Business continuity for small business: keeping trading when something breaks

That is the whole discipline. The rest of this page is how to build one in an afternoon, and which parts are worth spending money on.

Most security advice you will find is about keeping people out. This is about the other half, and it is the half that closes businesses. The classic definition of information security has three legs: confidentiality, integrity and availability (NIST, 2026). Availability is the one nobody sells you, and it is the one you notice on a Tuesday when the internet is down and nobody can take payment.

What actually stops a small business trading

Not what you would guess from the news. In our experience the interruptions that hurt owner-operators are ordinary:

• The internet service drops and nothing can take payment.
• A laptop is stolen, dropped or simply dies, and it held the only copy of something.
• An account gets locked, and the recovery email points at a mailbox nobody can open.
• A supplier or platform has an outage, and your booking system is theirs.
• Someone deletes the wrong folder.
• Ransomware encrypts what is on the machine and the backup drive plugged into it.

Only one of those is an attack. That matters, because a plan built solely around attackers will miss five of the six. The confidentiality half of the problem - what leaks and what is exposed - is covered in our small business security guide; this page is the other leg.

The financial side is not small either. The Australian Signals Directorate puts the average self-reported cost of cybercrime for an Australian small business at $56,600 per report, up 14 per cent in a year (ASD, 2025). Ransomware featured in 11 per cent of the incidents ASD responded to.

Step one: work out what would actually hurt

Before buying anything, spend ten minutes on this. Take your busiest trading day and walk through it with three things removed in turn: the internet, the main laptop, and your phone. Write down the moment you stop.

Most owners find the same short list: taking payment, quoting, reaching customers, and getting at records. That list is what your plan protects. Everything else can wait.

Now put two numbers against each item, because they are what turn good intentions into a budget:

How long can it be down? This is your recovery time objective, or RTO - the term your IT provider and your insurer will both use. Measured in hours or days, honestly rather than aspirationally, because a four-hour target costs far more than a two-day one.

How much recent work can you afford to lose? This is your recovery point objective, or RPO. If your backup runs nightly, the answer is up to a day's work. If that is not acceptable for your accounting file, the backup schedule is wrong.

Write both down per system. Most owners discover their current setup does not meet the numbers they just chose, and that gap is the plan.

Step two: backups you have actually restored

Backing up is the most-ticked box in small business and the least-tested. A job that reports success proves the job ran. It does not prove the data can come back.

ASD's guidance is to back up regularly or automatically, and to regularly test that backups can restore systems and important data (ASD, 2026). The second half is the part that gets skipped.

Cover the right things. Think about what the business could not function without: customer records, financial records, email, calendars, quotes and job history. For most small businesses that is now spread across a cloud accounting platform, a mailbox and a laptop, which means three separate backup questions rather than one.

Know that sync is not backup. A synchronised folder faithfully mirrors your mistakes. Delete a file locally and it disappears from the cloud copy within seconds; encrypt it with ransomware and the encrypted version syncs up. Version history helps, but it is bounded, and the bound is set by your provider rather than by your needs.

Know what your platform does not do for you. Microsoft keeps Microsoft 365 running; keeping your data recoverable is a different job. Every major platform applies a retention window to deleted mailboxes and files, after which the data is genuinely gone - so a departed staff member's mailbox, or a mass deletion discovered late, may not be recoverable. The same reasoning applies to Google Workspace and to your accounting platform. Look up the actual retention period for your own plan rather than assuming it is generous; it is the number that decides whether you need a third-party backup on top.

Keep one copy out of reach. The long-standing shorthand is three copies of the data, on two different systems, with one off-site. Fire, flood and theft take everything in the building, and ransomware takes anything it can write to.

Then test it. Restoring is also the step that proves the rest of your configuration is sound, which is why it sits alongside the items in our website security checklist. Once a quarter, restore one real file and open it. Fifteen minutes. Once a year, do a fuller rehearsal: restore enough to confirm the data is complete and usable, not merely present. Adam has written about what an untested backup is really worth, and the short version is that it is a hope with a green tick next to it.

Step three: a second way onto the internet

If losing your connection stops you trading, one service is a single point of failure. The fix is a second path that does not share the first one's fate.

For a very small business, your phone may be enough. Tethering covers email, quoting and card payments for a few people. Check the data allowance, because an outage lasting days will find its limits, and practise it once so you know your equipment tethers cleanly.

A failover router is the next step, and no longer expensive. It holds a mobile SIM alongside the fixed service and switches over automatically, usually within seconds. Staff often notice only that things slowed down.

Different supplier, different technology. This is the part people get wrong. A second service from the same carrier over the same infrastructure fails at the same time as the first. Pick a mobile network that is not your fixed provider's, or you have bought one path twice.

Adam makes the case for this from the data centre side in two wires into the building: the redundancy always looked expensive until someone did the arithmetic on an hour of downtime.

Step four: the way back into your accounts

A surprising share of small business outages involve no attacker at all. The business simply cannot get in.

Multi-factor authentication is not the risk; losing the second factor is. If your authenticator app lives on one phone and that phone is gone, you have lost the second factor on every account at once. The way back is recovery codes, which most people are shown once at setup and never save.

Print recovery codes for your email, your banking and your accounting platform today, and keep them somewhere physical. Better still, enrol a second device so the single point of failure disappears entirely.

Check where your recovery email points. The address that resets everything else is the quietest master key in the building. If it points at a mailbox belonging to a former staff member, or at a domain you no longer control, that is a locked door waiting to happen.

Give the business a second administrator. Not your only other director if you travel together, and someone who has actually logged in. Add a break-glass account too: an administrator account that belongs to the business rather than a person, whose credentials live offline in an envelope, and which is never used day to day.

Adam's piece on being locked out of your own business covers what this looks like when it goes wrong, and it is more common than the attack scenarios.

Step five: write the run book

A run book is the document that lets someone who is not you get the business working again. It matters because resilience that lives only in your head fails precisely when you are unreachable.

Keep it to a few pages:

• The systems you depend on, and who the provider is for each.
• How to get in - not the passwords themselves, but where they live and who can reach them.
• The people - IT support, accountant, insurer, bank, with numbers that work outside business hours.
• The reporting steps - ReportCyber for cybercrime, and IDCARE if identity information is exposed.
• What to do first for each of the scenarios you identified in step one.

Store it somewhere reachable when the office and the main laptop are not. A printed copy in a drawer at home is not old-fashioned; it is the only copy guaranteed to work when the digital one is inside the thing that broke.

While you are at it, build an asset register: what you own, when you bought it, what you paid, and a photo. After a fire or a theft the insurer's first real question is what you lost, and memory is a poor witness on the worst morning of your year.

Step six: rehearse it, on paper, for half an hour

Every stadium, airport and data centre rehearses its bad day. Almost no small business does, and the exercise costs nothing.

Sit down with one other person, a notepad and thirty minutes. Talk through four scenarios without touching a system: the laptop is stolen overnight, the phone is destroyed, the office floods, the internet is dead for three days. Write down every point where you stall.

That list of stall points is the whole prize. Each one converts into an hour or two of unglamorous fixing, and unlike generic advice, every item is proven relevant to your business because you just watched yourself fail at it on paper. Adam's thirty-minute fire drill walks through the same exercise in detail.

Twice a year is honest. Once a year is the floor. The drill that finds nothing is not wasted time; it is the day you learn your last six months of small fixes actually worked.

What this costs

Less than owners expect, because most of it is decisions rather than purchases.

Free: the ten-minute exercise, the run book, recovery codes printed and stored, a second administrator, the asset register, the tabletop drill, and checking where your recovery email points.

Tens of dollars a month: a proper backup service for your mailbox and cloud files, with retention measured in months rather than days.

A few hundred dollars, once: a small uninterruptible power supply if a sudden power loss would corrupt equipment or stop trading, and a retired laptop kept charged and configured as a spare.

A modest monthly amount: a failover router with its own SIM, if losing connectivity stops you earning.

Run the comparison honestly. Take your loaded hourly cost, multiply it by the hours a realistic outage would consume, and put that beside the list above. For most small businesses the plan pays for itself the first time anything goes wrong, and the cheapest items on the list are the ones that fail most often.

Where to start this week

Do these four things, in this order:

1. Restore one file from your most important backup and open it. If you cannot, you have found your first real problem.
2. Print the recovery codes for your email, banking and accounting platform.
3. Check the recovery email address on your main accounts is one you control.
4. Write one page listing your systems, providers and emergency contacts.

That is an afternoon, and it moves you further than any product would. The rest - the second connection, the failover router, the fuller rehearsal - can follow once you know which gaps are real.

Continuity is not a purchase and it is not a document. It is a small set of decisions made while everything is calm, so that the bad day is something you have already thought about rather than something you are meeting for the first time.

---

Sources

• Australian Signals Directorate, Annual Cyber Threat Report 2024-25 - retrieved 6 August 2026, https://www.cyber.gov.au/about-us/view-all-content/reports-and-statistics/annual-cyber-threat-report-2024-2025
• Australian Signals Directorate, Set up and perform regular backups - retrieved 6 August 2026, https://www.cyber.gov.au/learn-basics/explore-basics/set-and-perform-regular-backups
• National Institute of Standards and Technology, Information security (CSRC glossary) - retrieved 6 August 2026, https://csrc.nist.gov/glossary/term/information_security
• Red Bridge Cyber, perspective: A Backup You Haven't Restored Is a Hope, Not a Backup
• Red Bridge Cyber, perspective: Two Wires Into the Building
• Red Bridge Cyber, perspective: Locked Out of Your Own Business
• Red Bridge Cyber, perspective: The Thirty-Minute Fire Drill