Five Steps to a Business Continuity Plan for a Small Office
A business continuity plan answers one question: if something stops your business tomorrow, what do you do in the first hour, the first day and the first week? It does not need to be a thick binder. For a small office, a clear plan of a few pages that people can find and follow is far better than a long one nobody has read.
The cause matters less than you might think. A failed server, a ransomware attack, a burst pipe, a lost internet connection and a key employee leaving suddenly all create the same problem: work you rely on is not available. Planning around what you need, not around each possible disaster, keeps the plan short.
Step 1: List what your business cannot do without
Write down the functions that keep money coming in and customers served: taking orders or appointments, billing, payroll, email, phones, your main line-of-business software, and access to customer or patient records. For each one, note what it depends on, such as a particular server, an internet connection, a cloud account or a person.
Then rank them. Some things can wait a week. Others cannot wait an hour. That ranking drives every other decision.
Step 2: Decide how fast, and how much loss you can accept
For each critical function, answer two questions:
- How long can we be without it? This is the recovery time you are aiming for.
- How much recent work can we afford to lose? If your last backup is from last night, you may lose up to a day of entries. If that is too much, you need more frequent backups.
These two numbers are often called recovery time and recovery point objectives. Setting them in plain language, such as “payroll can wait two days, but the appointment system must be back within four hours,” lets your IT provider choose the right backup and recovery tools instead of guessing.
Step 3: Decide who does what
In an emergency, people lose time deciding who is in charge. Name a decision-maker and a backup for that person. Assign who contacts staff, who calls the IT provider, who talks to customers, and who handles the insurance carrier if needed.
Keep a one-page contact sheet with phone numbers that do not depend on your office systems: your IT provider, your internet provider, your insurance carrier, your bank, and your key staff. Store a copy outside the office, on paper and on a personal phone.
Step 4: Write your business continuity plan in plain language
Put the plan on a few pages. For each critical function, include what to do first, where the backups are, how to reach the person who can restore them, and what workaround keeps customers served in the meantime. A paper schedule or a phone call can cover for a scheduling system for a day.
Store the plan where you can reach it when your systems are down. A plan that lives only on the server that failed is not a plan. Make sure that more than one person knows where it is.
Step 5: Test it, then keep it current
An untested plan is a guess. Once or twice a year, walk through a scenario with your team: “The server is down and it is 9 a.m. on a Monday. What happens?” Time how long it takes to restore a real file or system from backup. Fix whatever slowed you down.
Update the plan when something changes: a new system, a new office, a staff change, a different provider. Put a reminder on the calendar. Many plans fail because the phone numbers are two years old.
How this connects to your IT
Your recovery plan is only as good as your backups, so make sure they are tested, stored away from your main systems, and protected from ransomware. Our backup and disaster recovery page explains what a good backup plan includes, with tested restores near the top of the list, and our managed IT services include emergency support available 24/7. If you carry cyber insurance, your continuity and incident response plan is also something your insurer may ask about. See cyber insurance readiness. To see where you stand today, start with a free network review.
Frequently asked questions
How long should a small business continuity plan be?
A few pages is enough for most small offices: critical functions, recovery targets, who does what, contact numbers and the steps to restore each system. If people will not read it, shorten it.
What is the difference between a continuity plan and a disaster recovery plan?
A continuity plan covers how the whole business keeps operating, including people, communication and workarounds. A disaster recovery plan is the technical part: how systems and data are restored. Each supports the other.
How often should we test the plan?
At least once a year, and after any major change. A quick discussion exercise takes an hour and often turns up problems. Test restoring from backup more often than that.
Do we need a plan if everything is in the cloud?
Yes. Cloud services can have outages, accounts can be locked or compromised, and your internet connection can fail. A short plan for those cases still matters.
Who should be involved in writing it?
The owner or manager, the people who run the critical functions, and whoever handles your IT. The people who do the work know what is really needed to keep it going.
