IT Planning
Small business IT continuity
Identify essential work, agree temporary ways to operate during IT failures, assign recovery owners and check the plan.
An IT continuity plan for a small business sets out the work that must continue during a technology failure, who decides what to pause, and how staff resume normal work. Begin with a few essential tasks and a temporary route for each. Some tasks cannot safely continue without their usual system; note that limit.
Set priorities for an interruption
Ask the people who do the work which tasks become urgent when the office internet, a device or a critical account is unavailable. For each task, record the information it needs, how long it can wait, who can authorise a temporary route and who will handle unfinished work.
| Task | Normal route | Temporary route to consider | Decision owner |
|---|---|---|---|
| Receive enquiries | Business phone, email or booking service | An approved reachable channel and a controlled request record | Named business owner |
| Continue scheduled work | Job system and current records | An agreed, limited set of work information | Named business owner |
| Issue time-sensitive documents | Accounting or document service | Record the work for later issue, or use an approved alternative | Named business owner |
These are planning prompts, not procedures that will suit every business. Confirm the route with its task owner before relying on it.
Normal vs. temporary routes for key business tasks
- Task: Receive enquiriesNormal: Business phone, email or booking service | Temporary: Approved reachable channel with controlled request record
- Task: Continue scheduled workNormal: Job system and current records | Temporary: Agreed, limited set of work information
- Task: Issue time-sensitive documentsNormal: Accounting or document service | Temporary: Record work for later issue or use approved alternative
Map what each route depends on
Trace the connection, device, sign-in, application and information behind each priority task. An internet outage can leave a working laptop unable to reach a cloud service. A broken laptop can leave that service available to other staff.
A locked administrator account may prevent recovery even when devices and connections work. Record the supplier or internal owner for each dependency.
Test a proposed temporary route against the failure it is meant to cover. A mobile connection needs reception, enough data, power and a working device where staff will use it. A spare computer needs the right applications, permissions and current records. Battery power for a router does not ensure the wider network will remain available.
Assign decisions and plan the return
Name who can activate a temporary route and who coordinates technical recovery, even when a supplier does the work. Keep essential contacts and a staff communication method available if email or a shared drive is down. Protect sensitive details and keep any accessible copy current.
Tell affected staff and customers what can still be done and when they will receive the next update. Avoid promising a restoration time before the responsible provider confirms it.
When the normal route returns, have an authorised worker complete the original task. Reconcile requests and records created during the interruption, check for duplicates and give every outstanding item an owner. If compromise is suspected, follow the incident process and obtain appropriate technical advice before reconnecting a potentially affected device or restoring data.
Check the plan
Walk staff through one contained failure scenario. Check whether they can find the plan, reach the decision owner and explain the temporary route. Separately, have an authorised person try a representative task on any proposed alternative equipment or connection. Record what worked and what remains untested.
Use a discussion exercise to consider a cyber incident. A discussion cannot prove that a backup restores or an application works on a spare computer. Review the plan after meaningful changes to staff, suppliers, systems or premises.
How to test your IT continuity plan
- Walk staff through a contained failure scenarioEnsure they can locate the plan, contact the decision owner, and explain the temporary route
- Have an authorised person perform a representative task on alternative equipment or connectionVerify functionality and identify any untested components
- Record what worked and what remains untestedUpdate the plan based on findings
- Conduct a discussion exercise on a cyber incidentUse this to assess readiness, even if it doesn't validate technical recovery
In this guide
- Preparing for an internet outageDecide which tasks need internet, check an alternative connection and give staff an outage and reconciliation sequence.
- Keeping emergency access to critical business accountsIdentify critical accounts, arrange secure provider-supported recovery and control how emergency access is used and checked.
- Planning how staff work during a device failurePlan the worker's temporary tasks, approved device and data access, then check and reconcile work when the original device returns.
- Testing the basic IT recovery checklistRun a contained recovery exercise, record observed results and assign fixes without mistaking a discussion for a technical restore test.
