Business Continuity Planning Guide for Small and Mid-Sized Businesses

Business continuity is about the business, not just IT

A business continuity plan explains how the organisation keeps serving customers when something goes wrong: a ransomware attack, a power cut, a flood, the loss of a key supplier or the sudden absence of key people. IT disaster recovery is an important part of it, but continuity also covers people, premises, suppliers and communication.

This business continuity planning guide is designed for small and mid-sized businesses that need a plan they can actually use, not a binder nobody opens.

Step 1: Identify your critical activities

List the activities the business cannot stop for long: taking orders, delivering services, paying staff, invoicing, answering customers. For each, ask:

• How long could we stop this before the damage becomes serious?
• What does it depend on: people, systems, data, suppliers, premises?

This is often called a business impact analysis. It does not need to be complicated; a table with one row per activity is enough.

Step 2: Set recovery targets

For each critical activity and the systems behind it, agree:

• RTO (recovery time objective): how quickly it must be running again.
• RPO (recovery point objective): how much recent data you can afford to lose.

These are business decisions. Shorter targets cost more, so set them per activity rather than one figure for everything. Our guide to RPO and RTO in plain English explains how to choose them.

Step 3: Plan for the main scenarios

You do not need a separate plan for every possible disaster. Plan for the effects instead:

• Loss of IT systems or data (ransomware, hardware failure, cloud outage).
• Loss of premises (fire, flood, no access to the building).
• Loss of people (illness, key staff unavailable).
• Loss of a key supplier (internet provider, software vendor, outsourced service).

For each, write down the workaround, who decides to use it and what they need.

Step 4: Build the IT recovery part

This is where disaster recovery planning comes in:

• Backups of every critical system, with at least one copy offline or immutable so ransomware cannot destroy it.
• A documented recovery process for each system, in the order systems need to come back.
• Standby capacity in the cloud if your recovery targets require it.
• Access to the plan itself even if your own systems are down: keep a copy outside your main email and file storage.

Step 5: Plan communication

• A contact list for staff, key customers, suppliers, your insurer and IT support, kept up to date and available offline.
• Who speaks to customers and what they say.
• How staff find out what to do if email and Teams are unavailable.

Step 6: Assign roles

Name a person, and a deputy, for each role: overall incident lead, IT recovery, communications, and finance and legal. Make sure they know they have the role.

Step 7: Test the plan

A plan that has never been tested will fail in ways nobody predicted. Start simply:

• Walk-through: read the plan together and check it still matches reality.
• Tabletop exercise: talk through a realistic scenario, such as ransomware on a Monday morning, and see where the plan breaks.
• Technical test: restore a critical system from backup and time it against the RTO.

Test at least once a year and after significant changes.

Step 8: Keep it current

Review the plan whenever people, suppliers, systems or premises change, and record the date of each review. Out-of-date contact details are the most common failure in real incidents.

Disaster recovery best practices to build in

• Separate backups from your main network and admin accounts.
• Monitor backup jobs daily and act on failures.
• Restore-test regularly, not only when something breaks.
• Document the recovery order and dependencies.

Getting help

Techx4u helps businesses build and test continuity plans that work. Our disaster recovery services provide tested standby systems and recovery runbooks, and a ransomware readiness assessment shows how your business would recover today, with a sample restore as proof.