Cyberattack Continuity Plan: Protect Your Business

Defining the Scope: Backups vs. Continuity Planning

Many business owners assume that having a cloud backup service is the same as having a disaster recovery plan. It is not. These are two distinct concepts that serve different purposes. A backup is a technical safety net for data; a continuity plan is an operational strategy for keeping your business alive when that data or the systems accessing it are unavailable.

To avoid confusion, it helps to define the terms clearly:

• Backup: The process of copying data to a separate location so it can be restored if deleted or corrupted.
• Disaster Recovery (DR): The technical process of restoring IT infrastructure (servers, networks, software) to a working state.
• Business Continuity Plan (BCP): The operational strategy that ensures your business can continue serving customers, processing payments, and maintaining staff operations even while IT is being restored.

The key difference lies in scope and timing. Backups focus on data integrity. Continuity focuses on business function. A cyberattack does not always involve data theft or deletion. Often, the goal is disruption. Attackers may lock you out of your systems, corrupt configuration files, or disable essential services without touching your actual data. In these scenarios, your backups are intact and safe, but your business is paralyzed because you cannot access the tools required to operate.

Consider a restaurant whose reservation system is locked out by a ransomware attack. The data in the backup is safe, but the restaurant cannot take new bookings, check in guests, or process payments through the digital interface. Without a pre‑defined continuity plan, the business faces unstructured downtime. Staff may wait for IT support to resolve the issue, customers may call repeatedly for updates, and revenue stops flowing. The cost of this downtime is not just lost sales; it is the erosion of customer trust. When a business cannot fulfill its basic promises due to a technical failure, customers often seek alternatives. A continuity plan ensures that when the unexpected happens, your response is fast, organized, and customer‑centric, rather than reactive and chaotic.

---

Identifying Critical Systems and Prioritizing Risks

To build an effective continuity plan, you must first map out which systems are non‑negotiable for your daily operations. This process involves identifying your “critical assets” and understanding where you have no alternative. Not all businesses use the same tools. A B2B manufacturer may rely on ERP software and logistics platforms, while a retail shop relies on POS and e‑commerce.

Start by listing the tools your business cannot function without. For many service and retail businesses, this often includes:

• Point of Sale (POS) Systems: The primary method for processing transactions.
• Inventory or Management Software: Tools that track stock, appointments, or patient records.
• Communication Channels: Email, phone systems, and customer‑facing platforms.
• Payment Processors: The gateway services that handle credit and debit card transactions.
• Website and Booking Engines: If you rely on online bookings or e‑commerce, these are critical lifelines.

Once you have this list, identify your “single points of failure.” These are vendors or services where a disruption stops your business completely. For example, a business that relies exclusively on a single cloud‑based reservation system may lose the ability to accept new bookings if that provider experiences an outage. Likewise, a clinic that depends on a single electronic health record (EHR) platform could be unable to view patient histories or schedule appointments if the platform becomes unavailable.

It is important to recognize that relying on a single vendor for multiple functions increases your risk. If you use one provider for both your website hosting and your email, a security breach affecting that provider could take down both services simultaneously. When evaluating your technology stack, consider whether you have redundant options. If your primary POS system is down, do you have a backup terminal or a manual process ready?

Do not assume that because a system is cloud‑based, it is immune to issues. Cloud providers can experience outages, and they can also become targets for cyberattacks. Your continuity plan must account for the possibility that your primary digital infrastructure may be unavailable for hours, days, or even weeks.

Prioritization Framework

Not all systems carry the same risk. Use a simple High/Medium/Low impact scoring method to prioritize your efforts. This prevents you from spending equal time on low‑risk tasks.

Focus your manual workarounds and testing on the “Critical” and “High” priority items first.

---

Building Your Response Protocol: The First 24 Hours

When a cyberattack or major outage occurs, the first 24 hours are critical. Panic leads to poor decisions, which can worsen the situation. You need a predefined response protocol that tells your team exactly what to do, who is responsible, and how to communicate.

Immediate Actions Checklist

Create a simple, one‑page checklist for your staff to follow immediately upon discovering a security incident or system failure:

1. Isolate Affected Devices: Disconnect computers, tablets, or IoT devices from the network if they are suspected of being compromised. Follow guidance from your IT or security provider before powering off devices.
2. Preserve Evidence: Do not delete logs or restart systems without direction from your IT provider. Screenshots of error messages or unusual activity can be vital for forensic analysis.
3. Notify Key Personnel: Alert your designated incident commander (usually the owner or manager) and your IT support provider immediately.
4. Activate Communication Plan: Begin drafting messages for staff and customers using pre‑approved templates.

Defining Roles and Responsibilities

Ambiguity during a crisis is dangerous. Assign specific roles before an incident occurs:

• Incident Commander: The person who makes high‑level decisions, such as whether to shut down systems entirely or switch to manual mode. This should be a senior leader who understands the business impact.
• Communications Lead: The person responsible for drafting and sending updates to customers, staff, and partners. They ensure the message is calm, consistent, and accurate.
• Technical Liaison: The person who works directly with IT vendors and cyber‑insurance providers. They manage the technical details and keep the Incident Commander updated.
• Customer Care Lead: The person who handles incoming calls and inquiries, using the communication templates provided.

Communication Templates

Having pre‑written templates saves time and ensures consistency. Avoid speculation. Stick to the facts and the next steps.

For Customers:

“We are currently experiencing technical difficulties with our [booking/payment] system. We are working to resolve this issue as quickly as possible. We apologize for the inconvenience. We will update you by [time] with more information. Thank you for your patience.”

For Staff:

“We have identified a security issue affecting our [system]. Please stop using [specific device/software] immediately. Do not attempt to reset passwords or restart devices. Await further instructions from [Incident Commander] before resuming work. If you are in the customer‑facing area, use the following script: [insert script].”

Clear, calm communication helps maintain trust. Customers are more likely to stay loyal if they feel informed and respected during a disruption.

---

Manual Workarounds and Offline Procedures

Digital systems are convenient, but they are not always reliable. A robust continuity plan includes “low‑tech” alternatives for your core transactions. These manual procedures allow your business to continue operating, albeit at a reduced capacity, when digital tools fail.

Core Manual Alternatives

• Transactions: If your POS is down, have a system for recording sales manually. This could be a paper ledger, a notepad, or a simple spreadsheet on a standalone device that is not connected to the compromised network. Ensure you have blank invoices and receipts ready.
• Payments: If card processing is offline, consider accepting cash only. Have a plan for handling cash securely and reconciling it later. Some businesses may have backup terminals that operate offline, but do not rely on this without testing.
• Communication: If email and phone systems are down, keep a physical list of contact numbers for key clients and suppliers. Use personal mobile phones to send SMS or make calls.
• Scheduling and Appointments: For clinics or salons, keep a physical calendar or whiteboard to manage appointments manually. Staff can note down bookings and confirm them via phone.

For healthcare providers, follow your organization’s standard procedures for temporary offline record keeping and ensure a secure transition back to digital systems.

Testing Your Manual Processes

A manual workaround is only useful if your staff knows how to use it. It is not enough to have paper forms in a drawer; your team must be comfortable using them under pressure.

Quarterly Checklist for Manual Procedures:

1. Inventory Check: Ensure you have sufficient stock of paper invoices, receipts, and blank forms.
2. Staff Training: Conduct a brief session (15–20 minutes) where staff practice recording a transaction manually. This includes writing out an invoice, calculating totals, and recording the payment method.
3. Communication Drill: Practice sending a manual update to a test group of customers using the pre‑approved templates.
4. Review and Update: Note any bottlenecks or confusion during the drill. For example, did staff struggle to find the manual ledger? Was the phone list outdated?

Example: Retail Shop Scenario
Imagine a retail shop whose POS system is compromised. The manager activates the manual procedure. Staff switch to a physical ledger to record sales. They accept cash only, as the card terminal is offline. The manager posts a sign at the entrance: “We are experiencing technical issues. Please allow extra time for checkout. We are accepting cash only.” This transparency manages customer expectations and reduces frustration.

By regularly testing these offline procedures, you ensure that your business can survive a digital outage without complete paralysis.

---

Testing, Training, and Updating Your Plan

A continuity plan is a living document. It is not something you write once and file away. Cyber threats evolve, your technology stack changes, and staff turnover means new employees may not be familiar with emergency procedures.

Annual Tabletop Exercises

Conduct a “tabletop exercise” at least once a year. This is a simulation of a cyberattack where your team walks through the response protocol without actually experiencing downtime.

• Scenario: Choose a realistic scenario, such as a ransomware attack that locks your email and POS system.
• Process: Walk through each step of your response plan. Who calls the IT provider? Who drafts the customer email? How do staff switch to manual mode?
• Debrief: After the exercise, discuss what went well and what was confusing. Did anyone know their role? Were there any gaps in the communication plan?

Tabletop exercises reveal weaknesses in your plan that you might not notice in a real crisis. They also help build confidence and familiarity among your team.

Keeping Contact Lists Current

Your continuity plan is only as good as the contacts you can reach during an emergency. Maintain a physical and digital list of key contacts, including:

• IT support providers and managed service providers.
• Cyber‑insurance provider and policy details.
• Legal counsel specializing in data privacy or cyber law.
• Key vendors and suppliers.
• Local law enforcement (if necessary).

Review this list quarterly to ensure phone numbers and email addresses are current. If you change providers, update your plan immediately.

Note: While listing your insurance policy number is common practice for quick access, always verify the specific requirements of your policy and consult with your legal or insurance advisor regarding how to handle notifications during an incident to ensure you are meeting contractual obligations.

Regular Review and Updates

Review your continuity plan at least twice a year, or after any major system change. If you switch to a new website builder, implement a new payment processor, or add a new software tool, update your plan to reflect these changes.

Cyber threats are constantly evolving. New types of attacks emerge, and new vulnerabilities are discovered. By keeping your plan up to date, you ensure that your business is prepared for the latest risks. This proactive approach not only protects your revenue but also demonstrates to your customers and partners that you take their trust seriously.

Integrated Testing Schedule

To ensure no task is forgotten, tie your activities into a cohesive annual calendar:

By distinguishing between backup and continuity, identifying your critical systems, establishing clear response protocols, and practicing manual workarounds, you can position your business to survive and recover from a cyber incident with minimal disruption.