Business continuity basics: keeping a small business running after a cyber incident

A business continuity plan for a small business sets out how the business keeps operating, or gets back to operating, when something disrupts it. For cyber security, that might be ransomware locking files, an email account being taken over, or a key cloud service going down. This guide explains what business.gov.au and the Australian Signals Directorate (ASD) describe for a simple continuity plan, how it differs from incident response and backups, and how small businesses test one. It’s general education, not a plan or professional advice.

Why it matters

ASD’s small business guide says “an emergency plan could reduce the impact of a cyber attack on your business”, and asks: “How will you manage business as usual, if any critical systems are offline?” business.gov.au describes an emergency management plan that “prepares you and your business for unexpected disruptions”.

A cyber incident can take systems offline for days. A business that has already written down its most important activities, workarounds and contacts has less to work out under pressure.

Continuity, incident response and backups: how they differ

These three ideas overlap, and small businesses often keep them in one document. They answer different questions.

Backups support continuity, but they aren’t a continuity plan on their own. ASD’s small business guide warns that without regular backups “it could be impossible for you to recover your information after a cyber attack”. A continuity plan adds the people, workarounds and contacts needed while that recovery happens.

What a simple continuity plan covers

business.gov.au’s guidance on developing an emergency management plan describes three parts.

1. Before: the continuity plan

business.gov.au describes identifying risks to the business’s “critical areas” and how to manage them, including:

• Products and services: the most important or profitable ones, how they’re delivered, and a backup if that fails.
• Key customers: who they are and how they’ll be contacted to explain what happened.
• Insurance: current policies.
• Relocation and continuity strategies: other ways to keep operating, such as a virtual office or an online store.
• Staff training: the skills that would help keep the business running.
• Information backup: how customer, financial and contact records are protected, including digital backup procedures.

2. During: the emergency action plan

business.gov.au describes emergency contacts, procedures, and “clear roles and responsibilities” with appropriate training. For a cyber incident, ASD’s small business guide adds who to contact, such as “IT professionals and your bank”, and how the business will communicate with staff, stakeholders or customers.

3. After: the recovery plan

business.gov.au describes a business impact assessment (the damage, its effect on the business, the response and who is responsible for each task), recovery contacts, insurance claims, and how the business communicates with customers.

Questions a small business commonly works through

Drawing those parts together for cyber incidents, a small business might write short answers to:

1. Which systems do we need to trade each day (for example, email, payments, bookings, accounting)?
2. If each one is unavailable for a day or a week, what’s the manual workaround?
3. Where are our backups, and who can restore them?
4. Who do we call? (IT provider, bank, insurer, key suppliers.)
5. How do we contact staff and customers if email is down?
6. Who makes decisions, and who takes over if they’re unavailable?

ASD’s guide describes keeping “a hard copy of the plan in case your systems are offline when you need it”. A plan stored only in the email account that has been taken over isn’t much help.

Testing the plan

business.gov.au describes rehearsing the emergency action plan with staff, noting this can reveal missing steps. It also describes regularly reviewing the plan, and updating it after staff changes or a move to a new location.

For backups specifically, ASD’s Essential Eight maturity model (November 2023 version, Maturity Level One) describes restoration of data, applications and settings from backups being “tested as part of disaster recovery exercises”. The Essential Eight explained guide covers the maturity levels.

Common ways small businesses test, from lightest to most involved:

• A read-through. The team reads the plan together and checks the contacts and phone numbers still work.
• A walk-through scenario. Someone describes a fictional incident (“the accounting system won’t open on Monday morning”) and the team talks through what they’d do using the plan. ASD’s free Exercise in a Box resource describes discussion-based exercises, “often called a tabletop exercise”, lasting 30 to 120 minutes with no real systems affected, as well as shorter 15 to 30 minute micro-exercises. It includes the materials to plan and run them and a report template for recording findings.
• A restore test. Someone restores a sample of files or a test account from backup to confirm it works and to see how long it takes.

After each test, the plan is updated with anything that was missing.

A fictional example

Priya runs a three-person physiotherapy clinic. She uses business.gov.au’s template to write a two-page plan. During a walk-through, the team realises appointment reminders are sent from the booking system, and nobody knows how to reach patients if it’s down. They add a weekly printed list of the next week’s appointments and the booking provider’s support contact (support@bookings.example) to the plan. A restore test also shows that only Priya knows the backup password, so a sealed copy is stored securely for her deputy.

Things to watch for

• Treating backups as the whole plan. Data can be restored while the business still can’t take payments or answer customers.
• Backups that can be reached by an attacker. ASD’s small business guide includes a case study where a connected backup drive “had also been encrypted” by ransomware. The 3-2-1 backup guide explains keeping copies in more than one place.
• A plan nobody can find. ASD describes keeping a hard copy; business.gov.au’s Continuing your business guide describes documenting procedures so staff “can access them easily”.
• Out-of-date contacts. Phone numbers and staff change. business.gov.au describes updating the plan after staff changes.
• Depending on one supplier. If a single cloud service runs the business, its outage becomes the business’s outage. See supplier and IT provider security.
• Insurance assumptions. business.gov.au’s cyber security checklist notes that an attack can cost more than repairs, and describes checking exactly what a cyber insurance policy covers.

Common questions

How do I write a business continuity plan for my small business?

business.gov.au’s guidance on developing an emergency management plan describes three parts: a continuity plan for before, an emergency action plan for during, and a recovery plan for after. For cyber incidents, ASD’s small business guide asks: “How will you manage business as usual, if any critical systems are offline?” A short plan can cover critical systems, workarounds, backups, contacts and who decides. See what a simple continuity plan covers.

What’s the difference between business continuity and incident response?

Incident response deals with the incident itself, such as isolating devices and contacting the bank. Business continuity is about keeping the business operating while systems are down, and recovering. Small businesses often keep both in one document. business.gov.au’s emergency management plan covers before, during and after; ASD’s emergency plan covers both reporting and keeping business as usual running. See how they differ.

Is there a free business continuity plan template in Australia?

Yes. business.gov.au’s page on developing an emergency management plan offers a downloadable “Emergency management and recovery plan template”. Our one-page cyber incident response plan covers the cyber-specific contacts and first actions, and the list of questions a small business commonly works through covers the cyber parts of a continuity plan.

How do I test a business continuity plan?

business.gov.au describes rehearsing the plan with staff, which can reveal missing steps, and reviewing it regularly, including after staff changes or a move; it doesn’t give an interval. Options range from a read-through, to a walk-through scenario such as the tabletop exercises in ASD’s free Exercise in a Box, to a restore test from backup. See testing the plan.

Are backups enough for business continuity?

Backups are one part, not the whole plan. ASD’s small business guide warns that without regular backups “it could be impossible for you to recover your information after a cyber attack”. business.gov.au’s plan also covers key customers, workarounds, roles, contacts and insurance, because data can be restored while the business still can’t take payments or answer customers. See how they differ.

What do I do if a cyber attack takes my business offline?

That’s when the plan’s workarounds and contacts are used, alongside the incident response steps. ASD’s small business guide lists contacts such as “IT professionals and your bank”, and ASD’s Australian Cyber Security Hotline, 1300 CYBER1 (1300 292 371), is available 24/7 according to ASD’s ransomware page. See the one-page cyber incident response plan and ransomware explained.

Where to get official help

• business.gov.au: develop an emergency management plan, including the free template.
• ASD’s small business cyber security guide, which includes its emergency plan questions.
• ASD’s Australian Cyber Security Hotline, 1300 CYBER1 (1300 292 371), is available 24/7, according to ASD’s ransomware page.
• Ransomware explained covers what ASD says to do if ransomware strikes.