LJE ITIT outside the box

Business continuity for small firms: a plan that fits on two pages

Home › Guides › Business continuity for small firms: a plan that fits on two pages

A business continuity plan sounds like something only big companies need. In reality, a small business hit by an IT outage, ransomware, or a lost office key loses money faster than larger firms can absorb it. A simple plan—written down and kept handy—takes an hour to prepare and can save your business during the unexpected.

What does a continuity plan do?

It answers three questions: if the office is not accessible tomorrow, what is the priority? What does the business need to keep running? Who calls whom? If the main system fails, does everyone know what to do, or are hours spent figuring it out while customers wait? A plan removes guesswork. It does not need to be long; two pages of clear steps are better than a fifty-page document nobody reads.

Step 1: List your critical functions

Start by naming the top three to five things your business absolutely must do. For a shop: taking payment, communicating with suppliers, managing stock. For an office: handling client calls, sending invoices, accessing email. For a charity: recording donations, scheduling staff, reporting to trustees. Write these down. Everything else is secondary.

Next, for each critical function, note what you need: computer, internet connection, phone line, software, printed contact list. Be specific. Knowing that you need “internet connection” is less useful than noting “four computers need internet via the office router.” The more specific, the faster you’ll recover when something breaks.

Step 2: Plan your backup

If your office isn’t accessible, how will staff work? Can someone work from home with a laptop and a mobile hotspot? Can you operate from a library or community centre with WiFi? Can you temporarily work by phone and email from home? Write down one or two realistic options. If you use cloud-based software (email, accounting, CRM), staff can often access it from anywhere once you’ve decided where that anywhere is.

For IT systems, decide what you’ll do if the main server fails:

  • Do you have backups that can be restored quickly? (Yes, if you follow the 3-2-1 backup rule)
  • If cloud-based, can you access it from another computer?
  • If not backed up, how long can you work without it?

Step 3: Know who to call first

Write down:

  • Your IT support contact (phone and email) – so you don’t waste time searching when a system fails
  • Your internet/phone provider’s support number – for broadband or phone failures
  • Your bank and payment processor – if you think there’s fraud or if you need emergency access
  • Action Fraud or the National Cyber Security Centre – if you suspect a cyber attack (0300 123 2040 for Action Fraud, available 24/7 for live incidents)
  • Staff contact details – so you can tell them where to work if the office is inaccessible

Keep this list on paper and in a staff email. Don’t assume you’ll remember it when you’re stressed.

Step 4: Prepare for cyber incidents specifically

Ransomware and other cyberattacks shut down business. Know your response in advance:

  • If your files are encrypted: stop work on that computer, disconnect it from the network, and call Action Fraud (0300 123 2040)
  • If you receive a phishing email: don’t click links, delete the email, and tell your staff
  • If you think someone has accessed your email: change the password from another device immediately, then contact your email provider

The faster you act, the less damage occurs. Panicking or trying to pay a ransom wastes time; a rapid call to Action Fraud and your IT support is the right move.

Step 5: Document it and test it

Write your plan in simple language and print a copy to keep in the office safe. Email a copy to a trusted team member or family member as a backup. Every year, read it through and update phone numbers or staff names. Once a year, do a small test: imagine the office is closed; can your staff access email from home? Can you log in to your cloud accounting software? Can you make a test payment without walking into the office?

Testing doesn’t have to be elaborate. It just confirms your backup systems work when you need them.

A one-page template

Business Continuity Summary

Critical functions:

  1. [List]
  2. [List]
  3. [List]

If the office is inaccessible: [Where and how will staff work?]

Backup system status: [Do backups exist? Are they tested?]

First contacts in a failure:

  • IT support: [Name, phone, email]
  • Broadband provider: [Number]
  • Action Fraud (cyber incidents): 0300 123 2040

How staff will be notified: [Email? WhatsApp? Phone call?]

Recovery time estimate: [How long until systems are back to normal?]

Key points

  • Identify your three to five critical business functions and what each one needs to run
  • Decide where and how staff will work if the office is inaccessible
  • Write down key contact numbers and keep them on paper and in email
  • Know your response plan for a cyber incident: stop, disconnect, call Action Fraud
  • Test your backup systems once a year to confirm they work
  • Keep your plan simple so staff actually read it and remember it

Related: Find IT support near you