Write a technology continuity plan people can use

Begin with essential business work

A continuity plan explains how the business keeps essential functions operating during disruption and returns to normal afterwards. It is broader than restoring a server. Staff safety, premises, suppliers, customer communication, payments and decision authority may all matter. Start with the few activities the business cannot pause for long, then identify the technology and people those activities depend on.

The Australian government's emergency management guidance separates continuity preparation, immediate action and recovery planning. Use that structure if it helps, but keep your own document short enough to use under pressure. A detailed folder that nobody can locate during an outage has limited operational value.

Set priorities and tolerances

List critical activities such as taking orders, dispatching goods, providing scheduled services and paying staff. For each, write the maximum tolerable interruption and the acceptable loss of recent information. Identify a decision-maker who can approve a temporary workaround, extra spending or suspension of an unsafe process.

Do not label every application critical. If everything is priority one, the recovery team has no order to follow. Ask what must happen in the first hour, the first day and the first week. A manual sales process may keep trading while reporting waits. A shared identity or network service may need restoration first because several other systems depend on it.

Design realistic fallbacks

For each activity, write a fallback and its limitations. Examples include a tested backup connection, a secure offline contact list, a manual order log or an alternate workplace. Check that the fallback does not depend on the same failed account, device or premises. A cloud-hosted instruction page is of little use if nobody can sign in.

Record how information captured during the outage will be reconciled afterwards. Manual orders can create duplicate fulfilment or missing payments if there is no return-to-normal process. Define what staff must not do, such as accepting unverified bank-detail changes or storing sensitive records in personal accounts. Temporary operation still needs appropriate controls.

Cost the disruption honestly

Estimate affected labour, genuinely lost gross profit and exceptional recovery costs separately. Some revenue is delayed rather than lost. Some staff can move to other useful tasks. Count only the affected share, and check that margin and labour assumptions do not duplicate the same cost.

For illustration, ten staff losing half their productive time for four hours at an assumed A$40 loaded hourly cost represents A$800 of disrupted labour capacity. Add A$600 of lost contribution only if it is truly unrecoverable and not already captured in the labour measure. Use the downtime calculator to expose those assumptions rather than presenting a single speculative loss figure.

Keep contacts and authority available

Maintain current contacts for key staff, IT support, internet provider, bank, insurer, building management and critical suppliers. Store a secure accessible copy outside the systems most likely to be unavailable. Do not include secret passwords in a widely distributed plan. Instead, describe who can retrieve protected recovery information and how they are authorised.

Define who communicates with staff, customers and external advisers. During a suspected cyber incident, ordinary email may be untrusted, so have an alternative channel. Obtain appropriate professional advice on legal, privacy, reporting and insurance issues. This guide does not determine notification obligations or promise that a workaround satisfies every regulatory requirement.

Keep a practical decision record

Put a short activation page at the front: who can declare the incident, immediate safety priorities, trusted communication channel, essential functions and first contacts. Give deputies access in case the owner is unavailable. Check that a printed copy does not expose secrets and that the current version can be identified easily. During an exercise, ask someone unfamiliar with its preparation to use it. If the instructions depend on unwritten knowledge, add the missing decision or contact. Keep the technical detail in supporting procedures that the relevant people can retrieve.

Exercise and improve

Run a short tabletop exercise: the office has no internet, the owner cannot access email, or the premises are unavailable for a day. Ask staff to find instructions and walk through the first decisions. Then test technical fallbacks safely, including backup restoration and connection switching. Record gaps, owners and dates for correction.

Review the plan after staff changes, new applications, relocation and significant incidents. Connect it to recovery tests, onboarding and supplier contracts. The useful measure is whether people can carry out essential work and recover consistently under the assumed conditions. A completed template is a starting point, not evidence that the business is resilient.