Business continuity for small business: a plan you can actually use
Business continuity sounds like something for banks and airlines. For a business of 30 people it comes down to a few practical questions. If email, files or the internet stopped this morning, what would you do first, who would you call, and how long could you keep working?
Writing the answers down beforehand is most of the work. This is the version we'd suggest for a small or mid-sized business.
1. Decide what matters most
List the systems the business can't work without, and for each one, how long you could manage without it. Email and files are usually near the top. So is the line-of-business software: practice management, accounting, job scheduling. Phones and internet sit underneath all of it.
Two questions for each system make the plan concrete:
- How much data could we afford to lose? An hour of email? A day of job notes?
- How long until it has to be working again? By lunchtime? By tomorrow?
The answers decide how often you back up and how quickly you need to restore.
2. Back up what the cloud doesn't
Microsoft runs Microsoft 365 reliably, but its job is to keep the service up, not to roll back your mistakes or an attacker's. Deleted mailboxes, overwritten files and ransomware-encrypted OneDrive folders are your problem. Regular backups are one of the ACSC's Essential Eight strategies for good reason.
- Back up Exchange, SharePoint, OneDrive and Teams to storage outside your tenant, so a compromised admin account can't delete the backups too.
- Include any remaining servers and line-of-business databases.
- Know who can restore, and how.
3. Test restores on a schedule
Until someone restores from a backup, nobody knows it works. Pick a mailbox, a SharePoint folder and a file each quarter, restore them somewhere safe, and record the date and the result. If a restore fails, you've found out on a quiet Tuesday rather than during an incident.
4. Plan for losing the internet
Cloud services don't help if the office can't reach them. A backup mobile connection on the router that takes over automatically keeps most work going through an outage. Laptops that work from home, or a phone hotspot, are a reasonable fallback for short outages. Test the failover by unplugging the main connection.
5. Write down who to call
Keep a short contact list somewhere that doesn't depend on your systems being up: printed, or on a phone. Include:
- your IT provider's phone number and email;
- your internet provider's fault line and your service ID;
- key software vendors and account numbers;
- your insurer, if you hold cyber cover;
- the people inside the business who make decisions in an outage.
6. Know what to do in a cyber incident
If the cause is a cyber attack, there are extra steps. The Australian Cyber Security Centre takes reports through cyber.gov.au and runs a hotline, 1300 CYBER1 (1300 292 371). If personal information is involved and the Privacy Act covers your organisation, the Notifiable Data Breaches scheme requires you to notify affected people and the OAIC when a breach is likely to result in serious harm. Your insurer will want to hear early too.
7. Practise once a year
Sit down for an hour with the plan and a scenario: "the office internet is down for two days" or "a mailbox has been taken over". Walk through who does what. The gaps show up quickly, and they're cheap to fix on paper.
How we handle it
For managed clients, Microsoft 365 is backed up outside the tenant, restores are tested on a schedule, and the latest result sits in the client's documentation register next to supplier details and admin accounts. Security alerts are triaged around the clock by our 24/7 cybersecurity remediation SOC. The older post on building an IT disaster recovery plan goes deeper on recovery planning, and managed IT services covers what we include.
Sources
Checked October 2026.