Could your business get back to work tomorrow?

The practical question is simple: if your team could not use its usual systems tomorrow, what would it take to open for business again?

Imagine arriving at work unable to reach your email or customer files. Quotes are waiting, a supplier needs an answer and payroll is approaching. It could be an account problem, a stolen device, an outage or a cyber incident. The first concern is the same: what can still be done, and who can help?

A recovery plan turns that concern into a few agreed decisions. You do not need to begin with a thick document. Start with one page that names the work you need to recover, the people responsible and the evidence that recovery is possible.

Choose what has to come back first

List business activities before listing applications. Taking customer orders, paying staff and accessing active job files may each depend on several systems. Include the account used to sign in, the device and internet connection, and any person whose approval is required.

For each activity, decide how long you can reasonably pause it and how much recent information you could reconstruct. These are different questions. You might tolerate half a day without a quoting tool but be unable to recreate a morning’s approved orders.

Use those answers to discuss backup frequency and recovery arrangements. A provider should help you test whether the proposed setup can meet them. A target written in a document is not yet a demonstrated capability.

Find out what your backups actually cover

Ask which files, mailboxes, application settings and business records are protected. Confirm the retention period, access controls and how a copy can be recovered if your usual administrator account is unavailable. Treat the backup account as important business access in its own right.

Cloud storage may include version history or deleted-item recovery, but the available protection depends on the product, configuration and retention limits. Ask someone to demonstrate the recovery you would need. Do not assume that syncing a folder answers every loss scenario.

The UK National Cyber Security Centre’s small-organisations guidance is a useful technical starting point. Its advice needs applying to your systems and circumstances; it is not a South African reporting or legal checklist.

Rehearse a small, safe recovery

Choose a representative file or a test copy of a business system. Agree the scope with the person responsible and restore it to a safe location, without overwriting live work. Check that the result opens, is complete enough to use and has the expected permissions.

Record the backup date, the time taken, what was missing and the next action. If only one person knew how to complete the test, make the instructions usable by someone else. Include a way to reach the relevant support contacts when your ordinary email is inaccessible.

Give people a way to keep working

A South African SME may need to plan for a connectivity failure or a lost device as well as a deliberate attack. Decide which work can continue manually, how colleagues will contact one another and who can authorise spending on a temporary solution.

Think through customer communication too. A simple, accurate update is more useful than a confident promise nobody can substantiate. Name the person who will send it and agree where reliable status information comes from.

If a cyber incident is suspected, involve your IT or incident-response provider before making changes that could destroy evidence or spread the problem. Keep bank and insurer contact routes available where relevant. Reporting obligations depend on the incident and should be assessed with the appropriate adviser.

Make recovery part of ordinary care

The NCSC’s response and recovery guide treats preparation and learning as part of the incident lifecycle. Use that principle after a rehearsal too: fix the gap you found, update the instructions and agree the next test.

Backup is one part of keeping a business working. The more useful outcome is knowing what you would do, who would help and which parts of the plan have actually been tried.