← All Blogs

Your office floods on a Tuesday. The first six hours.

By Best IT MSP Editorial Team - Updated October 21, 2026 - 10 min read

The Best IT MSP editorial team maintains this directory's provider data across the US and Canada. We rank providers on verified rating and firmographic data, label paid placement, and do not sell IT services.

What to do when your office floods, in the first six hours

To handle an office flood, work through six decisions in order. Cut power and account for people, photograph the damage, notify a fixed list, identify what actually stopped, move the work, then start the restore.

It is 9:40 on a Tuesday. A supply line above the ceiling failed overnight. Two inches of water now sit across the back half of your office, including the server room. Floods are the most common disaster in the United States, and the National Weather Service calls flooding a coast-to-coast threat nearly every day of the year. Your flood does not need a hurricane behind it. A pipe will do.

The six hours below are not a technology problem. Each hour holds one decision a named person makes, and one dependency the business never arranged. By hour four most readers find the same thing. Their continuity plan assumes a building they can no longer enter.

This walkthrough covers the physical event and the human sequence. For the backup questions beside it, read when was your backup last restored.

Hour 0 to 1: cut the power and count the people

In the first hour, treat the flood as an electrical hazard and a headcount problem, not an IT incident. Water plus a live circuit kills people. Data does not.

Six inches of moving water knocks an adult down. Ready.gov is blunt about the rest, telling people to not touch electrical equipment if it is wet or if you are standing in water. OSHA says to turn off the power at the main breaker or fuse on the service panel once water reaches circuits, and that work on damaged power lines must only be performed by properly trained electrical utility workers. So hour one has one job. Get everyone out, then kill the power.

The person who decides whether anyone goes back in is not you. Ready.gov's rule is to return only when authorities say it is safe. Once a fire crew or the building owner arrives, re-entry is their call. A plan whose first step reads "IT retrieves the server" assumes an authority the business does not hold.

The UPS is still live after you cut the mains

A UPS keeps the rack energized after the building power is off, because that is what it is for. An uninterruptible power supply holds a battery charge, so a flooded server room stays dangerous after the main breaker opens. Evacuate, cut the mains, then have a qualified person shut the UPS down. Reversing those last two steps is how somebody gets hurt.

Three facts belong on one printed page kept outside the building. The water shutoff location, the electrical panel location, and the mobile number of the electrician allowed to touch it.

Hour 1 to 2: photograph everything before anyone cleans up

In the second hour, document the physical damage before a single wet item moves. The insurance claim turns on evidence that stops existing the moment cleanup starts.

The source of the water decides which policy pays, and almost nobody knows that in advance. The federal flood policy defines a flood as a general and temporary condition of inundation of two or more acres of normally dry land, or of two or more properties including your own. A pipe that burst inside your own ceiling meets neither test. That is water damage under your property policy, not a flood. A creek that took the whole business park is the flood. Same two inches on the floor, two different claims.

If it is a flood, the limits are fixed and modest. The regular program caps non-residential building coverage at $500,000 and contents coverage at $500,000. Standard property policies do not cover flooding at all, and FEMA states that a flood policy typically takes 30 days to go into effect. Nobody buys flood cover on the Tuesday.

The policy also sets its own homework. It requires prompt written notice, separating the damaged and undamaged property, and an inventory of damaged property showing quantity, description, actual cash value, and amount of loss. Then it sets a hard deadline, a signed and sworn proof of loss within 60 days after the loss.

Two clocks now run against each other. You get 60 days to prove the loss and far less to prevent the next problem, because the EPA advises that water-damaged areas and items be dried within 24 to 48 hours to prevent mold growth. Document fast, then dry fast. Photograph every wall, rack and box, wide and close, with serial numbers readable, before the restoration crew arrives.

Hour 2 to 3: notify people in a fixed order

In the third hour, work a communications tree rather than answering whoever calls first. A fixed order sends the same facts to every audience.

Ready.gov names five audiences for a crisis communications plan, namely employees, customers, suppliers, management, and government officials and regulators. It adds that contact information for each audience should be compiled in advance and be accessible during an incident, and that lists should be updated regularly and secured.

This is where most plans break, and the reason is physical. Ready.gov suggests holding pre-scripted message templates with blanks to be filled in when information is available on a remotely accessible server. A server in the room that flooded is not remotely accessible, and neither is the binder on the shelf above it. The communications tree and the vendor contact list have to live where the water cannot reach them.

Six entries belong on that vendor contact list, each naming a person rather than a switchboard.

• Landlord or facilities manager, who controls re-entry.
• Insurance broker, who says which policy applies here.
• Electrician, the named one allowed to clear the panel.
• Water restoration firm, booked before the storm, not after.
• IT provider escalation line, the one that reaches a human.
• Phone carrier, to divert the main number within the hour.

Name one person to speak for the business before the day it happens. Ready.gov advises deciding in advance who will speak to the media and preparing that spokesperson with talking points. Three people giving a customer three versions costs more than the servers did.

Hour 3 to 4: find out what actually stopped

In the fourth hour, work out which business processes stopped rather than which machines got wet. A business impact analysis answers that in advance. Without one, hour four is an argument.

Ready.gov describes a business impact analysis as a prediction of the consequences of a disruption to your business, covering the operational and financial impacts resulting from the disruption of business. One of its points lands hard on a Tuesday morning. The point in time when a business function or process is disrupted can have a significant bearing on the loss sustained. Tuesday at 9:40 is payroll week, open orders and a full phone queue. The same flood at 2am on a Sunday is a cleanup job.

Borrow its ranking rule. Ready.gov states that business processes with the greatest operational and financial impacts should be restored first. Decide now which three processes you restore first, and prioritize by revenue at risk rather than by how loudly the outage is felt.

Cloud-first does not mean building-independent

Moving to the cloud takes the servers out of the risk, not the building. Five things in a flooded office stop cloud work anyway. The internet circuit and its hand-off panel. The core switch and the patch panel. The door access controller, which is why nobody reaches the dry half. The desk phones or the on-premises phone gateway. And the one on-premises box nobody lists, usually a line-of-business database, a scan server, or the label printer the warehouse cannot ship without.

That gap is why CISA's performance goals ask organizations to maintain accurate documentation describing current network topology and review it annually. Ready.gov puts the same idea in plan terms, noting that the recovery time for an IT resource should match the recovery time objective. No target is met for equipment you forgot you owned.

Hour 4 to 5: decide where people work tomorrow

In the fifth hour, choose the recovery strategy for tomorrow morning. Three options are realistic, an alternate site, a remote work fallback, or running degraded on paper. Pick one and tell everybody which.

An alternate site sounds like the strong answer and often is not. NIST defines a cold site as a backup facility that has the necessary electrical and physical components of a computer facility, only ready to receive the necessary replacement computer equipment. A cold site is a room with power. You still buy, ship and build the equipment, and that is weeks rather than hours.

The remote work fallback is usually the honest answer for a smaller firm, and it carries two physical dependencies people forget. The laptops are in the flooded office. The remote access hardware often sits in the same rack as the wet servers, so the fallback drowned alongside the thing it was meant to replace.

Plan to run degraded for a day, because that is what happens. CISA's recovery goal expects plans to cover degraded operations without critical assets or internet access, such as paper-based operations or radio communications. A printed order pad and a diverted phone number keep a business trading while the data center question gets settled.

Three options, one rule. Relocate to a temporary site if the outage runs past a week. Work remote if systems are reachable and people have devices. Run on paper for anything that cannot wait for either.

Hour 5 to 6: start the restore and start the money

In the sixth hour, trigger the restore and open the funding conversation together, because both run on calendars you do not control.

Cloud restores are not instant, even at small scale. Microsoft puts a single SharePoint site or OneDrive account restore at 10 to 120 minutes on average using an express restore point, and that is one site. Microsoft 365 Backup also offers restore points every 10 minutes for the past 14 days, then only weekly from 15 to 365 days back. Reach further back than two weeks and your recovery point objective quietly becomes a week of lost work.

Confirm the second copy sits somewhere else before you need it. CISA's goals direct organizations to securely store backups offsite and offline and to test backups and recovery on a recurring basis, no less than once per year. A tested backup appliance in the same server room is now in the same water.

The money gap surprises owners, and it is written into the policy itself. The federal flood policy pays only direct physical loss. It states that it does not pay for loss of revenue or profits, loss of use of the insured property, or loss from interruption of business or production. Business interruption is separate cover on a separate policy. If you have never asked your broker about it by name, assume you do not have it.

Federal lending fills part of that gap once a disaster is declared, and starting early helps you recover faster. SBA disaster loans reach a maximum combined amount of $2 million across physical damage and economic injury, with a fixed rate capped at 4 percent for businesses that cannot obtain credit elsewhere and payments deferred for 12 months with no interest accruing.

The federal flood policy pays for your wet servers and pays nothing for the week you cannot trade. Two different problems, two different purchases.

Six dependencies your plan assumes and probably does not have

Six assumptions fail in almost every small-business continuity plan, and all six are physical rather than technical.

• Access to the building, which is the fire crew's or the landlord's decision and never yours.
• A reachable contact list, because the communications tree sits on the wet server.
• Working devices, because the laptops behind the remote work fallback are in the flooded office.
• Remote access hardware, because the VPN appliance shares the rack with the servers it covers.
• An offline second copy, because the backup appliance in the same server room took the same water.
• Named authority, because nobody is designated to declare the incident, spend money and speak for the business.

Five of those six cost nothing to fix on a quiet afternoon. Print one page holding the shutoff locations, the vendor contact list and the named decision maker, then keep a copy in two homes. Move the message templates to a cloud document. Confirm the offsite backup is genuinely off the site.

Four questions to send your IT provider this week

Four questions separate a continuity plan that was written from one that was drilled. Send them by email so the answers arrive in writing.

• Show us the last plan testing record, with the date, who took part, and what failed.
• Name every device in our server room that stops cloud work if the room becomes unusable.
• Prove the second backup copy is offsite and offline, and give us the date it was last restored.
• State how staff reach systems if the rack is destroyed, and whether anything in that path sits in the same room.

A tabletop exercise is the cheapest way to get real answers. Everyone sits in one room, somebody reads the flood scenario aloud, and each person says what they would do next. Nothing gets touched. CISA expects incident response plans to be reviewed and drilled, at a minimum, on an annual basis. Drill yours once a year with the flood as the scenario.

Plan testing is the step buyers never ask about. A provider who names the date of the last exercise is managing continuity for you. A provider who emails a documented plan and stops there is selling one.

What six hours of good decisions does not buy you

A good first six hours shortens the outage. It does not prevent the flood, and no plan makes a business immune to physical damage or to a building it cannot enter.

What it buys is narrower and real. People stay safe. The insurance claim keeps its evidence. Customers hear one version. Work carries on somewhere by Wednesday, and the business recovers in days instead of weeks. The gap between a two-day disruption and a three-week one is almost never the backup product. It is whether those six decisions had owners before the water arrived.

If your provider cannot answer the four questions above, get the same answers from two other firms and compare them. For the planning vocabulary behind all of this, read business continuity vs disaster recovery.

FAQ

What should I do first if my office floods?

Cut the power and account for people first. Six inches of moving water knocks an adult down, and Ready.gov warns against touching electrical equipment while standing in water. Evacuate, open the main breaker, then have a qualified person shut down the UPS. Data comes after that.

Does business insurance cover an office flood?

Usually not on its own. Standard property policies do not cover flooding, and federal flood insurance is separate cover that typically takes 30 days to take effect. Non-residential limits stop at $500,000 for the building and $500,000 for contents. Business interruption is a further separate policy.

Is a burst pipe in my office a flood?

No, not under federal flood insurance rules. The policy defines a flood as inundation of two or more acres of normally dry land, or of two or more properties including your own. Water from your own failed pipe meets neither test, so it becomes a water damage claim on your property policy.

How long do I have to file an office flood insurance claim?

Give prompt written notice, then send a signed and sworn proof of loss within 60 days after the loss. The practical deadline is far shorter. The EPA advises drying water-damaged areas and items within 24 to 48 hours to prevent mold, so photograph and inventory everything before cleanup begins.

How do I test a flood continuity plan?

Run a tabletop exercise once a year. Read the scenario aloud, then have each person state their next action. CISA expects incident response plans to be reviewed and drilled, at a minimum, on an annual basis. Score it on whether the contact list, the devices and the offsite backup were reachable.

← All Blogs