Writing the IT section of your business continuity plan

Continuity is broader than cyber attacks

Many businesses think of IT continuity only in terms of ransomware, but the most likely disruptions are often mundane: a fibre cut down the road, a power outage, a failed laptop or firewall, a cloud service having a bad afternoon, or an office that becomes unusable because of a flood, fire or building issue. Staff illness or the sudden loss of a key person can also leave systems inaccessible.

A good continuity plan considers all of these. The cyber incident response plan sits alongside it, focused on the specific steps for a security incident, while the continuity plan answers the broader question of how the business keeps serving customers when something stops working. Keep the two documents consistent, and make sure the same people know where both are kept.

Identify critical systems and priorities

List the systems and services the business needs, and for each one, note what happens if it is unavailable for an hour, a day and a week. Typical critical items include email, phones, the internet connection, the accounting system, the practice or job management system, customer records, the website or online store, and payment processing.

From this, set recovery priorities and targets: how quickly each must be back, and how much recent data the business could afford to lose. These targets drive real decisions. If the booking system must be back within an hour, you may need a backup internet connection and a tested restore process; if accounting can wait a day, simpler arrangements may do.

Plan alternative ways of working

For each likely disruption, write down how people will keep working. If the office internet fails, can staff switch to a backup connection or work from home? If the office is unusable, can everyone work remotely, and do they have the devices and access to do so? If a key system is down, is there a manual workaround such as a paper form, a printed schedule or a phone process?

Cloud-based systems and laptops that people already take home make many scenarios far easier. Check that staff can actually sign in from outside the office, that phones can be redirected to mobiles, and that anyone who needs a printed list of contacts or schedules has one. Small practical details often decide whether the plan works on the day.

Who does what, and how to reach them

Name the people responsible for decisions during a disruption, with deputies in case they are unavailable. List contacts for your IT provider, internet and phone providers, key software vendors, the building manager, insurer and any other critical suppliers, along with account numbers and how to log a fault. Keep a copy of this information somewhere accessible when systems are down, such as printed and on personal phones.

Decide how you will communicate with staff and customers if email or phones are unavailable. A staff group on personal mobiles, an alternative email address or a website notice prepared in advance can make communication much easier during a stressful event. Agree in advance who is allowed to speak to customers and what the first message should say, so nobody is drafting statements under pressure.

Backups and recovery underpin everything

The plan relies on good backups and a tested way to restore them. Check that backups cover all critical systems, including cloud services such as email and file storage, that copies are kept separately from the original systems, and that someone checks the backups regularly. Record how long a full recovery takes, because that real figure needs to match your targets.

Keep spare equipment where it makes sense, such as a spare laptop, a backup internet device or a replacement network switch. Know your hardware warranty terms and how quickly replacements arrive, because a failed firewall with a slow replacement can leave an office offline for days. Where a single device would stop the whole office, consider whether a support contract with faster replacement is worth the extra cost.

Test and keep it current

A plan that has never been tested is mostly guesswork. Once or twice a year, walk through a scenario with the people involved, such as the office losing internet for a day or a key system failing, and check whether the plan holds up. Test a real restore from backup at least yearly. Note what did not work and fix it.

Update the plan whenever systems, suppliers, premises or key staff change. Keep it short and practical, because a long plan nobody has read will not be used in a crisis. A few clear pages that people know exist are worth far more than a binder on a shelf. Assign one person to own the plan and schedule its review, otherwise updates tend to slip until the day it is needed.