Business continuity

Also called BCP, Disaster recovery, Contingency planning

What you do when something stops the business. Written down before it happens, or improvised badly during it.

What it means

Business continuity planning identifies what could interrupt the business, how long you could tolerate each interruption, and what you would do.

Disaster recovery is the technology subset: getting systems and data back.

Why it matters

The events are ordinary rather than dramatic: a fire, a flood, a ransomware attack, a key supplier failing, the one person who understands the payroll being in hospital.

Larger customers increasingly ask for a plan as a condition of contract, so it has become a commercial requirement as well as a sensible one.

What it looks like in practice

List the handful of things the business genuinely cannot operate without. For each, note the maximum tolerable downtime and what you would actually do.

Test the backups by restoring from them. Untested backups fail at roughly the rate you would fear.

Keep a copy of the plan somewhere you can reach when your systems are down, with contact details that are not only in the system that is unavailable.

What to watch out for

Plans that assume the person who wrote them is available.

Insurance treated as the plan. Business interruption cover pays for losses; it does not deliver next week's orders.

Key person risk. In many small businesses the single largest continuity exposure is one individual.

Where to get proper advice

The National Cyber Security Centre publishes free, practical guidance for small organisations on the cyber side. Your insurance broker on business interruption cover.