Business continuity & disaster recovery
Stay in business during a disaster, not just after one
Most businesses plan for hurricane season and still underestimate the downtime. Days turn into months when staff cannot get childcare, housing or back to the office. A continuity plan keeps the business running through that.
A business continuity plan answers one question: how do we stay in business during a disaster? Not before it, not after it. During it.
On the Gulf Coast the obvious disaster is a hurricane, but continuity plans cover more than weather. A ransomware attack, a fire, a long power cut or the loss of a key supplier can stop a business just as completely.
Disaster recovery is the second half. Once the event is over, what needs to happen to get back to normal? Clean-up is not enough. You may be starting with no desks, no power and no computers, while every other business in the area competes for the same contractors.
The companies that come through well are the ones that planned properly. We help you build the plan, and then test it.
What's included
- Business impact analysis
- Which functions are critical, what each depends on, and how long each can stop before the damage is serious.
- Disaster risk matrix
- Each likely disaster scored on probability, consequence, time to recover, financial impact and how prepared you are.
- Critical staff documentation
- The knowledge that lives in one person's head, written down before that person is unreachable.
- Delegations of authority
- Who can approve what spending when the usual people cannot be reached.
- Supplier and vendor plans
- Your critical suppliers and service providers, their own continuity plans, and the alternatives if they fail.
- Communication protocols
- Who tells staff, clients and suppliers what, and how, when phones and email may be down.
- Payroll and finance continuity
- Payroll, payables and receivables kept running when the office is not.
- Alternate operations
- Alternate facilities, or the remote setup that means you do not need one.
- Backup and recovery
- Data backed up off-site and recovery tested, with targets for how much you can lose and how fast you are back.
- Disaster recovery plan
- What the office, services, staff and vendors need to look like to get back to normal, and in what order.
- Testing
- Failover and failback tests, tabletop exercises, walk-throughs, and plans tested by staff who did not write them.
Platforms we work with
- Veeam
- Microsoft 365
- OneDrive
- Azure
How a plan gets built
-
Define the scope
Which parts of the business the plan covers, and what it must protect.
-
Identify key areas
The parts of the business that matter most to keeping it alive.
-
Find critical functions
Within those areas, the functions that cannot stop.
-
Map dependencies
What each critical function relies on: people, systems, suppliers, buildings.
-
Set acceptable downtime
How long each critical function can be out before the business is in real trouble.
-
Write and test the plan
How each function keeps running, then a test to prove it.
Questions we get asked
What is the difference between business continuity and disaster recovery?
Business continuity keeps essential operations running during a disaster. Disaster recovery gets you back to normal afterwards. They are two separate plans, and continuity should come first, because it is the bridge that gets you through to recovery.
How long does a proper plan take?
Longer than most people expect. Our own plan took more than 320 hours over about four months. A small company's plan can be lighter, but anything written in an afternoon will not survive a real event.
Can you review a plan we already have?
Yes. Call us and we will talk it through. A second set of eyes often finds the dependency nobody thought of.
Where should we keep the plan?
In several places, and not only in the office. A plan stored on the server in the building that just flooded is not a plan.
Is a disaster a chance to upgrade?
Often, yes. Replacing everything like for like after a disaster is rarely the best use of the money. A recovery plan should say what you would rebuild differently.
Related
Controls that hold up when a client sends you a security questionnaire.
ServiceCloud & Microsoft 365Migrations that finish, and a tenant that stays tidy afterwards. Email, files, identity, phones.
ServicevCIO & vCISOSomeone who can sit in front of your board and answer for the technology.
ServiceThirty minutes, and you will know where you stand.
No obligation, no pitch deck. We will tell you what we would do and what the ceiling would be. If that is not worth it, you have lost half an hour.