Red Bridge CyberRed Bridge Cyber
Customer Login
What We CheckHow It WorksFree CheckPricingResearchAboutBlogCustomer Login
Security2026-11-09·10 min read

What goes in a business continuity plan for a small business?

Four things: what would stop you trading, who you would call, the way back into each system, and how you keep taking money. Three or four pages, not a binder.

RBBy the Red Bridge Cyber team

Four things: a list of what would stop you trading, the people and numbers you would need to reach, the way back into every system you depend on, and how you would keep taking money while the usual way is broken. For a business of 1 to 30 staff that is three or four pages. Everything else in a downloaded template is optional, and the optional parts are the reason most plans get written once and never opened again.

What goes in a business continuity plan for a small business?

Four things: a list of what would stop you trading, the people and numbers you would need to reach, the way back into every system you depend on, and how you would keep taking money while the usual way is broken. For a business of 1 to 30 staff that is three or four pages. Everything else in a downloaded template is optional, and the optional parts are the reason most plans get written once and never opened again.

That is not an argument against templates. The Australian ones are good, published at no cost by state and federal agencies, written by people who have watched businesses through floods and fires. It is an argument about which pages you fill in. A plan that answers those four questions and lives somewhere you can reach on a bad day beats a forty-page document that satisfies an auditor and sits in a folder on the laptop that just got stolen.

This page is the contents list. The build order, the two recovery numbers and what each part costs are on the parent page: business continuity for a small business.

The four sections that earn their place

Write these, in this order, and stop:

  • What would stop you trading. Not a risk register. A short list of the things you cannot serve a customer without: taking payment, quoting, reaching customers, getting at records. Then the four or five ordinary events that break them - the internet drops, a laptop dies, an account locks, a platform you rent has an outage, someone deletes the wrong folder. Six lines is plenty. This section is the whole reason the rest exists, and it is the one the long templates bury on page eleven.
  • Who you would call. Names, mobile numbers and account references for the people who can actually change something: your internet provider, whoever hosts your website and email, your bookkeeper, your insurer, your bank's business line, and the one staff member who knows where things are. Include your own customers if you have a handful who need to hear from you directly. Phone numbers, not links, because the version of this you need is the one you can read on a borrowed phone.
  • The way back into each system. For every account the business cannot trade without: who owns it, what the recovery email address is, where the recovery codes are, and who else can get in if you cannot. This is the section that quietly goes stale, because nothing in it breaks visibly until you need it. A recovery address pointing at a mailbox nobody has opened since 2019 is a locked door with your own name on it.
  • How you keep taking money. The manual fallback. A card reader that runs on mobile data instead of the shop internet. An invoice you can raise from a phone. A second way to give a customer your bank details that is not the quoting system that is currently down. Businesses survive a bad week if revenue keeps arriving; they do not survive a bad week where it stops.

A fifth section is worth adding once the first four exist: what you tell customers, and who says it. One paragraph and a name.

Notice what is not on the list. No threat modelling. No impact matrix. No appendix of definitions. If you want the one-line version to hand to a staff member, we have it at what is a business continuity plan.

Common variations: the plan changes shape with the business

The four headings hold. What goes under them moves a lot depending on how you trade.

A shop or a cafe is a connectivity and payments problem before it is anything else. The plan is mostly about the till: a mobile-data backup for the card reader, and a written price list that does not depend on a screen. It also has to record that your payments provider and your internet provider are two different phone calls.

A trade or a mobile service business carries its office in a ute. The single points of failure are the phone and the laptop, not the premises, so the plan leans hard on the recovery-codes section. A stolen phone can lock you out of the multi-factor codes for every account you own, which is a continuity event even though nothing was attacked.

A services business that lives entirely in cloud tools has the opposite shape. Nothing is on your hardware, so a fire is survivable and an account lockout is close to fatal. Your plan is a list of tenancies, who administers each one, and what happens if the administrator is the person who is unreachable.

Anyone with staff needs one line the sole traders do not: who decides. If the owner is uncontactable, name the person who can authorise spending money, calling the insurer and telling customers. Hesitation costs a plan as much as a missing phone number does.

The two numbers that size all of this - how long you can be down, and how much recent work you can afford to lose - belong next to each critical system. They are the recovery time and recovery point objectives, explained plainly at what are RTO and RPO.

What an external check would have told you about this

Nothing, and it is worth being clear about why.

Run your domain through a third-party checker like MXToolbox and you get an accurate picture of your public surface as it stands. Which mail servers answer for you, whether your email authentication records are present, whether your certificate is valid. What it cannot tell you is whether you could still take an order tomorrow if that mail provider went down. It measures the present state of a live service, not your ability to recover from its absence.

The same limit applies to our own scan, and we would rather say so plainly than let it be assumed. Red Bridge Cyber measures public-facing posture - domains, email authentication, certificates, web security configuration - continuously. It does not test your backups, it cannot see your recovery codes, and it has no view of whether you can keep trading. Continuity is not an externally observable property, and nobody sells a scanner for it.

There is one genuinely continuity-useful thing an external lookup gives you, though. An MX lookup tells you who actually runs your email, which is frequently not who you think it is, and the same goes for the name servers answering for your domain and the host serving your website. Half the "who would I call" section can be filled in from a five-minute lookup, and it beats the version in your memory.

If the answer feels like it should be paying someone to watch your systems around the clock, that is a different product with a different job, and at this size it is usually the wrong one. We work through it at do I need an MSSP.

The small-business version: what to write this afternoon

Start from an Australian template and delete aggressively. The Commonwealth's emergency management plan template on business.gov.au comes in three parts - a continuity plan, an emergency action plan and a recovery plan - and the first part maps almost exactly onto the four sections above. Several states publish their own, including the Small Business Development Corporation's business continuity plan template in Western Australia. Pick one, fill in what applies to a business your size, and leave the sections on security guards and evacuation floor plans blank if you work from a home office. An honest blank beats invented content.

Then do the four things that make the document real:

  1. Restore one file from your most important backup and open it. A plan that assumes working backups is built on an untested assumption, and the little green ticks in the backup log are not evidence. Set a rhythm with how often should I test my backups.
  2. Check every recovery email address on the accounts you listed. Fix the dead ones now, while you are calm and logged in.
  3. Print it. Two copies, one at home. A plan that exists only on the device you are trying to recover is not a plan. Same discipline as a run book: Write the Run Book Before You Need It.
  4. Put a date on it and a reminder to re-read it in twelve months. The Small Business Cyber Security Guide from the Australian Signals Directorate's Australian Cyber Security Centre treats regular backups and tested recovery as basic measures, not advanced ones.

That is an afternoon, and for most Australian small businesses it is the entire job.

When a few pages isn't enough

Four sections and an afternoon covers the ordinary bad day. Three situations need more.

Something in a contract requires it. Tenders, enterprise customers and some insurers ask for a documented plan with defined recovery objectives and evidence it has been tested. That is a compliance artefact as well as an operational one, and it needs the formal headings the short version skips. Insurance in particular arrives with control expectations attached, which we cover in do I need cyber insurance.

Personal information is involved. If an outage is also a breach, getting back online is half the obligation. Under the Notifiable Data Breaches scheme run by the Office of the Australian Information Commissioner (OAIC), an organisation that suspects an eligible data breach "must quickly assess the incident to determine if it is likely to result in serious harm to any individual" (OAIC, 2026). Whether the scheme reaches you is not purely a question of size: most businesses under $3 million annual turnover sit outside the Privacy Act, but health service providers and several other categories are covered regardless (OAIC, 2026). Check before you need to know. Responding is a separate document from continuing - see do I need an incident response plan.

You are already in the middle of one. If systems are down now and there is no plan to reach for, the ACSC publishes Business Continuity in a Box, built with contributions from CISA in the United States. It helps organisations "swiftly and securely stand up critical business functions during or following a cyber security incident", covering interim email and interim access to business-critical applications. The ACSC is candid that it is not a substitute: "Whilst a Business Continuity Plan (BCP) remains the most effective way for organisations to achieve business continuity, BCPs are not always developed, updated or regularly tested."

Which is the honest summary of the whole subject. The document is not the point. The four answers are, and you can write them down before the kettle boils.

Sources

#security#australian-business#small-business

Continue Reading

View All Articles →
Security11 min read

Business continuity for small business: keeping trading when something breaks

A business continuity plan for a small business is a few pages, not a binder. What to protect, how to test your backups, and how to get a second way online.

2026-10-06
Security8 min read

Website security checklist for Australian small business: 7 things to verify yourself

The 7-point website security checklist for Australian small business owners: what each item is in plain English, how to check it free, and what good looks like - no penetration test required.

2026-08-11
Security7 min read

SMB1001 vs Essential Eight: which to start with

The Essential Eight is what to do; SMB1001 is how to prove you did it. Start with the Essential Eight basics, certify with SMB1001 when someone asks for proof.

2026-07-13
Security5 min read

The Essential Eight Is Being Retired: What ASD’s New “Essentials” Means for Small Business

ASD will retire the Essential Eight within two years and replace it with the “Essentials” series. What the change means for Australian small business - and why the basics still matter.

2026-06-29
Security7 min read

Do I need cyber insurance for my small business?

Often yes - invoice fraud is the loss most likely to hit a small business, and insurance can cover it. But insurers expect the basics first, and the exclusions matter.

2026-08-26
Security7 min read

SMB1001 certification in Australia: the tiers, the costs, and what the certificate actually proves

Australia's small-business cybersecurity certification, tier by tier: what Bronze through Diamond require, what each costs, the self-attested vs audited split, and what to check before a director signs.

2026-06-13