When Did You Last Test Your Business Continuity Plan?

Who takes charge? How do you contact customers? What work can continue?

These are the questions a business continuity plan should help you answer. But if nobody has tested it, you may discover that the instructions, contacts or workarounds you are relying on no longer work.

At ITDS Managed, we encourage businesses to think beyond whether their technology is working today and consider how they would operate if something suddenly became unavailable.

Business continuity involves more than backing up your data

Backups are an important part of recovery, but they cannot answer every question raised by an outage. You also need to know how your people will communicate, which activities take priority and what customers should be told while services are disrupted.

Disruption does not have to start with a cyber attack. A failed internet connection, power cut, damaged laptop or unavailable software platform can interrupt everyday operations. Your plan should consider the different dependencies that keep the business running.

The National Cyber Security Centre recommends regularly testing continuity and recovery plans to identify gaps, check assumptions and improve coordination before an incident happens.

A practical checklist for your next test

1. Identify what must keep working

Start with the activities your business cannot afford to lose. That might include taking orders, accessing customer records, processing payments or delivering an essential service.

For each activity, identify the systems, devices, data and people it depends on. Agree how long the business could reasonably operate without it. This gives your recovery plan a clear order of priority.

2. Test what happens when the internet fails

Many businesses depend on internet access for email, telephone calls, cloud applications and shared files.

Check whether an alternative connection is available and whether it can support essential work. If the plan is for staff to work remotely, confirm they have suitable devices, secure access and clear instructions.

A workaround only becomes useful when the people who need it know how to use it.

3. Check your backup recovery process

A successful backup notification does not establish how quickly you can recover.

Arrange a controlled restoration test with your IT team or provider. Check that the recovered information is usable, understand how recent it is and record how long restoration takes. Consider whether applications and system settings also need to be recovered.

The NCSC advises organisations to test restoration processes regularly and prioritise business-critical services.

4. Consider lost or unavailable devices

If a key employee’s laptop failed or was stolen, how would they continue working?

Check whether replacement equipment is available, how quickly it could be configured and whether essential files are stored somewhere accessible and protected. Include access to authentication tools in your planning, particularly where employees use a phone to approve sign-ins.

5. Make responsibilities clear

Someone needs to coordinate the response, contact IT support, approve temporary arrangements and keep employees and customers informed.

Assign these responsibilities and nominate deputies. Make sure the plan and essential contact details can be accessed if your usual systems are unavailable.

6. Test communication as well as technology

An outage becomes harder to manage when nobody knows what is happening.

Agree how you will update employees if email or your usual messaging platform is unavailable. Decide who will communicate with customers and suppliers, what they need to know and when they should receive another update.

Start with one realistic scenario

Your first exercise can be a discussion around a table. Choose a scenario, such as losing access to your main business application for a day, and ask the relevant people to walk through their response.

Record where the answers are unclear. Does everyone know who to call? Can they find the plan? Are the proposed workarounds practical?

Technical recovery tests should be coordinated with your IT team or provider so they can be carried out safely. Afterwards, assign someone to resolve each gap and set a date to check the changes.

Keep the plan connected to your business

Review your plan when you introduce new software, change suppliers, move premises or change key roles. Build regular exercises into your schedule so that preparation keeps pace with the business.

ITDS Managed can help you review the technology your operations depend on, assess backup and recovery arrangements and identify practical steps to improve resilience.

If you cannot remember when your business continuity plan was last tested, get in touch with ITDS Managed to discuss where to start.

‍