Your main technology provider goes offline. Employees cannot access email. The executive who normally makes emergency decisions is unreachable. Customers still expect service, and payroll still needs to run.
Business continuity starts with a practical question: Can your team keep essential services running when its usual people, premises, technology, or suppliers are unavailable?
A useful plan does not try to preserve every activity at full capacity. It identifies what matters most, establishes an acceptable level of service, and gives people workable alternatives. The checklist below turns that objective into specific decisions, documented responsibilities, and tests that reveal whether your organization is ready.
Understand What Business Continuity Must Accomplish
Business continuity, incident response, and disaster recovery are related, but they solve different problems.
- Business continuity keeps essential operations functioning during a disruption, potentially through reduced service or alternative processes.
- Incident response addresses the incident itself, including investigation, containment, and coordination.
- Disaster recovery restores technology, data, and supporting infrastructure.
During a ransomware incident, for example, responders may isolate affected systems while recovery teams prepare to restore them. Meanwhile, business leaders must decide how to serve customers, approve payments, and communicate without those systems. Those decisions belong in the continuity plan.
The UK National Cyber Security Centre’s continuity guidance emphasizes preparing to maintain operations through disruptive cyberattacks. The same dependency-focused approach also helps address power failures, inaccessible offices, staff shortages, and supplier outages.
The Business Continuity Checklist
☐ 1. Identify What Must Keep Running
Start with a business impact analysis, not a shopping list of recovery technology. Ask each business owner which activities are essential and what happens when they stop. Consider customer harm, financial obligations, contractual commitments, safety, and legal requirements. Assess how those consequences change as an interruption continues.
For every critical activity, capture:
- Accountability: Who owns the activity and understands its minimum acceptable output?
- Dependencies: Which people, systems, records, facilities, and suppliers does it require?
- Impact and priority: What becomes unacceptable, and which activities must resume first?
A simple worksheet can use these headings: Critical activity | Business owner | Dependencies | Impact of interruption | Recovery priority. This is a practical planning tool, not a prescribed regulatory format.
Look beneath obvious dependencies. Order fulfillment may depend on inventory records, shipping labels, warehouse access, and a carrier—not merely the ordering platform. Ready.gov’s business continuity template provides a useful starting structure for impact analysis and recovery planning.
☐ 2. Establish Recovery Targets the Business Can Support
Document separate targets for restoring service and recovering data:
- Recovery time objective, or RTO: The targeted recovery window, established before disruption causes unacceptable business impact.
- Recovery point objective, or RPO: The point in time to which data must be recovered, expressed operationally as how much recent data the business can tolerate losing.
These are not interchangeable. A restored ordering system may become available quickly while still missing recent orders. Conversely, current data may survive even though the application remains unavailable.
Use NIST’s definition of RTO to keep recovery discussions precise. Business owners should approve targets, and technology teams should validate whether the architecture, staffing, and budget can meet them. Treat an untested target as an assumption—not a demonstrated capability.
☐ 3. Assign Decision-Makers and Their Backups
A continuity plan should remove uncertainty about authority. Name a continuity lead, supporting team members, and alternates. Define who can:
- Activate the plan and escalate a disruption.
- Approve emergency spending and temporary operating changes.
- Authorize employee, customer, supplier, and public communications.
- Approve the return to normal operations.
Create a short activation sheet containing names, roles, contact details, alternates, and decision authority. Make it securely accessible without relying entirely on normal business systems.
Specify activation triggers as well. An unavailable critical provider or an outage threatening an approved recovery target should prompt a defined assessment—not an improvised search for someone willing to take responsibility.
☐ 4. Prepare Realistic Ways to Operate Differently
“Work remotely” is not a complete workaround. Employees still need equipment, connectivity, secure access, instructions, and someone authorized to resolve exceptions.
For each essential activity, document an alternative operating method, the resources it requires, and its limitations. Consider alternate premises, cross-trained staff, replacement suppliers, and controlled manual procedures.
For example, a customer-service team might record requests through an approved temporary process while its normal platform is unavailable. That procedure needs access controls, clear ownership, and a way to reconcile records afterward. Otherwise, today’s workaround creates tomorrow’s data loss or privacy problem.
Include abrupt supplier failure. Ask whether an alternative provider depends on the same underlying platform, identity service, or infrastructure. Two suppliers do not necessarily eliminate a shared point of failure.
Test question: Could we deliver our highest-priority service if our main office or primary provider became unavailable?
☐ 5. Verify Recovery, Not Just Backup Completion
A successful backup notification does not establish that the business can recover. Recovery requires usable data, working systems, available credentials, and a sequence that respects dependencies.
The CISA and MS-ISAC ransomware guide recommends offline, encrypted backups and regular testing of their availability and integrity. Backups accessible from compromised environments can themselves become targets.
- Protect critical data and preserve the system images, software, configurations, and documentation needed for rebuilding.
- Ensure authorized recovery personnel can obtain necessary credentials and encryption keys during an outage.
- Restore into an appropriate recovery environment and validate security before reconnecting recovered systems.
Record what was restored, how long it took, which data was recovered, and whether the business could actually use it. Have business users validate a complete workflow, such as receiving and fulfilling an order, rather than checking only that a server starts.
☐ 6. Plan Communications Before Normal Channels Fail
Maintain current contact information for employees, customers, critical suppliers, and relevant response partners. Decide who communicates, who approves messages, and which channels remain available if email or corporate identity systems fail.
Prepare adaptable message templates covering:
- What is known, what remains uncertain, and which services are affected.
- What recipients should do and where they can obtain assistance.
- When and through which channel the next update will arrive.
Avoid promises that recovery teams have not validated. Where legal, contractual, or regulatory notifications may apply, identify who assesses those obligations and coordinates the response.
The Canadian Centre for Cyber Security’s continuity guidance addresses communications planning and emergency access to the plan. Walk through the first employee and customer updates while assuming normal email is unavailable.
☐ 7. Exercise the Plan Under Realistic Constraints
Begin with a tabletop exercise: a structured discussion of how participants would handle a disruption. Then use technical recovery tests and operational walkthroughs to verify the assumptions that discussion cannot prove.
A useful scenario combines several constraints: a critical provider fails, email is unavailable, and the primary decision-maker cannot be reached. Ask participants to locate the plan, activate alternates, prioritize services, and explain their next actions.
Include business teams and important delivery partners—not only IT. A technically successful restoration can still leave operations stalled if employees lack instructions or a supplier cannot reconnect.
Choose exercise scope and frequency according to business risk, operational changes, and previous findings rather than assuming one schedule fits every organization.
☐ 8. Fix Gaps and Keep the Plan Current
After every exercise or incident, document weaknesses and assign corrective actions to named owners. Track completion and retest changes that materially affect recovery.
Update the plan when essential services, leadership, suppliers, technology, locations, or contractual obligations change. Include continuity review in relevant change-management processes so the plan does not quietly fall behind the business.
Leadership reporting should distinguish documents from demonstrated readiness. Unresolved dependencies, measured recovery results, and overdue corrective actions say more than a statement that the plan was reviewed.
A continuity plan becomes credible when people can use it under pressure—and tests produce evidence that essential operations can continue.
Start With One Essential Service
You do not need to solve every disruption at once. You do need a clear starting point and accountable follow-through.
Select one essential service, name its owner, map its dependencies, and schedule a walkthrough of how it would operate during an outage. Confirm decision authority, challenge the workaround, and identify what evidence would demonstrate recovery.
Then repeat the process across the business. The goal is not a larger continuity document. It is an organization that knows what matters, understands its dependencies, and can make sound decisions when normal operations are no longer available.