Technology Advisor Blog

Business continuity planning helps your business operate nearly seamlessly in the event of a natural disaster, critical hardware malfunction, or even a cybersecurity breach. These events can cripple or even destroy your organization. But when you take precautions now before such things happen, you save yourself massive headaches down the road.

By incorporating business resilience strategies into your overall planning you’ll be able to address disasters in a focused, efficient way so that you can recover and return to normal business functions as soon as possible. It all starts by building a business continuity checklist. In this guide, we will look at business continuity planning for Boston small businesses, why it’s important, and how you can begin implementing emergency preparedness for businesses by just asking questions.

Watch the PodCast:  

Why Business Continuity Planning for Boston Businesses Matters

Having a comprehensive business continuity plan beyond mere emergency preparedness in the Boston area (or for any business anywhere) is important because unforeseen disruptions derail more than just everyday business. Incidents like data breaches can be as simple as a few hours of downtime or as extreme as your business closing.

The difference is that having business continuity planning in place gives you a base from which to address the incident in a controllable way. According to a study done by the Chartered Management Institute, 90% of organizations with a business continuity plan had reduced disruptions, greater resilience, and faster recovery from the disasters they faced.

Many businesses Ekaru encounters shrug off the necessity of business continuity planning despite its value. In Boston, some businesses will cite that we’re not in a tornado zone or at risk of tsunamis. One lawyer we worked with wasn’t worried about flood or water damage just because he worked on the second floor of a building. But that’s not the point. Yes, a tsunami probably won't hit Boston, but things like fires, flooding, or equipment damage from storms can occur anywhere, and so do critical human errors.

Business continuity plans don’t need to cover every catastrophe. Instead, your business continuity plan should focus on a range of events that could threaten your organization and how to overcome them. One such event type you should prioritize is cybercrime.

Cybersecurity isn’t Enough

Your ability to quickly execute an incident response plan is mission-critical in the event of a cyber incident. No matter what disaster you face, your IT system, data, and tools are probably the most essential for running of your business. That’s why IT disaster recovery planning should factor into every company’s business continuity plan, including yours. The reason? Most professionals agree that having intensive IT security in place, isn’t enough to withstand cybercrime.

Cybercriminals are increasingly targeting businesses in mass, and with the increased use of AI, data breaches are increasingly more unpredictable and costly. Looking at 2023, the amount of data compromised was 72% higher than in 2022. That’s a lot of attacks that were not planned for, and, more frighteningly, were not prevented, whether a data protection plan was in place or not. These resulted in significant delays and damages to unsuspecting businesses.

Those who were prepared were better equipped to navigate through the cyber ordeal. But this isn’t always the case. About 60% of small businesses close only months after a major hack. A major contribution to this is that besides the sheer loss of data and disruption to business operations if the organization cannot cohesively regroup, more wasted time and money compound to where business recovery is impossible. In 2024, cybercrime is predicted to climb to $9 trillion for small businesses.

What these trends demonstrate is that it doesn’t just pay to protect your network, it also pays to have disaster recovery and business continuity plans in place too. Cyber defenses can fail. You need to be prepared if this happens, or your business will suffer.

Disaster Recovery Strategies and Business Continuity Planning

At Ekaru, we believe that the psychology of ‘it’s not a question of if but when’ is central to the disaster recovery strategies that ultimately guide business continuity planning. You need to know what the critical functions of your business are, how they will be affected, and what steps you need to take to return to normal.

Disaster recovery planning focuses on addressing how to deal with a sudden catastrophe. This will also factor into your overarching business continuity plan, which dictates how your business will continue functioning during and after the disaster. Disaster recovery is a subset of business continuity. However, both of these plans work together to help businesses overcome the unexpected, especially for incidents like data breach recovery. It all starts with identifying how your organization can be disrupted, and what that would look like.

Building a Business Continuity Checklist

While professional business continuity consulting professionals like Ekaru can work with you to fully implement your business protections, you can start building your business continuity checklist now. While your checklist can become complex, it’s simple to start compiling. Begin by considering crucial questions like:

• What are the systems that your business really can't run without?
• Are these systems protected or backed up?
• How would you go about restoring these systems in the event of disruption?
• How could you work around the temporary inaccessibility of key systems, data, and resources?
• How would clients be affected?
• What communications would need to be sent out in the event of a disaster?
• What lines of internal communications would you fall back on to coordinate staff?

Your team can simply go through this exercise of discovering what critical systems need to be maintained for business functionality. If one or more of these systems becomes inaccessible, this is what you plan around. From here, you can pinpoint the types of situations that you’d need to factor into your business continuity planning checklist. Let’s look at a few examples.

Local disasters

If your company depends on in-person commuting to a central office or conducting service calls in your area, a local disaster that prevents or inhibits travel can be an issue. This can be seen recently in Maryland, where the Francis Scott Key Bridge collapsed. The result not only shut down traffic to the port, it also disrupted many lives and businesses that use the bridge as a resource.

What’s more is that the collapse completely severed Maryland's main East-West connection, and put a major stall on the commerce taking place in the Port of Baltimore. Because of this, the state of Maryland may lose $15M in revenue a day - which is a major threat to local markets and the economy. Local businesses, or even businesses that depend on Maryland businesses or roadways, need to prepare for such an event. Things to think about:

• Are there alternative routes to commute through?
• Are staff equipped to work from home?
• How can areas near the destruction be serviced?
• Are there local assets that need to be safeguarded in such an event?
• Is our business model dependent on physical transit?
• How could we serve customers who become physically inaccessible?

Data Breach and Cyber Emergencies

Again, your business continuity plan should consider how your IT infrastructure is affected in a catastrophic event, especially if it involves a data breach. If your data is targeted, your immediate responses are very important as you may have legal obligations to customers regarding their data. In some instances, you may not be able to even access your data to perform key tasks.

What’s very daunting about data security is that even with cybersecurity in place, there are multiple ways data can be lost. This can range from human errors resulting in data deletion, equipment destruction due to natural disasters, and malware attacks via phishing emails.

All of these situations are inherently different but the results are still compromised, missing, or inaccessible data. Besides trying to prevent these circumstances with security measures and backup systems, companies should still have a plan in place to address data loss head-on. Things you should consider:

• What is our key data?
• Where is the data stored?
• How can our business suffer data loss and breach?
• Will systems operate without access to certain information?
• Do we have a data backup system we can fall back on?

National/natural emergencies

National emergencies are overwhelming and hard to recover from without proactive planning. The Covid 19 pandemic and shutdowns were a clear testament to this as - all of a sudden, here in Massachusetts, there was a directive to stop work and shelter in place. What do you do at that point?

For IT firms like Ekaru, there was a scramble at first, but thanks to our use of cloud technology, we were able to resume work after minimal downtime. This event forced many organizations to pivot to remote work options and adopt cloud technology as a way to counter events like the pandemic. Disasters like this emphasize the need for flexibility in emergency planning. For this aspect of your business continuity planning, question ways to incorporate redundancies and alternatives into your overall operational structure. Consider the following:

• How much work can be conducted online/remotely?
• Do we have everyone’s contact information?
• What is our communication plan if faced with a pandemic or emergency?
• How long can we tolerate downtime?
• Do we have enough backups in place?
• Are there technologies we can adopt that will provide more flexibility?
• Are there redundant hard drives we can depend on?

Emergency Preparedness for Businesses Requires Testing

If your business continuity plan isn’t tested, it probably won’t help you in a moment of crisis. That’s why you need to take the time to walk through different scenarios, test your plans, and then revisit their effectiveness.

Your preparedness tests can take a variety of forms such as a fire drill or a mock phishing email test. The goal is to practice your emergency and business continuity planning in a controlled setting because this will you a baseline to observe how your staff performs prior to dealing with the shock and stress of an actual event. Tests may also indicate that you need to simplify things or rely on different resources in key situations. Often times these tests reveal the gaps in your plans, such as a lack of communication and documentation that need to be resolved.

For example, Ekaru got a call from a local law firm in the Boston area that had been hit with a cyber event, which we helped them through. One of the main things they described during the entire event was that the employees didn't know what to do, which was greatly attributed to a lack of communication. This was a major hurdle they had to overcome, but it’s something you can prevent by testing your business continuity plan.

The 3-step Business Continuity Test

To conduct a simple, but thorough business continuity test, you can break your testing into three distinct phases. The format can range from simple conversations to tabletop exercises, and, of course, full-blown physical tests. The point is that you simply want to review your plan, gauge how your staff performs, and then assess its effectiveness. Here are the steps:

1. Scenario brief - overviewing the situation and the plan to address the incident
2. Read-through of responses - team members outline their responsibilities and goals during the emergency
3. Simulation - undergo the test and walk through the scenario with the plan you just rehearsed

The scale of your tests should mirror the depth of your business continuity planning. That said, not every organization will have big budgets, large teams, a CISO, or even a full executive suite. That’s fine. You can start the process by simply discussing how business continuity testing would work at your next staff meeting, this in itself is a major step.

How Often Should I Plan a Business Continuity Test?

You’ll want to test your business continuity plans annually. However, certain areas of your business continuity plan may need more testing to ensure peak readiness. This is particularly important when it comes to cybersecurity. It is because of the constant developments in cybercrime that Ekaru encourages our clients to have proper insurance in place to secure business assets, especially cybersecurity insurance for small businesses. As you build and test your business continuity strategies, you may find that you require more safeguards in place. Still, continuous testing will keep your staff in readiness, which is simultaneously what insurance providers look for.

Your tests don’t have to be a massive event each time. For example, scheduling time to periodically check that your data is being backed up and functioning is simple and highly vital to your overall business continuity. Should you suddenly need to recover/restore the data, you will have the peace of mind that your backup is functioning.

Even if you aren’t running full-scale business continuity tests all the time, consider having monthly conversations with your staff about emergency preparedness. If there’s a news event like the Francis Scott Key Bridge collapse, bring it up and assess how your business would respond. The same can be done with cyber-related events. All of this keeps your team thinking ahead and can help you build stronger strategies going forward.

Ekaru Provides Continuity Planning for Boston Businesses

While cyberattacks increase and unexpected disasters continue to occur sporadically, having a business continuity plan provides critical protection for your business. Are you willing to risk your business by not planning?

Ekaru’s business continuity consulting services can help. We start by working with you to identify the central risks to your unique business and the immediate steps you can take to protect your organization. From here, we work with your team to build and test your business continuity plan. We’ll also educate your staff on the latest cybersecurity best practices needed to keep your company safe. It all starts by contacting us for a risk assessment. Contact us at ​​(978) 692-4200.