Business Continuity Planning for Small Businesses

What is a business continuity plan for a small business?

A business continuity plan explains who does what, and how work keeps going, when something disrupts the business. It is about people and process first, technology second.

An IT disaster recovery plan is the technology section inside it: how systems and data come back. Our backup and disaster recovery service handles that technical side, including tested backups and recovery targets. This page is about the plan around it.

For a small firm, the whole thing can fit in a few pages. Short plans get read; long ones sit in a drawer.

What should a small business continuity plan include?

It should cover your critical work, the people responsible, and how to carry on without your usual office or systems.

• The functions that cannot stop, such as billing, client service or payroll, and who owns each one
• The systems and data each function depends on
• How staff work if the office is closed: laptops, remote access and phone forwarding
• A contact list for staff, key clients, vendors, your insurer and your IT provider
• Who makes decisions and who talks to clients
• Where the plan is kept, including a printed copy that does not depend on the network

IT disaster recovery plan: the technology section

The IT disaster recovery plan lists your systems, where the backups are, and the order you bring things back. It should be clear enough to follow under stress.

• Each critical system and where its backups live, including offsite cloud backups
• How much recent data you can afford to lose (RPO) and how long you can be down (RTO)
• The restore order, for example internet and email first, then accounting, then everything else
• Where passwords and recovery keys are stored safely
• When backups were last test-restored

If ransomware is a worry, and it should be, add at least one immutable backup copy to the plan.

Disaster recovery plan template: a simple starting outline

You can start with a one-page outline and fill it in over a few meetings. Here is a structure that works for most small offices:

1. Purpose, scope and the date of the last review
2. Emergency contacts and who declares a disaster
3. Critical functions, owners and acceptable downtime
4. Systems, data and backup locations
5. Step-by-step recovery for each critical system
6. How to work remotely or from another location
7. Client and staff communication
8. Test results and next review date

We can help you fill in the technical parts and check that each step actually works.

Massachusetts requirements and where continuity fits

Continuity planning supports several obligations that Massachusetts small businesses already have. Under 201 CMR 17.00, businesses holding personal information need a Written Information Security Program (WISP), and the HIPAA Security Rule asks healthcare practices for a contingency plan covering backup, disaster recovery and emergency operations.

Cyber insurers increasingly ask about backups and recovery plans too. Our compliance support for HIPAA and Massachusetts WISP can tie these documents together.

How do you test a business continuity plan?

Walk through it with your team, then test the technology behind it. A plan nobody has rehearsed usually has gaps.

A simple walk-through asks “what if the office were closed tomorrow?” and checks each step. On the technical side we verify backup jobs and run quarterly test restores. Review the plan once a year and after any big change, such as a move or a new system.

We are a family-run IT company at 335 Auburn Street in Newton and work with businesses across Greater Boston on-site and remotely.