A power failure, flooded access road, missing supplier or cyber incident can stop a business long before its building is damaged. The same disruption may affect staff, deliveries, payment systems and customers at once.
A useful business continuity plan explains which services matter most, when it is safe to stop work, and how essential functions can resume. For sustainability, the practical questions include preventing avoidable stock losses, protecting equipment and supporting people who cannot simply switch to working from home.
The plan does not need to predict every emergency. It needs to give people workable choices when normal arrangements fail.
1. Protect people and establish safe shutdowns
Start with the conditions under which work must pause. Decide who can close a site, how visitors and staff will receive instructions, where people should gather, and who checks that everyone has been accounted for. Include assistance for people who may need accessible routes or additional communication support.
Security measures should follow the premises’ actual risks. At a venue where professional assessment identifies a need to screen for metallic weapons, equipment such as CEIA OPENGATE may form one part of the arrangements. GXC describes its two independent pillars as using electromagnetic fields to analyse metal signatures as people pass through. That is a supplier description of a screening tool, not evidence that equipment alone prevents incidents or makes a site safe.
Any screening arrangement still needs trained operators, a response to alerts, accessible entry routes and clear emergency exits. It should not divert attention from fire, extreme weather, medical emergencies or the risks specific to the workplace.
For a broader framework, OSHA’s emergency-action guidance covers evacuation conditions, authority to order shutdowns, routes, assistance and accounting for workers. Requirements vary by jurisdiction and workplace; use the rules and emergency arrangements that apply locally.
Separate emergency response from business recovery. A person authorised to restart a booking system is not automatically qualified to decide that flood-damaged electrical equipment can be used. Record who gives each type of clearance.
2. Map essential services and their dependencies
List what the business must keep doing, then identify what each function depends on. A café may need safe refrigeration, water and a way to take payment. A repair workshop may need customer records, particular parts and a technician with a specific qualification. A care provider may need reliable transport and time-critical communication.
Ready Business’s continuity-plan template distinguishes recovery-time objectives from recovery-point objectives. The first concerns when a function needs to resume. The second concerns the point to which data must be restored, and therefore how much recent information could be lost.
Use those distinctions to make a short working table. The example below is illustrative; set the priorities for your own operations.
| Essential function | Dependency | Fallback to test | Who decides? |
|---|---|---|---|
| Customer communication | Main phone and internet | Alternative number and offline contact list | Duty manager |
| Order fulfilment | Supplier and delivery route | Approved substitute or revised delivery promise | Operations lead |
| Access to records | Software, credentials and power | Restored backup and essential offline procedures | Authorised IT contact |
| Safe premises | Utilities, access and qualified assessment | Temporary closure or suitable alternative site | Named site decision-maker |
Look for shared points of failure. Two internet connections may still depend on the same local infrastructure. Two suppliers may rely on the same transport corridor. A backup stored beside the main equipment may be exposed to the same fire or flood.
The Ready Business hurricane toolkit offers a useful dependency check across utilities, systems, access, people and suppliers. Even where hurricanes are not the local hazard, those categories can help structure a location-specific assessment.
Include heat, storm and water-related disruption where relevant. Review stock that can spoil, equipment that needs a controlled shutdown and materials that require secure containment. These are operational decisions with environmental consequences, rather than a separate sustainability appendix.
3. Give teams usable alternatives
A plan cannot depend on one person remembering everything. Name a primary contact and a deputy for each essential role, and document the minimum information either person would need.
Keep instructions short enough to use during an interruption. A one-page contact sheet, clear shutdown checklist and tested restoration procedure may be more useful than a long policy document nobody can open without the office network.
- Communications: choose an alternative channel and decide how staff will recognise an authentic instruction.
- Responsibilities: cross-train people for critical tasks within their competence and authority.
- Records: restrict sensitive information to authorised people while ensuring the required access can survive the disruption.
- Customers and suppliers: prepare a way to explain delays without promising a recovery time the team cannot support.
For digital recovery, a backup existing somewhere is not enough. CISA’s StopRansomware Guide recommends offline, encrypted backups of critical data and regular testing of their availability and integrity. A constantly synchronised copy can reproduce damaged or encrypted files; understand how your system retains recoverable versions.
Practical support for staff also matters. Ask what happens if public transport stops, schools close or someone’s home is affected. Define a minimum safe service level instead of assuming every employee can compensate for a disrupted workplace with unpaid flexibility.
4. Test recovery against realistic constraints
Choose a manageable scenario and walk through the first hour. For example: the site is inaccessible, the main manager is unavailable and the usual customer system cannot be reached. Who discovers the problem? Who makes the first decision? Which information is missing?
Then test a real recovery action. Restore a sample of records in an appropriate test environment, use the backup contact route, or ask the deputy to follow a documented procedure. Record the time taken and the obstacles encountered.
A useful exercise can reveal that a password is held by one person, a supplier’s emergency number is out of date, or an alternative location cannot accommodate a worker’s access needs. Those findings are reasons to improve the plan, not to conceal the test result.
Review the plan after exercises, incidents and significant changes to premises, systems, staffing or suppliers. Give each corrective action an owner and a completion date. The next test should establish whether the correction actually worked.
Avoid treating every backup purchase as an environmental improvement. Extra equipment and inventory have costs of their own. Start with maintenance, repair, safe stock rotation and alternatives that meet the recovery need. Our discussion of resilience in the industrial landscape explores why reliable operations and resource decisions need to be considered together.
What should the finished plan contain?
- Essential functions, their dependencies and agreed recovery priorities.
- Clear authority for emergency action, shutdown and restart.
- Named contacts and deputies, with accessible communication arrangements.
- Recovery procedures, backup locations and the permissions needed to use them.
- A record of exercises, unresolved gaps and review dates.
For energy-related investments, distinguish everyday efficiency from what will actually function during an outage. The wider questions raised in our guide to the green power boom are relevant here: equipment choices need to match the service being delivered.
Begin with one essential function. Identify its most important dependency, choose a fallback, and test it. A modest plan that people can carry out is a stronger foundation than an ambitious document built on untested assumptions.
Photo by ThisisEngineering / Unsplash.