Business Continuity Planning for UK SMEs: A Practical Guide

Business continuity planning for UK SMEs: a practical guide

Business continuity plans have a reputation for being 40-page documents that live in a folder nobody opens until it's already too late. In reality, a useful continuity plan for a UK SME is closer to a short, opinionated playbook: what could take us offline, what we do first, and how quickly we get back to serving customers.

Here's how we help our customers build one that actually works when it's needed, without turning it into a compliance exercise.

Why continuity planning matters more than it did five years ago

Three things have shifted for UK SMEs since the pandemic:

• More of the business is digital. Even traditional sectors now depend on Microsoft 365, cloud line-of-business apps, VoIP phones and remote access. When IT stops, the business stops much faster than it used to.
• Cyber incidents are a leading cause of outage. Ransomware, business email compromise and third-party breaches are now more common causes of prolonged downtime than fire, flood or hardware failure.
• Customers and insurers expect it. Larger customers routinely ask for evidence of continuity planning as part of onboarding. Cyber insurers ask about tested backups and incident response at renewal.

The upside: because so much runs on cloud services and modern endpoints, an SME with the right plan can now recover from serious incidents in hours rather than weeks.

Start with the two numbers that matter: RTO and RPO

Every continuity plan we build starts with two questions, agreed with the leadership team, not IT:

• RTO (Recovery Time Objective): how long can the business tolerate being unable to do X before it hurts? Measured in hours or minutes.
• RPO (Recovery Point Objective): how much data can the business afford to lose if we have to restore from a backup? Measured in time.

You'll usually have different RTO and RPO for different systems. Email might be an hour. The finance system might be four hours. Historical shared files might be a day. The point is to make it explicit so the technical design maps to a real business need.

The core building blocks

1. Resilient identity

Microsoft 365 (or Google Workspace) is your identity plane for almost everything else. Protecting it is job one:

• MFA on every account, no exceptions.
• Break-glass admin accounts stored securely.
• Conditional access policies that limit sign-ins to expected locations and devices.
• A separate Microsoft 365 backup so mailboxes, OneDrive, SharePoint and Teams can be restored independently.

If your identity provider goes down or gets compromised, nothing else matters until it's back.

2. Backups that survive the worst-case scenario

The rule we work to is simple: at least one backup copy has to be reachable only via credentials that a ransomware attack on your production environment cannot obtain. That usually means immutable cloud backups, separate MFA-protected admin accounts, and retention windows long enough to catch a slow-moving compromise.

And, again, restores get tested. A backup that has never been restored is a hypothesis, not a plan.

3. Resilient connectivity and comms

If the office internet drops, can staff work from home? If the phone system goes down, can calls be answered on mobiles?

Modern VoIP platforms make this straightforward. Our communications and VoIP customers can route incoming calls to mobile softphones, on-call rotas, or another site in minutes rather than waiting for an engineer to reconfigure a physical PBX. That single capability turns "we're offline" into "we're operating from home for the afternoon".

4. Documented incident response

The plan doesn't have to be long. It has to be usable at 8am on a bad Monday. Ours typically covers:

• A clear list of scenarios (ransomware, M365 outage, office inaccessible, key supplier failure, key person unavailable).
• The first three actions for each, and who owns them.
• Contact numbers for IT, insurance, legal and key suppliers.
• Communications templates: staff, customers, suppliers, regulators.
• A single owner in the business who can call the shots.

Print a copy. Do not rely on it living only in the system that just went offline.

5. A tested workflow for remote-first working

Hybrid working made continuity planning easier for most SMEs, provided the setup is deliberate. Cloud-based file storage, modern endpoints, VoIP softphones and remote-friendly line-of-business apps mean that "the office is unusable" doesn't have to mean "we're closed".

Test it. A quarterly "we're all working from home tomorrow" morning is worth more than any policy document.

What to test, and how often

Continuity plans decay. Software changes, staff change, suppliers change. A sensible testing rhythm for an SME looks like:

• Monthly: spot-restore a random file and a random mailbox from backup.
• Quarterly: full-team remote working test, phone system failover test, table-top walkthrough of one scenario.
• Annually: a proper table-top exercise of a serious incident with the leadership team, plus a review of RTO/RPO against how the business has changed.

None of this needs to be a big-bang project. Most of the value comes from getting a short cycle running and iterating on it.

Where continuity planning fits alongside cyber security

The two overlap heavily but aren't the same thing. Cyber security tries to stop incidents happening. Continuity planning assumes some will get through and focuses on how you recover.

If you already have a cyber security consultancy engagement running, continuity planning is a natural next step, because the assessment will have already flagged the weak points. If you don't, the two are frequently scoped together.

Common mistakes we see

• A plan built by IT, in isolation. RTO and RPO belong to the business, not the technical team.
• Backups nobody has ever restored.
• Continuity plans that assume the office is available. Every plan should work if the building is off-limits.
• Single points of failure that everyone knows about and nobody has budgeted to fix.
• No named owner. Someone has to be able to say "we're invoking the plan now".

Where to start this month

Pick one scenario. Ransomware is usually the most instructive. Walk your leadership team through, on paper, exactly what happens in the first hour, the first day, and the first week. Every gap you find is your continuity plan writing itself.

If you'd rather work through it with a partner who does this regularly, that's exactly what a scoping call with our IT consultancy or cyber security consultancy team looks like. Get in touch and we'll help you turn a blank page into a plan you'd actually use.