Most business planning focuses on growth: revenue targets, new customers, expansion and efficiency. Very few plans start with a different question: what happens if our systems stop working?
For many small and medium-sized enterprises, IT downtime is one of the most underestimated risks they face. A ransomware attack, a failed server, a Microsoft 365 outage, a burst pipe in the server room or a simple human error can stop work for hours or days.
A business continuity plan (BCP) is how you prepare for that in advance. This guide explains what a BCP is, how to write a simple one for your SME, and how to keep it useful once it’s written.
Downtime Is a Business Problem, Not Just an IT Problem
Downtime is often described in technical terms: the server is down, the system is slow, email isn’t working. But the real impact is on the business:
- Orders, invoices and payments are delayed
- Deadlines are missed and customers are left waiting
- Staff sit idle but still need to be paid
- Customers and partners lose confidence
- Data entered since the last backup may have to be redone, or is lost
The business still exists, but it can’t function normally. A continuity plan is about keeping the most important work going, and getting everything else back in a sensible order.
What Is a Business Continuity Plan?
A business continuity plan is a short, practical document that answers three questions:
- What matters most? Which systems and processes the business can’t do without.
- How do we keep going? Workarounds while systems are down.
- How do we get back to normal? The order and timeframe for recovery.
It’s different from an incident response plan. An incident response plan covers the first hours of a security incident: who to call, how to contain it and what to report. A continuity plan covers keeping the business running and recovering, whatever the cause, whether a cyber attack, hardware failure, power outage or office closure.
Common Causes of IT Downtime for SMEs
| Cause | Example |
|---|---|
| Cyber attack | Ransomware encrypts files and servers |
| Account compromise | A hacked email account is locked or used to send scams |
| Hardware failure | A server, NAS or firewall stops working |
| Cloud or internet outage | Microsoft 365 or your internet provider has a service disruption |
| Human error | Files deleted, settings changed or the wrong update installed |
| Physical events | Power cuts, water damage, fire or office access restrictions |
| Supplier issues | A key software vendor or IT provider is unavailable |
How to Write a Simple Business Continuity Plan
Step 1: List your critical systems and processes
Start with what the business does every day, then the systems each activity depends on. For most SMEs this includes email, accounting or ERP software, shared files, the customer database, payment and banking access, phones and the internet connection.
Step 2: Decide how long each one can be down
For each critical system, agree two numbers with management:
- Recovery Time Objective (RTO): how long the business can manage without the system before the impact becomes serious. For example, 4 hours for email or 1 day for accounting.
- Recovery Point Objective (RPO): how much data the business can afford to lose, measured in time. If backups run nightly, you could lose up to a day of work.
These numbers decide what kind of backup and protection you need. A system with a 2-hour RTO needs a much faster recovery method than one the business can live without for a week.
Step 3: Check that your backups match those targets
Your backup frequency must match your RPO, and your restore speed must match your RTO. Follow the 3-2-1 backup rule: three copies of your data, on two different types of storage, with one copy offsite or in the cloud and protected from ransomware. Remember that Microsoft 365 data needs its own backup too.
Step 4: Plan manual workarounds
Decide how essential work continues while systems are down. Examples:
- Keep an offline copy of key customer and supplier contacts
- Have a paper or spreadsheet process for taking orders and recording payments
- Agree how staff will communicate if email is unavailable, such as a WhatsApp group
- Know how to make urgent payments if your usual banking access is affected
- Identify whether staff can work from home or another location
Step 5: Set out roles and contacts
Name who decides what happens, who contacts your IT provider, who updates staff and who talks to customers. Include phone numbers for your IT support, internet provider, key software vendors, bank and insurer. For more on decision-making, see Cybersecurity Is a Leadership Responsibility.
Step 6: Agree the recovery order
When several systems are affected, you can’t restore everything at once. Agree the order in advance, based on your RTOs, so nobody has to argue about it during a crisis.
Step 7: Plan how you’ll communicate
Prepare short message templates for staff, customers and suppliers explaining the disruption, what you’re doing and when you’ll update them next. Clear, early communication protects your reputation.
Business Continuity Plan Template: Critical Systems Table
Use a simple table like this as the core of your plan. Replace the examples with your own systems and targets.
| System | Owner | Max downtime (RTO) | Max data loss (RPO) | Workaround | Recovery priority |
|---|---|---|---|---|---|
| Email (Microsoft 365) | Office manager | 4 hours | 1 hour | WhatsApp group, phone | 1 |
| Accounting / ERP | Finance manager | 1 day | 1 day | Record invoices in a spreadsheet | 2 |
| Shared files | Operations lead | 1 day | 1 day | Work from offline copies | 3 |
| Customer database | Sales lead | 2 days | 1 day | Offline contact list | 4 |
| Website | Marketing | 3 days | 1 week | Social media updates | 5 |
Test Your Plan, Don’t Just Write It
A continuity plan that has never been tested is a list of assumptions. Simple ways to test it:
- Restore test: restore a server, a laptop or a set of files from backup and time how long it takes. Compare it with your RTO.
- Tabletop exercise: spend 30 minutes with management walking through a scenario, such as “ransomware has encrypted our accounting server”, and check whether everyone knows their role.
- Contact check: make sure every phone number in the plan still works.
- Offline copy check: confirm the plan can be accessed if your systems and email are down.
Review the plan at least once a year, and whenever you change key systems, move office or change IT provider.
Prevention Reduces How Often You Need the Plan
A good continuity plan helps you recover. Good protection means you need it less often. The minimum security baseline covers the essentials, including MFA, patching and network security. In particular:
- Acronis Endpoint Security stops ransomware and malware before it spreads across your devices.
- Acronis Backup provides fast, ransomware-protected recovery of servers, PCs and files.
- Microsoft 365 Backup protects email, OneDrive, SharePoint and Teams data that Microsoft doesn’t keep long term.
- Managed IT support means someone is monitoring systems and can respond quickly when something fails.
Eligible SMEs can get up to 50% grant support for Acronis Endpoint Security, Acronis Backup and Microsoft 365 Backup under IMDA’s SMEs Go Digital programme. See our EDGE grant guide.
Frequently Asked Questions
What is a business continuity plan for an SME?
It’s a short document that lists your critical systems, how long each can be down, how work continues in the meantime, who is responsible for what, and the order in which systems are recovered.
What’s the difference between a business continuity plan and a disaster recovery plan?
A business continuity plan covers keeping the whole business running during a disruption, including people, processes and communication. Disaster recovery is the technical part: restoring IT systems and data from backup.
What are RTO and RPO?
Recovery Time Objective (RTO) is how long a system can be down before the impact becomes serious. Recovery Point Objective (RPO) is how much data, measured in time, the business can afford to lose.
How often should we test our business continuity plan?
At least once a year, plus a backup restore test regularly, for example every quarter. Also review the plan whenever you change key systems, office or IT provider.
Does a small business really need a continuity plan?
Yes. Smaller businesses often have fewer people and less spare capacity to absorb downtime. Even a one-page plan with critical systems, contacts and workarounds makes recovery faster and less stressful.
Get Help Preparing for Downtime
WhatsApp Ostendo on +65 9457 3538 to review your critical systems, backup and recovery times, or download our Cyber Resilience Checklist below, which includes downtime and recovery questions for business leaders.
Checklist: Seven Essentials for Cyber Resilience and IT Optimization
In today’s fast-paced digital landscape, SMBs face unique challenges in managing their IT infrastructure.
This checklist is designed to help you score and identify where you stand regarding cyber resilience and what areas in your organization lack expertise, resources and experience regarding IT support, and partnering with an MSP like us, is crucial.
Fill out the form to download the checklist today!
