IT outages rarely happen at a convenient time. Your internet connection fails during a client deadline. Microsoft 365 becomes unavailable when your team needs shared files. A laptop is lost with important data on it. A cyber incident locks staff out of systems. A key supplier has a problem and your business feels the impact immediately.
A realistic business continuity plan helps you keep working when technology fails. It does not need to be a huge document that nobody reads. It needs to be practical, clear and based on how your business actually operates.
For many London businesses, the challenge is not knowing that continuity planning matters. It is knowing where to start. IT consultancy by Northern Star can help you build a plan that covers your people, systems, suppliers, data and recovery steps without making the process more complicated than it needs to be.
The need is real. The UK Government’s Cyber Security Breaches Survey 2025/2026 found that 43% of UK businesses identified a cyber breach or attack in the previous 12 months, equal to around 612,000 businesses. It also found that only 25% of businesses overall had a formal incident response plan in place.
Table of Contents
What is a business continuity plan for IT outages?
A business continuity plan sets out how your business will keep operating during disruption. For IT outages, this means looking at the systems, devices, connections, data and services your team depends on every day.
It should answer simple questions:
- Which systems are critical to daily operations?
- How long can you manage without each system?
- Who needs to act when something goes wrong?
- How will staff communicate if email or Teams is down?
- How will data be restored?
- Which clients, suppliers or staff need updates?
- What temporary workaround is acceptable?
The National Cyber Security Centre provides response and recovery guidance for small and medium-sized organisations, focusing on preparing a response and planning recovery from cyber incidents. The same mindset is useful for wider IT outages too.
Start with your most important business activities
Do not start with technology. Start with the work your business must continue doing.
For example, your most important activities may include responding to clients, processing orders, accessing case files, running payroll, issuing invoices, managing bookings or supporting remote staff.
Once you know what must keep running, you can identify the systems behind it. This may include Microsoft 365, line-of-business software, CRM systems, accounting platforms, phones, broadband, cloud storage, servers, laptops or payment systems.
This helps you avoid a common mistake: treating every system as equally urgent. In a real outage, you need priorities.
Set recovery time objectives
A recovery time objective, often called an RTO, is the maximum time your business can tolerate a system being unavailable.
You do not need to overcomplicate this. For each key system, ask:
- Could we manage without it for 1 hour?
- Could we manage without it for half a day?
- Could we manage without it for 1 full working day?
- Would being without it stop the business from trading?
For example, email may need to be restored within a few hours. Payroll software may be less urgent on most days, but critical near payday. Your customer portal may need a very short recovery time if clients rely on it.
This process helps you decide where to invest. Not every system needs the same level of resilience. Some may justify extra protection. Others may simply need a clear workaround.
Map the main outage scenarios
A useful continuity plan should cover the incidents most likely to affect your business. These may include:
- Internet failure at your office
- Microsoft 365 or cloud service disruption
- Cyber attack or ransomware incident
- Lost or stolen device
- Server or hardware failure
- Power cut or office access problem
- Supplier outage affecting software or connectivity
- Staff unable to access systems remotely
For each scenario, write down what happens first, who is responsible and how staff should continue working. Keep the language plain. In a stressful situation, nobody wants to search through pages of technical detail.
Check your backups properly
Backups are not the same as recovery. Having a backup is useful, but only if it covers the right data, is protected from attack and can be restored quickly enough.
You should know:
- What is backed up
- How often backups run
- Where backups are stored
- Who checks they are successful
- How long data is retained
- When the last test restore was completed
- How long a restore is likely to take
This is especially important for Microsoft 365. Many businesses assume cloud platforms remove the need for backup planning. Cloud services provide resilience, but your business still needs to think about accidental deletion, malicious changes, retention settings, user error and recovery requirements.
Create communication steps for an outage
Communication often breaks down during an IT outage. Staff do not know whether to keep trying, wait for updates or use a workaround. Clients may receive no explanation. Managers may chase different people for the same information.
Your plan should include a simple communication structure.
This may cover:
- Who confirms that an outage is happening
- Who updates staff
- Which channel is used if email is unavailable
- Who speaks to clients or suppliers
- How often updates should be sent
- What should not be shared until facts are clear
For example, you may agree that SMS, mobile calls or a pre-approved WhatsApp group will be used if email and Teams are down. The exact method matters less than making sure everyone knows it before the outage happens.
Include practical workarounds
A continuity plan should not simply say “restore the system”. It should explain how the business can keep moving while recovery is taking place.
Workarounds might include:
- Using mobile data if the office internet fails
- Redirecting calls to mobiles
- Using offline copies of critical documents
- Moving staff to remote working temporarily
- Using a secondary device for key roles
- Manually recording orders, enquiries or service requests
These workarounds should be realistic. If staff have never used them, they may not work well under pressure. Keep them simple and test them where possible.
Understand the cost of downtime
Continuity planning becomes easier when you understand the cost of disruption.
For example, if 20 employees lose 4 hours of productive time and the average employment cost is £25 per hour, the staff time alone is worth £2,000. That does not include missed sales, delayed projects, client frustration, emergency IT work or reputational damage.
You do not need a perfect calculation. You need enough of an estimate to make sensible decisions. If a system outage could cost £5,000 in lost time and disruption, spending money on better resilience may be easier to justify.
Assign clear ownership
A business continuity plan needs owners. Otherwise, it becomes a document that sits in a folder until it is out of date.
Assign responsibility for:
- Maintaining the continuity plan
- Reviewing backup reports
- Testing recovery steps
- Updating staff contact details
- Checking supplier escalation contacts
- Approving emergency spending if needed
This does not all need to sit with one person. In fact, it is better if the plan does not depend on a single individual being available.
Test the plan before you need it
A continuity plan is only useful if it works. Testing does not always need to mean a full shutdown. You can run simple exercises, such as:
- Restoring a sample file from backup
- Checking who can access the plan without the main file system
- Testing staff communication channels
- Running through a Microsoft 365 outage scenario
- Confirming supplier support numbers and escalation routes
Testing will usually reveal gaps. That is not a failure. It is the point of the exercise. It is far better to find those gaps on a quiet Friday morning than during a real outage.
Keep the plan short and current
The best continuity plan is one people can use quickly. Avoid making it so long that nobody reads it.
Review the plan whenever your business changes. This includes moving office, changing systems, adding new cloud platforms, growing your team, changing suppliers or introducing hybrid working.
At minimum, review it once a year. For fast-growing businesses, every 6 months may be more realistic.
Build IT resilience with Northern Star
A realistic business continuity plan gives your business more control when IT disruption happens. It helps your team respond calmly, protect data, communicate clearly and recover in the right order.
Northern Star can help you review your current risks, assess your backup and recovery arrangements, create practical outage plans and improve the resilience of your IT systems. Whether you are worried about cyber incidents, Microsoft 365 downtime, ageing hardware, remote access or supplier risk, you can get clear advice shaped around the way your business works.
Contact Northern Star today to create a practical business continuity plan and make sure your business is ready for the next IT outage.
