Server Down? What to Do in the First Hour: An IT Emergency Guide for BC Businesses
When your server goes down, the first hour decides how much the outage costs you. The right sequence is: confirm the scope, stop making changes, protect your data, notify your IT provider with specific details, and communicate with staff. Acting quickly matters — but acting in the wrong order is what turns a two-hour outage into a two-day one.
This guide walks through exactly what to do, in order, and what to put in place before it happens again.
The first 15 minutes: confirm before you act
The instinct is to start restarting things. Resist it. Rebooting a server mid-failure can corrupt data that was still recoverable, and it destroys the evidence your IT team needs to find the cause.
Instead, answer four questions:
- How many people are affected? One person, one department, or everyone? If it is one person, it is a support ticket. If it is everyone, it is an incident.
- What exactly is broken? Can staff reach email but not files? Is the internet down, or just one application? “Nothing works” is not enough for anyone to act on.
- When did it start, and what changed? A power blip, a Windows update, a new device on the network, a storm. Recent changes are the most common cause.
- Can you still reach your data? If files are encrypted, renamed, or asking for payment, stop immediately and treat it as a security incident, not a technical fault.
Write the answers down. This takes three minutes and saves your provider twenty.
Minutes 15 to 60: contain and communicate
Disconnect, do not delete. If you suspect malware or ransomware, unplug the affected machine from the network — pull the ethernet cable or turn off Wi-Fi — but leave it powered on. Powering down can wipe memory-based evidence and, in some ransomware variants, trigger further encryption.
Do not pay, and do not negotiate on your own. Canadian businesses report widely different outcomes here, and paying does not guarantee recovery. This is a decision for your provider, your insurer and, where personal data is involved, legal counsel.
Call, do not just email. If email is part of the outage, your ticket may never arrive. Know your provider’s emergency phone number before you need it. This is what emergency IT services and 24/7 support exist for — a real phone line answered outside business hours, not a form that queues until Monday.
Tell your staff something specific. “IT is aware, file server is offline, use local copies, next update at 11am” keeps people working. Silence produces twenty people trying their own fixes, which is how small outages get bigger.
What actually counts as an IT emergency
Not every problem needs an after-hours call. Knowing the difference saves money and stops genuine emergencies getting lost in the noise.
| Treat as an emergency | Can wait until business hours |
|---|---|
| Server, network or internet down for the whole office | One user’s printer or headset not working |
| Suspected ransomware, encrypted files, or ransom message | Software running slowly |
| Email completely unavailable company-wide | A single mailbox needing a password reset |
| Point-of-sale or booking system offline during trading hours | A report that will not export |
| Confirmed data breach or account compromise | A licence due for renewal next month |
| Physical damage — flood, fire, power surge to equipment | New employee setup scheduled for next week |
What downtime actually costs a Canadian business
Most owners underestimate this, because the visible cost — the repair bill — is the smallest part. The real cost is staff sitting idle, orders not processed, and customers who go elsewhere.
The Canadian numbers give a sense of scale. IBM’s 2025 Cost of a Data Breach report puts the average Canadian breach at CA$6.98 million. The Canadian Anti-Fraud Centre recorded CA$704 million in reported fraud losses in 2025, the highest year on record — and with an estimated 90% of incidents going unreported, the true figure is far higher. Statistics Canada found that 16% of Canadian businesses were hit by a cyber security incident in 2023, while only 26% had a written cyber security policy.
Those averages are skewed by large enterprises, and a ten-person firm in Surrey will not lose seven million dollars. But the arithmetic still bites: twelve staff unable to work for a day, at a loaded cost of $45 an hour, is roughly $4,300 in wages alone — before a single lost sale.
How fast should your IT provider respond?
This is the question to ask before you sign, not during an outage. A credible provider will commit to specific response times in writing, usually tiered by severity:
- Critical (whole business stopped): 15–30 minutes to first response, work starts immediately
- High (a department blocked): 1–2 hours
- Normal (one user, workaround exists): same business day
- Low (requests, new setups): 1–3 business days
Two details matter more than the numbers. First, response time is not resolution time — make sure you know which one is being promised. Second, ask what happens outside business hours: whether there is a real on-call engineer, or an answering service that takes a message.
Speed also depends on what your provider can do without driving to you. Most incidents are resolved faster through remote IT support, with an on-site visit only when hardware genuinely needs hands on it.
The work that happens before the emergency
Every fast recovery is the result of decisions made months earlier. Four things do most of the heavy lifting:
1. Backups you have actually tested
An untested backup is a hope, not a plan. The question is not “do we have backups” but “when did we last restore from one, and how long did it take?” Proper business cloud backup includes a documented restore test, not just a green tick on a dashboard.
2. A recovery plan with numbers in it
Two figures define your plan: how long you can afford to be down, and how much data you can afford to lose. Those two answers determine what your disaster recovery setup needs to look like — and how much it costs. Without them, you are buying blind.
3. Monitoring that catches problems first
A failing drive, a full disk or a backup that silently stopped three weeks ago all give warning signs. Proactive monitoring and patching is what turns those into a scheduled fix instead of a Monday morning outage.
4. Layered security, not one product
Most incidents start with a person, not a server — a convincing email, a reused password. Email security, endpoint protection and multi-factor authentication together stop far more than any single tool. Attackers move quickly once inside: Mandiant measured a median of 22 seconds in 2025 between initial access and handoff, down from more than eight hours in 2022.
A one-page plan worth writing today
Before you need it, write down and print: your IT provider’s emergency number; who declares an incident; where backups live and who can restore them; your cyber insurance policy number and claims line; how you will reach staff if email and Teams are down; and which systems must come back first.
One page. Printed, not stored on the server that just failed.
Frequently asked questions
Should I restart the server when it goes down?
Not before you know why it failed. A restart can corrupt data that is still recoverable and erases diagnostic evidence. Confirm the scope first, then let your IT provider decide.
What is the first thing to do in a ransomware attack?
Disconnect affected machines from the network but leave them powered on, stop all file access, and call your IT provider and insurer immediately. Do not pay or contact the attacker yourself.
How long should an IT emergency take to fix?
It depends on cause and preparation. With tested backups and a documented recovery plan, most outages are resolved within hours. Without them, a full rebuild can take days.
Do small businesses really need 24/7 IT support?
It depends on when you trade and what an hour of downtime costs. A weekday-only office may not. A retailer, clinic, restaurant or logistics firm operating evenings and weekends usually does.
Insmart Technology provides managed IT services in Surrey and across the Lower Mainland, including emergency IT services and 24/7 support. If your systems are down right now, call us — do not wait for a ticket to be read.
About the author: Naqash Bin Iqbal is an SEO Specialist at Insmart Technology, a Surrey-based managed IT and cybersecurity provider.
