test. Restore a defined set of files or access a backup environment. Confirm that authorized users can work without relying on the person who created the backup.

3. Payroll continuity test. Map the steps required to process payroll if the primary finance employee and office are unavailable.

4. Alternate-site test. Confirm access, internet, equipment, privacy, accessibility, and program suitability at the alternate location.

5. Client communication test. Deliver a service interruption message in the required languages and through the backup channel.

6. Incident decision exercise. Give the leadership team a defined disruption and require a written decision log, spending authorization, service prioritization, and board notification.

Each exercise should produce findings. Findings should be classified by severity, assigned to an owner, given a due date, and reviewed by management or the board.

Compliance metrics should be visible. A basic dashboard can track:

• Percentage of critical functions with documented recovery objectives.
• Percentage of critical systems with tested backups.
• Percentage of key roles with trained alternates.
• Days since the last contact-tree test.
• Open corrective actions past due.
• Percentage of emergency suppliers with current contacts.
• Cash available for the defined interruption period.
• Time required to issue a staff notification.

These metrics do not measure resilience in full. They measure whether the organization is maintaining the controls that support resilience.

The weakest part of a continuity plan is usually not the policy. It is the untested dependency that the policy assumes will work.

Turning the framework into an operating cycle

Planning should be connected to the annual management calendar. A disaster recovery plan is not a document produced once for a grant application.

A practical cycle can follow this sequence:

Map

Identify sites, services, staff roles, technology, suppliers, contracts, records, and funding dependencies. Separate critical functions from routine activities.

Assign

Name primary and alternate owners. Give each recovery control a person with authority, not only a department label.

Document

Use HSC materials, Nonprofit New York guidance, NYC Emergency Management resources, and the organization’s own policies. Replace generic language with local operating facts.

Test

Run focused exercises. Measure time, access, staffing, and decision quality. Avoid exercises that produce only discussion and no evidence.

Correct

Assign every gap an owner and deadline. Track unresolved issues through management and board reporting.

Refresh

Update contacts, vendor data, site information, system inventories, cash assumptions, and communication procedures. A stale plan is a failed control.

The planning team should also record what the organization will not do during a disruption. Scope limits prevent staff from making contradictory promises. For example, a nonprofit may define a minimum service model, suspend noncritical intake, redirect referrals, or delay routine reporting while preserving safety and contractual obligations.

This is where fiscal health connects to operational planning. A nonprofit cannot maintain every program at full capacity without unrestricted liquidity, available staff, and functioning infrastructure. The recovery plan should state the trigger points for reducing service, requesting support, activating reserves, or seeking contract modifications.

The operational route for NYC nonprofit leaders

The local planning resources provide a route, not a finished destination. HSC supplies planning templates and HSAlert. Nonprofit New York provides the three-phase distinction and a structured guide. NYC Emergency Management provides Partners in Preparedness and Ready New York guidance. The organization must connect these resources to its own risk register, financial controls, contracts, systems, and service obligations.

For executives, administrators, and boards, the next actions are specific:

• Build a three-phase plan that separates emergency action, basic service recovery, and full continuity.
• Assign primary and alternate decision-makers for every critical function.
• Define recovery objectives in hours or operating periods rather than using “as soon as possible.”
• Map the systems, records, vendors, sites, and staff required for priority services.
• Test payroll, communications, backups, and alternate-site procedures.
• Track cash exposure and restricted-fund limits during an interruption.
• Use HSAlert and NYC Emergency Management resources as external inputs, not substitutes for internal controls.
• Complete the five Partners in Preparedness activities while keeping the program seal separate from any claim of government certification.
• Maintain a corrective-action register with owners, deadlines, and board visibility.
• Review the plan after exercises, major staffing changes, new contracts, system changes, and facility changes.

The strongest NYC nonprofit disaster recovery plan is not the longest document. It is the one that identifies the first operational decisions, the dependencies behind them, the evidence required to confirm recovery, and the person accountable for each step.