Every business owner in the Pacific Northwest has had the Cascadia conversation — the subduction zone, the “big one,” the estimates about how long things stay broken. This article won’t rehearse the drama, because IT preparedness for Cascadia turns out to be surprisingly undramatic: it’s the same handful of disciplines that protect you from ordinary disasters, held to one extra standard — nothing that matters can live only in this region.

Why Cascadia is a different kind of planning problem

Most disaster planning assumes the disaster is local and the world around it still works: the office floods, but the data center across town is fine; the building burns, but your people work from home Monday. A major Cascadia event breaks that assumption. The affected zone is the whole region — your office, your homes, your local providers, the roads between them, and potentially power and communications for an extended period across western Oregon and Washington.

For IT, that reframes one question above all: where, physically, does your survival data live? Not “is it backed up” — backed up to the server in the same closet or a data center in Hillsboro answers the ordinary disasters and fails this one. The standard is out-of-region: backups and critical systems replicated somewhere the same event can’t reach. The quiet good news is that mainstream cloud platforms and modern backup services already offer exactly this — geographic separation used to be an enterprise luxury, and now it’s mostly a checkbox that someone has to actually check.

The honest version of “how fast could we come back”

Recovery objectives get set against normal disasters — a server dies, you restore in hours. Cascadia planning asks a humbler question: if the region is running on generators and patience, what does our business actually need to function at all? For most, the honest list is short. Payroll has to run. Clients and employees have to be reachable. Insurance documentation has to exist somewhere retrievable. The accounting system and the handful of files that constitute “the business” have to survive. That short list — not your full environment — is what deserves the out-of-region standard, and naming it explicitly is most of the work. For a typical professional firm, the whole survival list fits on an index card: payroll, the client database, the accounting file, the insurance policies, and the credentials to reach them all from a borrowed laptop. It’s the same triage a business continuity plan forces anyway; Cascadia just grades it harder.

Set expectations accordingly: this isn’t a scenario where IT restores everything Tuesday. It’s a scenario where, weeks later, the business still exists — its records intact, its obligations meetable, its recovery fundable — because the essentials were living somewhere else all along.

Three details that decide whether the plan works

The plan can’t live inside the systems it’s for. A recovery runbook stored only on the server, reachable only with the password manager, on the laptop, in the building — that’s a plan that dies with the disaster. Print it. Copies at leaders’ homes, one out of region with a trusted contact. Include the practical essentials: account numbers, insurance policy details, key vendor contacts, and how to reach your critical platforms from a borrowed computer.

Assume the first communications are primitive. Cell networks degrade under regional load; the communication plan needs a low-tech layer — a phone tree that includes out-of-state numbers (long-distance often works when local won’t), a pre-agreed check-in method, and an out-of-region contact who can relay. Decide now who tells clients what, and from which channel, if the usual ones are dark.

Identity is the master key — protect the keyring. If everything critical lives in the cloud, then your ability to log in becomes the single point of failure: the admin whose phone holds every MFA code, the password manager nobody else can open. An identity recovery plan — break-glass credentials, stored offline, in more than one place — is the difference between “our data survived” and “our data survived and we can reach it.”

The reassuring part

Here’s what makes the Cascadia question tractable: every dollar of this preparation pays for itself against the disasters that actually happen every year. Out-of-region backups also defeat ransomware and building fires. The printed runbook also works during the ice storm. The communication tree also works when a water line floods the office. Honest recovery objectives make every ordinary incident cheaper. You’re not buying insurance against one low-probability event — you’re raising the floor under all of them, and the big one simply stops being a special case.

A short self-audit

  • Does a current copy of our critical data exist physically outside the Pacific Northwest — and have we tested restoring from it?
  • Could we run payroll and reach our clients if the office, and every home in the metro, had no power for two weeks?
  • Does our recovery plan exist on paper, in more than one place, including the passwords-and-policies layer?
  • If our primary administrator were unreachable, could anyone else get into our systems?
  • Have we written down what “minimum viable business” means for us — the short list worth protecting to a higher standard?

The bottom line

Cascadia preparedness for IT isn’t bunker-building; it’s ordinary discipline with one added rule — the things that constitute your business must exist somewhere this region isn’t. Out-of-region backups, a short honest list of survival systems, a plan that works on paper and a keyring that doesn’t live in one pocket. Do that, and you’ve prepared for the big one by becoming hard to kill in all the small ones — which is the version of the question we’ve watched pay off, year after ordinary year.