Disruption can affect any organisation.
A cyberattack, power failure, technology outage, supplier problem, severe weather event or loss of access to a building can interrupt operations with little warning.
Business continuity planning helps an organisation prepare for these events, maintain its most important services and recover in a controlled order.
It is not simply an IT recovery document. A practical plan should cover people, processes, technology, premises, suppliers, communications and leadership decisions.
What is business continuity?
Business continuity is the organisation's ability to continue delivering its critical products and services during a disruption.
It is closely related to disaster recovery, but the two are not the same.
- Business continuity covers how the wider organisation will keep operating.
- Disaster recovery focuses more specifically on restoring technology, applications and data.
- Incident response covers how the organisation detects, manages and contains an event such as a cyberattack.
These plans should work together. Restoring a server is of limited value if employees cannot access the building, a key supplier is unavailable or nobody knows what to tell customers.
Identify your critical business activities
The first step is to identify which activities the organisation must continue or restore first.
This is normally completed through a business impact analysis. The process considers what would happen if a service became unavailable and how the effect would increase over time.
For each important activity, assess:
- The employees and skills required
- The applications and data it depends on
- The premises, equipment and connectivity it needs
- The suppliers and external services involved
- The customers, contracts and regulatory duties affected
- The financial and reputational impact of disruption
- The longest period the activity can remain unavailable
This creates a clear recovery order. Customer-facing services, communications, payment systems and essential operational platforms may need to be restored before less urgent internal systems.
Set clear recovery objectives
A business continuity plan should define how quickly services need to return and how much data the organisation can afford to lose.
Two common measures are:
- Recovery time objective: The target time for restoring a system or service after disruption.
- Recovery point objective: The maximum acceptable amount of data loss, measured in time.
For example, a four-hour recovery time does not mean much unless the organisation has confirmed that its people, suppliers, technology and recovery processes can realistically meet it.
Targets should be based on business impact rather than chosen only by the IT team.
Protect and regularly test your backups
Backups remain central to business continuity, particularly when an organisation faces ransomware, accidental deletion, hardware failure or data corruption.
A backup strategy should include:
- Regular backups of important data, applications and configurations
- Copies held separately from the live environment
- Protection against unauthorised alteration or deletion
- Encryption in transit and at rest where appropriate
- Defined retention periods
- Monitoring to confirm that backup jobs complete successfully
- Regular restoration tests
An organisation should not assume that a successful backup report means its data can be recovered.
Restoration testing should confirm that the information is complete, usable and capable of being restored within the required recovery time.
Prepare for cyber incidents
A serious cyber incident can affect systems, data, communications and confidence in the organisation at the same time.
The business continuity plan should therefore work alongside the cyber incident response plan.
Preparation should include:
- Clear responsibility for declaring an incident
- Contact details for internal teams and external specialists
- Alternative communications that do not depend on affected systems
- Procedures for isolating compromised devices and accounts
- Access to protected backups and recovery environments
- Processes for preserving evidence
- Agreed decision-making and escalation routes
- Plans for customer, supplier, insurer and regulatory communications
During a ransomware incident, restoring systems too early can reintroduce the attacker or spread the problem into the recovery environment. The organisation needs to understand how the incident occurred and confirm that recovery systems are safe before reconnecting them.
Build resilience into your IT infrastructure
Business-critical technology should not depend on a single device, connection, location or service where the resulting risk is unacceptable.
Depending on the organisation, resilience measures may include:
- Redundant servers or cloud services
- High-availability applications
- Secondary internet connections
- Alternative network routes
- Resilient data centre facilities
- Cloud or secondary-site recovery environments
- Automatic or controlled failover
- Spare devices for essential employees
Virtualisation and cloud services can make systems easier to replicate and restore, but they do not remove the need for planning.
The business still needs to understand application dependencies, identity requirements, data locations, licensing, connectivity and the order in which systems should be recovered.
Protect against power and connectivity failures
Power interruptions can damage equipment, interrupt transactions and prevent employees from accessing critical systems.
An uninterruptible power supply can provide short-term power during an outage, allowing equipment to remain operational briefly or shut down safely.
Longer interruptions may require:
- Backup generators
- Alternative working locations
- Cloud-hosted services
- Secondary internet connections
- Mobile connectivity
- Manual operating procedures
UPS equipment should be maintained and tested. Batteries deteriorate over time, so simply having a unit installed does not guarantee that it will work when required.
Plan for the loss of a workplace
A fire, flood, utility failure, transport disruption or safety issue may make a workplace inaccessible even when the organisation's technology remains operational.
The continuity plan should explain how essential employees will work if the main site cannot be used.
Options may include:
- Remote working
- Use of another company location
- Temporary office or co-working space
- Agreements with partner organisations
- Prioritised access to a limited recovery site
- Manual or reduced-service operations
Remote working should be tested before an incident. Employees need suitable devices, secure access, multi-factor authentication, adequate connectivity and clear instructions.
Businesses should also consider roles that cannot be completed remotely and decide what facilities or equipment those employees would require.
Understand your supplier dependencies
Many organisations depend on cloud platforms, telecommunications providers, software companies, logistics partners, payment services and outsourced support teams.
A disruption affecting one of these suppliers can interrupt the business even when its own systems are working normally.
For critical suppliers, establish:
- Which services they support
- What would happen if the service became unavailable
- What continuity and recovery arrangements they maintain
- How incidents will be reported and escalated
- What contractual recovery commitments apply
- Whether an alternative supplier or manual process is available
- How data can be retrieved if the relationship ends
Contracts and service-level agreements can support continuity planning, but they do not replace it. A supplier may meet its contractual obligations while the disruption still exceeds what your organisation can tolerate.
Prepare alternative communications
During an incident, employees, customers and suppliers need accurate information.
The organisation should decide in advance:
- Who is authorised to communicate externally
- How employees will receive instructions
- How customers will be updated
- Which channels will be used if email or telephone systems fail
- How messages will be approved
- Which regulators, insurers or authorities may need to be contacted
Contact lists and draft message templates should be stored somewhere accessible during a systems outage.
Communications should be factual and regularly updated. Speculation or conflicting messages can make an already difficult incident harder to manage.
Document roles and decision-making authority
A continuity plan should state who is responsible for leading the response and who can make important decisions.
This may include authority to:
- Declare a major incident
- Shut down or isolate systems
- Move operations to another location
- Approve emergency spending
- Contact customers and regulators
- Engage recovery, legal or cybersecurity specialists
- Prioritise the restoration of services
Deputies should be named in case the primary decision-maker is unavailable.
The plan should also include current contact details. A plan stored only on an unavailable network will not help during an outage, so protected offline or separately hosted copies should be available.
Create practical workarounds
Not every service needs to be restored immediately if the organisation has a safe temporary alternative.
Workarounds might include:
- Recording orders manually
- Redirecting telephone calls
- Using approved alternative communication channels
- Prioritising urgent customers
- Temporarily reducing service levels
- Using replacement devices
- Processing transactions when systems become available again
Manual processes should be documented and tested. The business must also consider how information recorded during the disruption will later be checked and entered into its main systems.
Test your business continuity plan
A plan cannot be relied upon until it has been tested.
Different forms of testing include:
- Document reviews: Checking contact details, responsibilities and procedures.
- Tabletop exercises: Talking through a realistic incident with the people who would manage it.
- Technical recovery tests: Restoring data, applications or infrastructure.
- Communications exercises: Testing emergency notification and escalation routes.
- Workplace recovery tests: Confirming that employees can operate from another location.
- Supplier exercises: Testing how third parties respond and communicate during disruption.
Exercises should include senior decision-makers as well as technical staff. Many of the most difficult questions during a disruption involve priorities, customers, finances, legal duties and reputation rather than technology alone.
After each exercise or real incident, record what worked, what failed and what needs to change.
Keep the plan current
A business continuity plan can quickly become outdated as employees, systems, suppliers and business priorities change.
Review it:
- At agreed intervals
- After major technology or organisational changes
- When a critical supplier changes
- After an exercise
- Following a real incident
- When new threats or regulatory requirements emerge
Business continuity should be treated as an ongoing management process rather than a document completed once and stored away.
Business continuity checklist
Use the following questions to review your current position:
- Have we identified our most critical services?
- Do we know how quickly each service needs to recover?
- Have we mapped the people, systems, locations and suppliers each service requires?
- Are our backups protected and regularly tested?
- Can we communicate if our normal systems are unavailable?
- Can essential employees work from another location?
- Do we have alternatives for critical suppliers and connections?
- Are incident response and disaster recovery integrated with the wider continuity plan?
- Do decision-makers understand their responsibilities?
- When was the complete plan last exercised?
Strengthen your resilience with CloudCoCo
CloudCoCo helps organisations protect critical services and prepare for disruption through business continuity planning, cloud and data centre services, backup and disaster recovery, cybersecurity, connectivity and managed IT support.
We can assess your current environment, identify important dependencies and help build recovery arrangements around the needs of your organisation.
Contact the CloudCoCo team or call 0330 236 9070 to discuss your business continuity and recovery requirements.
Leave a comment!