The first seven parts of this series built the pieces; the last one fits them on a single page that tells anyone in the business who does what, who to call and what to say when the website, email, payments or data stop working.
Eight Nights · Part 8 of 8 · See the full series
Advertisement
Why one page is enough to start
Ready.gov’s business continuity plan template is thorough, covering the continuity team, a business impact analysis, recovery strategies, manual workarounds, incident management, training, testing and maintenance, and Ready.gov advises building an IT disaster recovery plan alongside it. That is the destination. A business with a handful of employees can start with a single page that someone can follow on a bad morning.
The Small Business Administration’s Business Resilience Guide points at the same core: document the operations that matter and the systems behind them, build relationships with key vendors, protect data with backups and cybersecurity, and plan for cash flow. The page below has five blocks (costs, roles, contacts, first steps and messages) plus a review date.
Start with what an outage costs
Ready.gov describes a business impact analysis as a way to predict the consequences of a disruption. The impacts it lists include lost sales and income, increased expenses such as overtime and outsourcing, regulatory fines, contractual penalties and customers who leave. Timing matters too: Ready.gov notes that when a disruption happens can significantly affect the loss, and it advises restoring the processes with the greatest operational and financial impact first.
Two terms from the Ready.gov template are worth putting in plain words. A recovery time objective is how long a process or system can be down before the damage becomes unacceptable. A recovery point objective is how much recent data the business can afford to lose, which is set by how often backups run (Part 2 of this series). Writing both down for the website, email, payments and accounting tells everyone what “urgent” means.
The calculator below uses the business’s own figures rather than industry averages: typical revenue per hour times hours down, plus one-time recovery costs such as emergency developer time or overtime.
Advertisement
Roles, and a backup for every role
Ready.gov’s template asks businesses to define team members’ roles and responsibilities, lines of authority and who takes over when a leader is unavailable. On one page, that becomes four lines, each with a named person and a named backup:
- Incident lead: decides what happens next and approves customer messages.
- Website and email: contacts the host, registrar or web developer and starts restores.
- Money: runs the backup payment method from Part 3 and talks to the bank and processor.
- Customers and staff: posts updates to listings and social media (Part 5) and answers the phone.
The SBA’s emergency tips say staff need to know whom to contact and how, and suggest setting up a phone tree in advance. Personal mobile numbers belong on the page, because company phones and email may be what failed.
The contact sheet
Ready.gov’s template includes a vendor table with company, contact name and both emergency and business phone numbers. For an online operation, list the registrar, web host, web developer, email provider, payment processor, bank, IT support and insurance agent. Next to each, note where the login and any support PIN live: the company password manager from Part 1, never the page itself.
Ready.gov’s crisis communications guidance says contact lists should be compiled in advance, accessible during an incident, updated regularly and secured. Keep a printed copy in the office and a copy stored outside the company’s own systems. A plan saved only in the email account is no help when email is down.
First steps for the four common failures
Website down
Check from a phone on cellular data to rule out the office connection. Confirm the domain has not expired (Part 1), then call the host with the account PIN ready. Post a notice on the Google Business Profile and social accounts. If the site was hacked or corrupted, restore from a tested backup (Part 2).
Email down
Switch staff to the phone tree or a group text. Check that the domain renewed and its email settings match the DNS records from Part 1, then contact the provider. If an account may have been taken over, the FTC’s first steps are to change the compromised passwords and disconnect affected devices from the network (Part 6).
Payments down
Move to the backup method from Part 3, such as payment links or invoices, and tell customers at the counter and online what still works. Follow Part 3’s card-handling rules rather than improvising.
Data loss or breach
The FTC’s Data Breach Response guide says to mobilize the response team, take affected equipment offline without turning machines off until forensic experts arrive, and preserve evidence. It also says to check state and federal laws and notify law enforcement, affected businesses and affected individuals as required. If money was sent because of a fraudulent request, the FBI’s Internet Crime Complaint Center advises contacting the bank immediately to ask for a recall and filing a complaint at ic3.gov.
Messages written before they are needed
Ready.gov’s crisis communications guidance names the audiences that will want information: employees, customers, suppliers, management, and government officials or regulators. It recommends pre-scripting messages “as templates with blanks to be filled in” when details are known. Two templates cover most small business outages:
Customers: “We’re having a problem with [our website / card payments / email] as of [time]. You can still [call us at ___ / pay by ___ / visit us at ___]. We’ll post an update by [time] at [where].”
Staff: “[System] is down as of [time]. [Name] is leading the response. Until further notice, [workaround]. Send questions to [name] at [personal phone], not by company email.”
Review it on a schedule
Ready.gov’s template calls for a schedule, triggers and assignments for periodic review, plus training, orientations, tabletop drills and full-scale exercises. For a small business, a workable rhythm is a quarterly review, an immediate update whenever a person, vendor or account changes, and an annual tabletop run: the site goes down at 10 a.m. on a busy Saturday, and the team talks through each step. The template also recommends one master copy kept by the team leader.
The Fenway Web Take
A continuity plan fails in two predictable ways: it cannot be found when the systems it describes are down, or the names on it have changed. Fenway Web’s view is that the page should be printed, dated, signed by the incident lead and reviewed every quarter. Each part of this series feeds one line of it. Fenway Web offers clients a free continuity review.
Tonight’s checklist
- Name an incident lead and a backup.
- List every vendor with a support phone number and where its login and PIN are stored.
- Write the first three steps for site down, email down, payments down and data loss.
- Draft one customer message and one staff message with blanks.
- Run the downtime calculator with real numbers.
- Print the page and store a copy outside company systems.
- Put a quarterly review on the calendar.
What it means for you
- A one-page plan that people can find beats a thorough plan nobody can open during an outage.
- Every role needs a named backup and a phone number that does not depend on company systems.
- Prepared messages save the most time when customers are asking questions.
- Using real revenue figures shows which systems deserve investment first.
Test yourself
1. What is a recovery point objective, in plain words?
Answer: How much recent data the business can afford to lose, which depends on how often backups run.
2. After a suspected data breach, should affected computers be switched off?
Answer: No; the FTC says to take affected equipment offline but not to turn machines off until forensic experts arrive.
3. Which business processes does Ready.gov say should be restored first?
Answer: Those with the greatest operational and financial impact.
4. Why keep a printed copy of the plan?
Answer: A plan stored only in email or on the website is out of reach when those systems fail.
Discussion
- If the owner were unreachable for a day, who would lead the response, and do they know it?
- Which system would cost the most per hour if it failed: the website, email, payments or accounting?
- What is the one message customers most need to hear in the first hour of an outage?
From the network
- Boston Made Reader — every story from the family in one free reading app.
- Fenway Web — the web design and care studio of Boston Made, Inc.
- Boston Made — the company behind the Boston Made family.