Storm-Ready IT: A Checklist for Madison County Businesses
By Ricky Browning · Browning PC, Valdosta, GA
If a storm knocked out power to your business for three days, what would you actually lose? For most small operations around Madison County the answer isn't the building — it's the data, the point-of-sale, and the days of downtime while somebody figures out how to get it all back. The good news is that the protection is cheap and boring: battery backup, real off-site backups you've actually tested, and knowing your obligations before something goes wrong. Here's the whole checklist, with sources.
I'm writing this one for my new neighbors. Browning PC just joined the Madison County Chamber of Commerce & Tourism, and we're taking on work across the county — we're about 30 minutes up Madison Highway in Valdosta. And I'm writing it today, August 14th, on purpose: we are heading into the worst stretch of hurricane season, not out of it.
First, the honest weather picture
The Atlantic season runs June 1 to November 30, but the danger is heavily loaded toward the back half. The National Hurricane Center puts the climatological peak on September 10, with most activity falling between mid-August and mid-October. So as you read this, the busiest part of the season is just getting started.
Now, this year's forecast — and one big caveat that matters more than the forecast itself. In its August 6, 2026 update, NOAA called for a below-normal season: 7–13 named storms, 2–6 hurricanes, 0–2 majors, with a 75% chance of below-normal activity, largely because of a strong El Niño creating hurricane-shredding wind shear. As of this writing the Atlantic has produced three named storms and zero hurricanes.
⚠️ Do not read that as "we're safe this year." NOAA's seasonal outlook predicts how many storms form across the entire Atlantic basin. It is not a landfall forecast — NOAA doesn't make one. A quiet season can still park a major hurricane on top of your county, and a busy season can leave you completely alone. Ask anybody in Madison County how much the seasonal average mattered when Idalia came through.
And here's the number that should actually shape your planning. According to FEMA's own disaster declaration records, Madison County has been included in 20 federal major disaster declarations — with four in 2024 alone: severe storms in June, Debby in August, Helene in September, and Milton in October. Idalia was the year before. This isn't a hypothetical risk here; it's a Tuesday.
One important local nuance: Madison County is inland. Your risk isn't coastal storm surge — it's high wind, falling trees, and power that stays out for days. Which is exactly what the rest of this checklist is built around.
The scary statistic you've heard — and why I won't use it
You have almost certainly seen this line: "40% of small businesses never reopen after a disaster." It's usually credited to FEMA. It shows up in news headlines, insurance pitches, and — I'll be honest — plenty of IT marketing.
I went looking for the study behind it. Here's what I found.
FEMA really does print the number — there's an infographic in its Ready Business toolkit that says exactly that. But the source line underneath reads: "Source: 2014 data from the Federal Emergency Management Agency (FEMA) and US Department of Labor." FEMA is citing FEMA. Researchers who have tried to trace it back further have followed the trail through consultancies and vendors to claimed 1970s university research and never found an original study.
Meanwhile, the actual peer-reviewed literature says something noticeably different. A 2025 review in the Annual Review of Resource Economics puts it plainly: some businesses never reopen, but "the majority, however, will reopen" — with roughly 20% ceasing operations in the years that follow. And the SBA's own 2024 research report devoted entirely to small businesses and natural disasters contains no closure-rate statistic at all.
So I'm not going to scare you with a number nobody can source. The real data is motivating enough:
- Small businesses get hit more often than big ones. SBA research covering 2017–2021 found small employers were 1.8 percentage points more likely to be struck by a natural disaster each year than large firms (42.4% vs 40.7%).
- Most damage is survivable-sized — if you're ready. In Federal Reserve survey data, 53% of disaster-affected firms reported total losses under $25,000. That's a bad month, not an extinction event — unless you also lose your records.
- Almost half do nothing afterward. 46% of disaster-affected firms had made no changes to address their risk. And 38% of firms hit in a given year had been hit by a similar disaster before.
- Confidence outruns preparation. A 2026 U.S. Chamber of Commerce Foundation and Verizon survey found 94% of small business owners believe they'd recover from a disaster — but only 31% have a disaster plan. Owners guessed preparedness would cost about 30% of their budget; the real figure is closer to 5%.
- Cash runs out fast. JPMorgan Chase Institute research found the median small business holds only 27 days of cash buffer. For restaurants it's 16.
What a UPS actually buys you (spoiler: minutes)
The single most common misunderstanding I run into. People buy a battery backup expecting to keep working through an outage. That's not what it does.
Look at a manufacturer's own runtime chart. A common 1500VA/900W unit delivers about 4 minutes at full load, roughly 15 minutes at half load, and about 25 minutes at 300 watts. Real numbers, from the spec sheet — not marketing.
So the job of a UPS is a graceful shutdown: enough time to save open work and power everything down cleanly, so a hard cut doesn't corrupt a database, scramble a QuickBooks file, or kill a hard drive mid-write. Size it by "how long do I need to shut down properly," not "how long will the power be out."
And the genuinely underrated part isn't the battery at all — it's voltage regulation. A line-interactive UPS (the right class for nearly every small business) includes a tap-changing transformer that corrects sagging or surging line voltage without touching the battery. Out here, where the power browns out before it goes out, that quiet daily protection probably saves more equipment over the years than the battery ever will.
| Priority | What | Why |
|---|---|---|
| 1. Must | Server, or the one PC that runs the business | A dirty shutdown mid-write is how databases get corrupted |
| 2. Must | Point-of-sale / register | Losing a transaction mid-swipe is its own headache |
| 3. Should | Modem, router, and switch | Cheap, low-draw, and keeps you online during brief blips |
| 4. Nice | Security camera recorder (NVR) | Cameras that stop recording during the event are no help after it |
| Never | Printers, space heaters, coffee makers | Huge draw, kills runtime, and some can damage the UPS |
Surge protection and lightning — a few things that surprise people
This matters more here than almost anywhere: Florida is the highest-lightning state in the country, at 305 lightning events per square mile in Vaisala's 2025 annual report — ahead of Oklahoma, Louisiana, and Mississippi.
- A surge strip is not lightning protection. The National Weather Service says it flatly: "Typical surge protectors will not protect equipment from a lightning strike." They handle everyday spikes. A direct or near strike is a different animal.
- Don't shop by "joules." The standardized, comparable spec under UL 1449 is the Voltage Protection Rating (VPR) — lower is better. Joule ratings aren't measured consistently between brands.
- Surge protectors wear out. They degrade with every hit they absorb, often silently. If yours has been through a few storm seasons, it may be a power strip with a comforting light on it.
- This one's counterintuitive and important: the advice to "unplug everything when a storm rolls in" is right only if you do it early. Once the thunderstorm has arrived, NWS says: "Do not unplug equipment during a thunderstorm as there is a risk you could be struck." Power down and unplug before it gets there, or leave it be.
- Whole-building protection is the real answer. Modern electrical code now requires a surge protective device at the service panel for dwelling units on new and upgraded services — the same logic applies to a shop. Panel-level plus point-of-use is the layered approach.
Two OSHA rules worth knowing, because I see both broken constantly: power strips must plug directly into a wall receptacle — never daisy-chained into each other — and they're intended for "low-powered loads, such as computers, peripherals, or audio/video components." The break-room space heater on a power strip is a genuine fire hazard, not a technicality.
Generators: the part that actually kills people
I'd rather over-warn here than be polite about it. After Idalia and Helene, generators ran all over this region — and they are, by a wide margin, the most dangerous thing on this list.
- Carbon monoxide. The Consumer Product Safety Commission's most recent estimates attribute 93 of 107 engine-driven-tool CO deaths in a single year to generators — the single deadliest product category CPSC tracks for CO. Run generators outdoors only, and per FEMA guidance keep them at least 20 feet from windows, doors, and attached garages, with exhaust pointed away.
- Backfeed. OSHA is unambiguous: "Never attach a generator directly to the electrical system of a structure … unless a qualified electrician has properly installed the generator with a transfer switch." Backfeeding through an outlet can electrocute the lineman working to restore your power. Get a transfer switch installed properly, or run extension cords to specific equipment.
Backups: the 3-2-1 rule, and the trap almost everyone falls into
CISA's guidance for small business is the 3-2-1 rule, in their words: "3 copies of important files, 2 different types of storage media, 1 copy off-site." Simple, and it survives almost everything.
Now the trap. File sync is not backup. OneDrive, Dropbox, and Google Drive copy whatever is in the folder — including damage. CISA's #StopRansomware Guide (written jointly with the FBI and NSA) spells it out: if local files get encrypted by an attacker, the cloud service may cheerfully sync the encrypted versions right over your good ones. Their recommendation is to maintain offline, encrypted backups and test them regularly. Worth knowing given Verizon's 2025 breach report found ransomware present in 44% of breaches — and small organizations get hit disproportionately.
And the part everybody skips: test a restore. Not "check that the backup ran" — actually pull a file back and open it. CISA's own benchmark is to confirm you can restore "both fully and partially" and roll back "at least seven days." If you want a cautionary tale, GitLab — a serious technology company — published a postmortem after losing production data in 2017 in which five separate backup and replication methods all turned out to be broken or not working as intended. They recovered from an unrelated snapshot somebody happened to have taken hours earlier. Luck, not process.
(If you're weighing your internet options for getting backups off-site out here, I covered every local provider and price in my South Georgia internet guide — much of it applies just across the line.)
The Florida wrinkle: your 30-day clock
Here's something that genuinely surprises business owners near the state line, and it's the biggest practical difference between running a shop in Madison and one in Valdosta.
| Florida | Georgia | |
|---|---|---|
| Deadline | Hard 30 days after you determine a breach occurred | No fixed deadline — "most expedient time possible and without unreasonable delay" |
| Who it covers | Essentially any business — sole proprietors on up | A much narrower set: "information brokers" and "data collectors" |
| Tell the state? | Yes — the Department of Legal Affairs, if 500+ Floridians affected | No general requirement |
| Covered data | Broad — includes medical, health insurance, biometric, geolocation, and even a username + password with no name attached | Narrower — no medical, biometric, or geolocation elements |
Two things to take from that. First, Florida's law is meaningfully stricter, and it applies to ordinary small businesses in a way Georgia's older, narrower statute generally doesn't. Second — and this is the part people miss — which state's law applies depends on where your affected customers live, not where your business sits. Both statutes are written that way. If you serve customers on both sides of the line, you're working inside Florida's rules for the Florida ones.
Thirty days sounds like plenty until you're living it. Figuring out what was taken and whose data it was is the slow part — and you can't do it at all without decent logging and records. That's not a compliance product you buy; it's just having your systems set up properly beforehand.
The 30-minute version
- ☐ Battery backup on the server/main PC, the register, and the network gear
- ☐ Check surge protectors older than a few seasons — they wear out silently
- ☐ Confirm your backup includes an off-site copy that isn't just file sync
- ☐ Test an actual restore — pull a file back and open it
- ☐ Photograph your equipment and serial numbers now (insurance claims go faster)
- ☐ Write down who calls whom, and keep a paper copy — your contact list lives on the phone that's about to die
- ☐ Know how you'd take payment with no power and no internet
- ☐ If you have a generator: transfer switch installed, 20 feet out, exhaust pointed away
- ☐ Power down and unplug before a storm arrives — never during
Most of that costs very little. The Chamber/Verizon survey found owners expect preparedness to eat about 30% of their budget when the real number is nearer 5% — the gap between what people fear it costs and what it actually costs is doing a lot of damage.
⚡ Want this handled before the next one comes through?
I do storm-readiness setups for businesses across Madison County — battery backup sized properly, off-site backups that get tested, and a simple written plan for what happens when the lights go out. We're a member of the Madison County Chamber of Commerce & Tourism and about 30 minutes up Madison Highway, so an on-site visit is easy. See our Madison, FL services page, or just call.
📞 229-561-1674 ·
📅 Book an appointment
Frequently Asked Questions
Does a forecast for a quiet hurricane season mean my business is safer this year?
No — and this is the most misread number in weather. NOAA's seasonal outlook predicts how many storms form across the whole Atlantic basin. It is not a landfall forecast, and NOAA does not make one. A quiet season can still put a major hurricane over your county, and a busy season can leave you untouched. Plan for the storm that reaches you, not for the seasonal average.
How long will a UPS keep my business computers running?
Minutes, not hours — and that is by design. A common 1500VA unit runs about 4 minutes at full load, or roughly 15 minutes at half load, per the manufacturer's own runtime chart. The job of a UPS is to give you a graceful shutdown so a sudden cut doesn't corrupt your files or kill a drive. Its most underrated feature isn't the battery at all — it's voltage regulation, which smooths the sags and spikes that quietly wear out equipment.
Is OneDrive or Dropbox a backup for my business?
Not on its own. File sync copies whatever is in the folder — including damage. As CISA's #StopRansomware Guide warns, if local files are encrypted by an attacker, the cloud service may simply sync the encrypted versions too. Real backup means separate copies you can restore from a point in time, ideally with one offline. CISA's rule of thumb is 3-2-1: three copies, two types of media, one off-site.
How fast do I have to tell customers about a data breach in Florida?
Florida law sets a hard 30-day deadline. The Florida Information Protection Act requires notice to affected individuals no later than 30 days after you determine a breach occurred, and if 500 or more Floridians are affected you must also notify the state Department of Legal Affairs. Which state's law applies depends on where your affected customers live, not where your business sits. This is general information, not legal advice — talk to your attorney.
What is the single most important thing to do before a storm?
Test a restore. Not check that backups are running — actually pull a real file back and open it. Most businesses discover their backup was broken only when they finally need it, and by then it's too late. CISA recommends confirming you can restore both fully and partially, and roll back at least seven days. Everything else on the checklist matters, but a tested backup is the one that saves the business.