Business Continuity Plan: Preparing Your Company for a Crisis

Quick answer. A business continuity plan (BCP) is the set of measures that lets a company maintain or quickly restore its essential functions after a major shock: cyberattack, physical loss, failure of a key supplier, departure of a key person. The method, framed by ISO 22301, has five steps: analyse the impact of interruptions (BIA), set recovery objectives (RTO/RPO), choose responses, write the procedures, then test. It rests on three pillars: proven backups, a designated crisis team and a cash reserve. An SME can build a useful BCP in a few weeks.

Shocks have multiplied: ransomware, supply disruptions, floods, hosting outages, cascading failures. For an SME, the point is not to avoid the unexpected — that is impossible — but to absorb it without stopping. That is exactly what the business continuity plan is for: organising in calm what you will not have time to think through in the heat of the moment.

The common reflex is to reduce the BCP to IT. That is a mistake: a BCP covers all vital functions — production, payroll, invoicing, customer relations, cash — not just servers. Data backup is one brick among others. The right approach starts from the essential activities, then traces back to the resources (people, IT, finance, suppliers) they depend on. It complements the detection of difficulty signals: one anticipates the financial crisis, the other the operational crisis.

The BCP aims to keep essential activities running during the crisis and restore them quickly. Do not confuse it with two neighbouring notions:

• the DRP (disaster recovery plan) is the IT side: restoring systems and data after an incident. It is a subset of the BCP, not its equivalent.
• crisis management is the human and decision-making dimension: who decides, who speaks, who does what during the event. The BCP integrates it through the crisis team.

The international reference standard is ISO 22301 ("Security and resilience — Business continuity management systems"). It does not legally bind an SME, but offers a proven method, organised around the PDCA continuous-improvement cycle (plan, do, check, act).

The impact analysis (BIA), the heart of it#

The business impact analysis answers one question: if a given activity stops, how much does it cost, and from when does it become vital? You rank activities by criticality, quantify the losses (lost revenue, penalties, lost clients), and identify the indispensable resources. Without a BIA, a BCP protects at random; with a BIA, it concentrates resources where stopping hurts most.

RTO and RPO: two numbers that structure everything#

Two metrics, recognised by ISO 22301 and by the French cybersecurity agency (ANSSI), set the tempo:

• the RTO (Recovery Time Objective) is the maximum tolerable interruption before an activity is restored. How long can you stay down?
• the RPO (Recovery Point Objective) is the maximum data you accept to lose, expressed in time. A daily backup implies a 24-hour RPO: you can lose one day of entries.

These two numbers dictate the investments. An RPO of a few minutes requires continuous replication; a 24-hour RPO settles for a nightly backup. Setting an RTO and RPO per activity avoids over-investing everywhere or under-protecting the essentials.

The 3-2-1 backup rule is worth knowing for every owner: three copies of the data, on two different media, one of them off-site (and ideally offline, to withstand ransomware). A backup never restored is not a backup: it is an assumption. Testing restoration is part of the plan. On the physical-loss side, compensation and accounting also need preparing.

People readily document servers and procedures but often forget the sinews of war: money. During an interruption, costs continue (wages, rent, subscriptions) while collections stop. A solid BCP therefore includes a financial component:

1. A cash reserve sized to last the longest RTO, fixed costs included.
2. Confirmed credit lines mobilisable without delay (authorised overdraft, receivables line).
3. A crisis cash forecast that simulates the stoppage and quantifies the need day by day. It is the natural extension of a cash-flow stress test.

This financial component is too often neglected because it belongs to a different skill set than IT. Yet it is what decides whether the company survives a three-week stoppage, and it is exactly where an outsourced finance director adds value.

A plan is only as good as the people who run it. The crisis team designates, in calm, who leads, who approves exceptional spending, who speaks to clients, staff, insurers and authorities. A crisis directory (up-to-date contacts, including personal ones, accessible outside the information system) avoids hunting for a number while everything burns. Communication is prepared: template messages to clients and teams, a single spokesperson, backup channels.

• The very small firm. No need for an 80-page manual: a one-page sheet per essential activity (who, what, where the backups are, who to call) already prevents paralysis.
• The all-cloud company. The risk shifts to the host and access: what happens if the SaaS provider goes down, or the admin account is compromised? Exported backups and two-factor authentication become vital.
• The seasonal business. The cost of an interruption depends on timing: a stoppage in peak season is devastating. The BCP must weight RTOs by the calendar.
• Platform dependence. Many activities depend on a single actor (marketplace, payment processor). The BCP plans a backup channel and reads the terms.

• A BCP never tested is fiction. Schedule at least one exercise a year: backup restoration, crisis-team simulation.
• Online backups are no longer enough. Against ransomware, an offline or immutable copy is essential.
• Keep the plan up to date. A change of software, supplier or director quickly makes a BCP obsolete.
• Check your insurance. Business-interruption cover and cyber insurance are read before the crisis, not during.

A client firm of about ten employees suffered ransomware one Monday morning: everything encrypted, including the first backup, connected to the network. They had no offline copy. Recovery took eleven days and cost far more than the avoided ransom: production halted, anxious clients, delayed payroll. We then helped them build a minimal but real BCP: 3-2-1 backups with a weekly tested offline copy, continuity sheets per activity, and above all a cash reserve equal to three weeks of fixed costs. A year later, a hosting outage stopped them for two days: thanks to the plan, they switched to their fallback procedure without panicking.

The real value of a BCP is measured not the day you write it, but the day you need it. And on that day, what saves you is never the document: it is having thought ahead. Building a BCP is the luxury of thinking in calm.

Hayot Expertise tip. Start small but start. List your three most critical activities, set a tolerable downtime for each, check that your backups actually restore, and quantify the cash needed to survive a stoppage. We help you connect the financial side — a crisis cash forecast — with securing your systems and data.