Business continuity planning (BCP) gets conflated with disaster recovery, but they're different disciplines. Disaster recovery is about restoring IT systems after a failure. Business continuity is about keeping the business operating — even if some systems are down or inaccessible.

Start With Your Critical Functions

The first step in any BCP is a Business Impact Analysis (BIA): identify which business functions are truly critical, what systems they depend on, and how long they can be down before the impact becomes severe.

Two numbers matter: Recovery Time Objective (RTO) — how quickly a system must be restored — and Recovery Point Objective (RPO) — how much data you can afford to lose. These numbers drive every subsequent technical decision.

The Four Scenarios to Plan For

  • IT outage: A server fails, ransomware hits, or your internet connection goes down. Can your team still operate? Do they know what to do?
  • Physical access loss: Your office is inaccessible due to fire, flood, or other event. Can everyone work remotely immediately?
  • Key person dependency: Your IT person, bookkeeper, or operations lead is unavailable. Is there documented runbook for critical processes?
  • Vendor failure: A key software vendor or supplier goes down. What's your fallback?

Backup Is Not a BCP

Having backups is essential but it doesn't answer: who initiates the restore, how long does it take, where does it restore to, and who communicates with staff and customers during the outage? Those answers need to exist before you need them.

The Plan Is Only as Good as the Test

A BCP that's never been tested is a document, not a plan. At minimum, run a tabletop exercise annually: walk your key team members through a realistic scenario and see where the plan breaks down. It always breaks down somewhere — and it's better to find out in a conference room than at 2am during an actual incident.

What to Document

  • Contact list for all key staff, vendors, and stakeholders (stored somewhere other than your email server)
  • Step-by-step runbooks for critical IT recovery tasks
  • Communication templates for notifying clients during an outage
  • Offsite or cloud-based access to critical business data
  • Insurance policy numbers and claims contacts

The businesses that recover quickly from disruptions aren't lucky — they prepared.