Business Continuity Checklist for SMEs
- Estimated time: 10–15 minutes
Why business continuity matters
Unexpected events can interrupt access to your systems, data, offices, employees and suppliers. Without a clear continuity plan, even a short disruption can affect your customers, productivity, revenue and reputation.
This checklist provides a straightforward way to review how prepared your organisation is to continue operating and recover from an incident.
Disclaimer: This checklist provides general guidance and should not be treated as a complete professional risk assessment.
Operational Resilience Assessment
Evaluate your business posture against critical risks. Use this checklist framework to identify vulnerabilities in your priority systems and data recovery strategies.
Critical Systems & Priorities
- You have identified the systems and services that are essential to your daily operations.
- You know which business activities must be restored first.
- You have documented acceptable downtime for critical systems.
- You understand the impact of losing access to email, files, applications and communications.
- Each critical system has an assigned owner.
- Important dependencies between systems are documented.
- You know which employees require priority access during a disruption.
- Critical customer and supplier processes have been identified.
- You have considered the financial impact of prolonged downtime.
- Your recovery priorities are reviewed when the business changes.
RECOMMENDED ACTION
Create a prioritised list of critical systems, services and business processes, including the maximum acceptable downtime for each one.
Data Backups & Recovery
- Your important business data is backed up regularly.
- Your backups are stored separately from the main business network.
- Your Microsoft 365 or Google Workspace data has an appropriate backup solution.
- Your backup data is encrypted.
- Access to your backup systems is restricted.
- Your backup failures generate alerts.
- You regularly test that files can be restored.
- You know how long a full recovery would take.
- At least one backup copy is protected from ransomware or accidental deletion.
- Your backup retention periods meet your operational requirements.
- Your important cloud applications are included in your backup planning.
- Your recovery instructions are documented and accessible.
Test a sample restoration regularly. A backup should not be considered reliable until data has been successfully recovered.
IT Outages & Cyber Incident Response
Assess your organization’s preparation for technical disruptions and digital security threats. Ensure you have the protocols to protect critical systems and maintain control during unexpected incidents.
Category 3: IT Outages and System Recovery
- You have a documented process for reporting a major IT outage.
- You know how to contact your IT provider outside normal business hours.
- Responsibilities during an IT incident are clearly assigned.
- Recovery procedures exist for your critical servers, devices and cloud services.
- Your important licences, credentials and configuration details are securely documented.
- Replacement equipment can be obtained within an acceptable timeframe.
- Internet connectivity has been considered in your continuity planning.
- Alternative connectivity options are available where necessary.
- You know how your employees will work if key systems are unavailable.
- Recovery progress can be communicated to management and employees.
- You have considered how to operate manually during a system outage.
- Technical recovery procedures are reviewed after major system changes.
RECOMMENDED ACTION
Document who should be contacted, which systems should be restored first and how the business will operate while recovery is taking place.
Category 4: Cyber Incident and Ransomware Response
- You have a documented cyber incident response plan.
- Your employees know how to report suspected phishing, malware or account compromise.
- You know who has authority to make decisions during a cyber incident.
- You have procedures for isolating affected devices.
- Important emergency contact details are available outside your main IT systems.
- Your administrator and cloud accounts are protected with multi-factor authentication.
- You know how to contact your cyber insurer where applicable.
- You have considered when legal, regulatory or customer notifications may be required.
- Your backups are protected from being altered or deleted by an attacker.
- You have a process for preserving evidence after an incident.
- Your employees are told not to investigate serious incidents themselves.
- A ransomware or account-compromise scenario has been discussed with management.
RECOMMENDED ACTION
Run a tabletop exercise based on a ransomware attack, compromised email account or loss of access to Microsoft 365.
Operational Resilience & Incident Communications
Verify your readiness in managing distributed team operations and maintaining critical contact when standard channels fail. Align your practices against these essential categories.
Category 5: Staff, Remote Working and Alternative Locations
- Your employees know what to do if the normal workplace is unavailable.
- Your remote-working arrangements are documented.
- Your employees have secure access to essential systems from alternative locations.
- Your company devices are configured for secure remote working.
- Multi-factor authentication protects your remote access.
- Key responsibilities have more than one trained employee.
- Deputies are identified for your essential roles.
- Your staff contact information is kept up to date.
- You have considered how to support employees during prolonged disruption.
- Your personal devices are controlled through an appropriate company policy.
- Your employees understand how business communications will be distributed.
- Alternative meeting and collaboration methods are available.
RECOMMENDED ACTION
Ensure key employees can securely access essential systems from an alternative location and that important roles have trained deputies.
Category 6: Communications During an Incident
- You have an up-to-date employee contact list.
- Emergency contact details are accessible if your company systems are unavailable.
- You have a process for informing employees about an incident.
- You know who is responsible for communicating with customers.
- You have prepared basic customer and supplier communication templates.
- Alternative email or messaging methods have been considered.
- Your important phone numbers are documented.
- Your employees know where to find official updates.
- External communications require appropriate approval.
- You have considered how to manage website or social media updates.
- Communication responsibilities are clearly assigned.
- Sensitive incident information is only shared with authorised people.
RECOMMENDED ACTION
Keep essential contact information and communication templates available outside your normal business systems.
SUPPLIERS & GOVERNANCE
Business Continuity Checklist — Part 4
CATEGORY 7: SUPPLIERS AND THIRD-PARTY SERVICES
- You have identified suppliers that are essential to your operations.
- Contact details for critical suppliers are documented.
- You understand how a supplier outage would affect your business.
- Alternative suppliers have been considered where practical.
- Important cloud and software providers are included in your continuity plan.
- Service-level agreements have been reviewed.
- Supplier support and escalation procedures are documented.
- You know how to access your data if a supplier becomes unavailable.
- Third-party access to your systems is reviewed regularly.
- Important suppliers are asked about their own continuity arrangements.
- Contract renewal and licence information is documented.
- A process exists for managing the failure of a critical supplier.
RECOMMENDED ACTION
Identify the suppliers whose failure would stop your business operating and document an alternative or escalation process for each one.
CATEGORY 8: DOCUMENTATION, TESTING AND REVIEW
- Your business continuity plan is documented.
- Your plan includes clear roles and responsibilities.
- Copies of your plan are available outside the main business network.
- Your plan contains current employee, supplier and emergency contact details.
- Your recovery procedures are written in clear, practical language.
- Your plan is reviewed at least annually.
- Your plan is updated after major technology or staffing changes.
- Business continuity exercises are carried out regularly.
- Lessons from incidents and tests are documented.
- Your employees understand their responsibilities.
- Your management has approved the continuity plan.
- The date of your next review is recorded.
RECOMMENDED ACTION
Test the plan at least annually and after significant changes to your systems, suppliers, premises or staffing.
How prepared is your business?
IMPROVEMENTS NEEDED
Some important continuity arrangements may be missing or incomplete. Prioritise recovery planning, backup testing, communication procedures and clearly assigned responsibilities.
URGENT REVIEW RECOMMENDED
A large number of unchecked items may indicate that your business would struggle to operate or recover during a serious disruption. Consider arranging a professional continuity and IT resilience review.
STRONG FOUNDATION
You have many important continuity controls in place. Continue testing your arrangements and update the plan whenever your systems or business operations change.
Note: This checklist is an initial self-assessment and does not confirm that an organisation is fully prepared for every possible disruption.
Six actions to prioritise
Identify critical operations
Document the systems, people, suppliers and processes your business cannot operate without.
Set recovery priorities
Decide which systems must be restored first and how much downtime is acceptable.
Verify your backups
Confirm that your critical data is protected and can be successfully restored.
Document responsibilities
Make it clear who will make decisions, contact suppliers and communicate with employees and customers.
Prepare alternative working arrangements
Ensure your employees can continue essential work if the office or main systems are unavailable.
Test the plan
Run a realistic exercise and record any weaknesses or improvements.
What to do when disruption occurs
Follow this structured five-step timeline to guide your team’s immediate response and ensure business continuity.
Assess the situation
Confirm what has happened, which systems are affected and whether the incident is still developing.
Protect people & systems
Take immediate steps to protect your employees, data, devices and business operations.
Activate the plan
Contact the responsible people and begin your documented recovery process.
Communicate clearly
Provide accurate updates to your employees, customers, suppliers and other relevant parties.
Recover and review
Restore your priority services, record what happened and update your continuity plan with lessons learned.
Ready to take the next step?
Now that you’ve completed the checklist, it’s time to move forward. Take action today and see how we can help you achieve your goals. Don’t hesitate to reach out if you have any questions!
VSG delivers dependable IT and security services designed for real-world businesses. We reduce risk, improve performance, and give you peace of mind with support you can trust.
Registered in the United Kingdom and Wales
Company Number: 16072925
D-U-N-S Number: 232653775