Term
Business continuity plan
A prepared procedure for keeping key activities running through a disruption such as a fire, a cyberattack or the illness of a key person. It sets priorities, responsibilities and fallback solutions.
Updated
What it means
A business continuity plan is a document describing how a company will keep its key activities running, or restore them quickly, after a serious disruption. This might be a fire, an IT outage, a ransomware attack, the long illness of a key person or the loss of a supplier.
The plan is based on a business impact analysis. The company identifies which processes are critical, how long they can be down and how much data it can afford to lose. From this follow the maximum recovery time and requirements for backups, alternative premises and cover for key people.
Business continuity planning is part of risk management. For companies covered by the NIS2 directive or financial regulation it is mandatory; for others it is sensible prevention that proves invaluable on the first day of a crisis.
How it works in practice
With clients we start with a simple question: what happens if tomorrow the computer, email or bank does not work? For each critical process we write down who does it, what they need and what the fallback is. The result is a document of a few pages, not a thick binder.
For us as an accounting firm, access to data and meeting deadlines are key. Backups are kept separate from the production environment, we test restores regularly and every client has an assigned deputy. We recommend the same approach to clients for payroll and payments that cannot wait.
The plan also covers finances. We assess whether the company has a cash buffer and business interruption insurance, and whether it knows how long it could survive without revenue. In family businesses the plan also touches on succession and cover for the owner.
What to watch out for
A plan nobody has read and that has never been tested will not help in a crisis. We recommend simulating at least one scenario a year, such as restoring from backup or working without the office, and updating the plan based on the result.
Contacts and procedures in the plan must be available even when IT is down. A plan stored only on the company server is inaccessible during a ransomware attack, so a copy must also be kept offline or outside the company’s infrastructure.
Need the term explained on your own situation? Consulting from €55 / hour excl. VAT, depending on topic and complexity.