The Hawaii Storm-Scare Checklist

Published July 29, 2026 · Last reviewed July 2026 · HI Tech Hui · ~8 min read · Tick the boxes as you go — your progress is saved in this browser.

1. Communication

The first thing that fails in a real event is rarely a server. It is knowing who was told what, by whom, and when.

• Did every employee actually receive the storm advisory or notice from us — not just see it on the news?
• Did our notification method work as intended — text, email, group chat, phone tree?
• Was there a single, agreed-upon channel for “here is what is happening” updates, or did information scatter across texts, calls, and social media?
• Did anyone not get the message at all? Why?
• Do we have a working out-of-band contact list — personal mobile numbers on paper or in a phone — that survives losing email and the office phone system?

The decision matrix

During an outage, the wrong question is “what do we do?” The right question is “who decides?” Recovery time spent waiting for someone to make a call is the most expensive and least defensible kind.

• Confirm a one-page decision matrix exists, in writing, naming who decides what during a storm event: who calls it (closing a location, sending staff home, invoking remote work), who communicates to staff, who communicates to customers, and who authorizes emergency spend and up to what dollar amount without additional signatures.
• Confirm the matrix names a backup person for every role — the primary may be off-island, unreachable, or dealing with their own flooded house.
• Confirm at least one printed copy lives somewhere reachable when systems and power are down.

2. Power & connectivity

Most Hawaii storm impact is secondary: a transformer blown out blocks away, a fiber cut, a generator that did not start, a cooling failure in an unconditioned closet during a multi-day heat advisory.

• Did we lose power or internet at any point — even briefly?
• If we have backup power (generator, UPS) or a failover internet connection (cellular hotspot, secondary ISP), did it kick in as expected? Did anyone verify, or do we assume it would have?
• How long would our critical systems have stayed up if the outage had lasted a full day? Do we actually know the answer, or are we guessing?
• When were UPS batteries last tested or replaced? A UPS with four-year-old batteries provides a comforting green light and about ninety seconds of runtime.
• Do we need a backup connection or power source we do not currently have?

3. Data & backups

This is the section where “the backup job completed” gets mistaken for “we can recover.” They are not the same claim.

• Were our backups running normally throughout the event?
• Does our design meet the 3-2-1 rule — three copies of the data, on two different media types, with one copy off-site?
• Is at least one copy immutable (write-once), so that neither ransomware nor an accidental deletion can reach it?
• Is at least one copy off-island? Cross-island (Oahu primary with a Maui or Kauai secondary) protects against a localized event. Mainland protects against a statewide hurricane, an undersea cable event, or a grid failure. Most Hawaii businesses benefit from both.
• When did we last actually test a restore — not just confirm the job succeeded? Time it, and write down what went wrong.
• Does every business service have a documented recovery tier, and does the backup configuration actually match it? The working baseline: Tier 1 revenue- or safety-critical services (email, payments, phones, POS or PMS) at RTO 4 hours and RPO 1 hour; Tier 2 operationally important services (file shares, line-of-business apps, accounting) at RTO 8 hours and RPO 4 hours; Tier 3 secondary services (archives, reporting) at RTO 24 to 72 hours and RPO 24 hours.
• If we had lost the main office entirely, how much data — in hours or days — would we have lost? Is that number inside the RPO leadership signed off on?

Tiering matters because setting Tier 1 targets for every system is unaffordable and setting Tier 3 targets for payments is negligent. Our 2026 Hawaii small business disaster recovery plan guide works through the full eight-section plan these numbers belong in, including who signs them and what test evidence to retain.

4. Remote work readiness

The classic Hawaii scenario is that the office loses power and your house does not. That only helps if people can actually do their jobs from there.

• Could our team have worked from home if the office was inaccessible for a day? Three days? A week?
• Does everyone who might need to work remotely already have a company-approved device and secure access set up — not something we would have to scramble to provision mid-event?
• Does the VPN have license and bandwidth capacity for the entire staff at once, not the usual handful?
• Does multifactor authentication work away from the office? If a hardware token or a desk phone is the second factor, that is a discovery worth making now.
• Do phones forward or route through a softphone, so customers calling the main line still reach a human?
• Did anyone work around access problems in a way that created new risk — personal email, personal devices, unapproved file-sharing apps? Those workarounds tend to outlive the storm.

5. Physical site & equipment

Water and humidity do quiet damage that shows up weeks later as an unexplained hardware failure.

• Is our network and server equipment elevated off the floor and away from likely water intrusion points — windows, roof penetrations, low-lying areas?
• Do we know the current condition and maintenance history of the roof above any critical equipment?
• Did we walk the site after the event to check for water intrusion, humidity damage, or equipment issues — even if nothing looked obviously wrong?
• Is the room housing critical gear conditioned, and does that cooling survive a power event?

Hardware pre-staging

• Confirm that replacement and backup hardware — routers, modems, firewalls, switches, UPS batteries, and at least one or two spare laptops — is pre-staged on-island. Mainland shipping during storm season can stretch from days to weeks, and every other business in the state will be ordering the same parts at the same time.
• Confirm someone can find the spares and knows the configuration to load onto them. A spare firewall with no saved config is a paperweight.

This is unglamorous and cheap. It is a closet, not a warehouse, and it is frequently the single difference between recovering in hours and recovering in weeks.

6. Customer & vendor continuity

• Did customers know how to reach us, or find out whether we were closed or delayed, during the event?
• Were our website, voicemail, and social profiles updated with accurate hours and status — or left showing “business as usual” while we were actually affected?
• Do we have an alternative way to take orders, book appointments, or serve customers when primary systems are down?
• Did we check in with critical vendors — payment processor, key suppliers, our IT provider — about their own readiness and their own single points of failure?
• Do we know which vendors are also Hawaii-based, and therefore likely to be hit by the same event at the same time?

7. IT & security provider check-in

• Did our IT provider proactively reach out before or during the event, or did we have to chase them?
• Do we have direct emergency contact information for our provider beyond the general helpdesk line — and does someone other than one person have it?
• Did anything IT-related actually break, get delayed, or need a manual workaround during the event?
• Is it clear in writing who owns what during a disaster — provider owns backup operation, restore execution, and technical runbooks; we own recovery targets, communications, insurance, and the incident lead role?
• Does our provider maintain on-island spare hardware and on-island response capacity, or does everything route through the mainland?

8. Debrief & plan update

This section is the one that turns a checklist into preparedness. Skipping it is how the same gaps survive five seasons.

• Schedule a 30-minute debrief within one week, while it is still fresh: what worked, what did not, what surprised us.
• Update the written business continuity and emergency plan with everything learned — including the small things, which are the ones that get forgotten.
• Assign one named owner and a real deadline to every gap found above. Not “we should look into that.”
• Run a 90-minute leadership tabletop exercise simulating a storm-driven power and connectivity outage at least once per season — ideally before August, when peak risk starts. Walk the decision matrix, the remote-work path, and the restore procedure out loud with the people who would actually be making the calls.
• Calendar a reminder to re-run this same checklist after the next storm scare, so lessons compound instead of resetting.

---

Why this matters

A “storm scare” is any time a tropical system gets close enough to Hawaii that your team started watching the forecast — whether or not a watch or warning was ever issued, and whether or not it made landfall. Most of them come to nothing. That is exactly what makes them valuable: every near-miss is a free, low-stakes rehearsal that shows you where your plan is thin, without charging you for the lesson.

This page is deliberately not tied to one named storm. It is meant to be re-run, season after season, so the lessons compound instead of resetting to zero each time. There will be another one.

The 2026 season gives you plenty of opportunities to practice. The NOAA and National Weather Service Honolulu 2026 Central Pacific Hurricane Season Outlook forecasts a 70% chance of an above-normal season, with five to thirteen tropical cyclones expected in the basin that includes the Hawaiian Islands. The season runs June 1 through November 30, peaks in August and September, and the above-normal outlook is driven primarily by El Niño conditions in the Pacific. An above-normal forecast does not predict a direct hit. It raises the odds that at least one system comes close enough to knock out power, fiber, or shipping somewhere in the state.

The reason to care about the difference between a rehearsed team and an unrehearsed one is arithmetic. The joint Calyptix and ITIC 2025 SMB Security Survey found that 57% of small businesses with 20 to 100 employees report downtime costs above $100,000 per hour. Hawaii businesses sit at the harder end of that range — replacement hardware ships from the mainland, on-island vendor capacity is finite and books out the moment a storm threatens, and a statewide event hits every supplier and every customer at the same time. A four-hour outage you could have avoided is not a nuisance. It is a line item.

For a deeper walkthrough of the five moves that prevent most of this — test a restore, document who decides what, confirm remote-work paths, pre-stage hardware, run a tabletop — see our hurricane season business continuity guide. This checklist is the after-action companion to it.

The pattern to watch for

If you find yourself answering “no” or “not sure” to more than one or two of these, the problem is not the storm. It is that near-misses are not being treated as rehearsals. Every system that gets close and does not hit is a free chance to find the gap before a real one does — and in an above-normal season, you will get several of those chances.

Related reading

• How should a Hawaii business prepare for IT downtime during hurricane season? — the five moves before August
• What should be in a Hawaii small business disaster recovery plan in 2026?
• Hawaii ransomware recovery: the first 72 hours
• The real cost of IT downtime for Hawaii businesses — and why it is higher here
• Your backup isn’t a strategy — it’s a test you haven’t passed yet

---

Want help closing any of the gaps this checklist surfaced? HI Tech Hui works with Hawaii businesses on backup design, failover, and continuity planning built for island-specific risk. Call (808) 206-8549, email info@hitechhui.com, or schedule a discovery call. We are at 401 Kamakee St Suite 206, Honolulu, HI 96814.

Forecast figures reflect the NOAA / NWS Honolulu 2026 Central Pacific Hurricane Season Outlook. For live watches, warnings, and advisories, always defer to the Central Pacific Hurricane Center and your county emergency management agency.