Business continuity plan basics: keep working when systems go down

What is a business continuity plan?

A business continuity plan (BCP) is a document that outlines how your company will continue to operate during an unplanned disruption in service. While a disaster recovery plan focuses on IT systems and technical restoration, a business continuity plan focuses on the business itself. It answers the question: 'If our office is closed or our computers are down, how do we keep serving our customers and paying our employees?'

For a small business, a business continuity plan is an essential insurance policy for your reputation. If you can continue to provide services while your competitors are shut down by a local power outage, a natural disaster, or a cyberattack, you build immense trust with your clients. It ensures that the vital organs of your company keep beating even when the environment becomes hostile.

The four pillars of business continuity

When building your business continuity plan, you need to consider four main areas: people, locations, systems, and vendors. Addressing each of these ensures that your response is comprehensive.

• People: Who does what if key staff are unavailable? Who is the backup for the owner or the head of operations?
• Locations: Where will people work if the physical office is inaccessible? Is there a remote work protocol in place?
• Systems: Which IT tools are absolutely required for each department to function, and what happens if they fail?
• Vendors: Which third-party partners do you rely on, and what happens if their systems go down?

Identifying critical business functions

Not every task in your business is equally important during a crisis. The first step in a business continuity plan is a 'Business Impact Analysis.' You need to determine which processes are critical to your survival and which can be delayed. For example, a dental clinic must be able to access patient records and schedules to treat people safely, while their social media marketing or monthly newsletter can wait a few weeks.

1. List every department in your company and their primary responsibilities.
2. Identify the 'must-do' tasks for each department that generate revenue or protect safety.
3. Determine the maximum tolerable downtime for each task before the damage becomes irreversible.
4. Assign a 'process owner' who is responsible for that task during a crisis.

Manual workarounds and 'Paper Mode'

One of the most practical parts of a business continuity plan is defining manual workarounds. If your digital order system goes down, do you have a way to take orders over the phone and record them on paper? If your automated payroll system is locked by ransomware, do you have a way to issue emergency manual checks or bank transfers? Having these 'paper mode' processes documented can save your business from a total standstill.

The communication plan: avoiding the silence

In a crisis, silence is your enemy. Your business continuity plan must include a clear communication strategy for three groups: employees, customers, and vendors. You need to know how you will reach them if your company email is down. Will you use a group text? A secondary messaging app like Signal or WhatsApp? A call tree? Defining this now prevents panic and ensures everyone knows where to get reliable information.

Testing and training your team for resilience

A business continuity plan that sits in a drawer and is never discussed will not work when you need it. You should conduct 'tabletop exercises' once or twice a year. This involves gathering your key staff and walking through a hypothetical scenario, like a sudden flood or a cyberattack, and asking everyone to describe their role and how they would use the plan. This builds muscle memory and helps you find gaps in the plan before a real disaster strikes.

• Conduct a Business Impact Analysis to find critical tasks.
• Draft manual workaround procedures for critical tasks.
• Create an emergency communication list with personal phone numbers.
• Perform a tabletop exercise with leadership once a year.