IT security

If the worst were to happen to your business IT system, could you carry on working? How quickly could you recover? Careful continuity planning and a reliable backup system will ensure you can keep operating with minimal disruption.

Business continuity planning explained

Business continuity planning involves anticipating problems which could disrupt your company's ability to operate properly and taking steps to mitigate them. For most businesses, these problems typically fall into two categories:

• Physical threats, like fire, flooding or theft or failure of key equipment.
• Software threats, like viruses, malware, ransomware, and hackers.

It's important your disaster planning measures ensure fast business recovery for key systems.

Disaster planning: it might never happen, but?

Good continuity planning involves methodically examining the threats to your business:

1. Assess the threats. Consider what threats could pose a risk to your IT systems. For instance, a fire in your premises, a virus infection or the failure of your internet connection.
2. Determine the likelihood of each threat. Some threats are much more probable than others. Get expert help to assess risk levels. Your IT supplier may be able to help.
3. Work out the potential damage. For instance, would the threat take your main customer database offline? Or would the impact be relatively minor?

Your continuity planning should prioritise the threats with the highest likelihood of happening and those with the potential to cause most damage.

Identify and eliminate single points of failure. For instance, a power cut could take your server offline. Or, if your customer database is held in the cloud, losing your internet connection could leave you unable to check customer details.

In both cases, you might consider adding backup systems. An uninterruptible power supply (UPS) can keep your server running, and a cheap broadband service can provide a secondary internet connection.

Your business recovery plan

As well as taking steps to reduce the likelihood of the scenarios you identify, your business recovery plan should describe how your organisation will react in the event of a problem.

• Establish procedures to follow if something goes wrong. Have clear lines of communication to notify key people quickly.
• Plan how to get up and running. For instance, could you share offices with another company if your premises were out of action?
• Think about short term contingency. If it will take time to fix your systems, how will you cope in the meantime? Can you work remotely, from another location or using cloud services?

Once you've put a business recovery plan together, test it. See how your communications work in practice, and how long it takes you to get working again.

You may wish to consider your business recovery plan when negotiating with IT suppliers. For example, you might want to pay your support company for a faster response time in the event of important systems failing.

Your backup system

Your continuity planning should include a backup system, so you have a safe copy of key data. A number of factors will influence your choice of backup system:

• How much data you need to backup.
• How often you need to back up. It's a good idea to choose an automatic backup system if you have to take a new backup every day.
• How long will you need to keep your backups. Do you need to keep data for several weeks, months, or longer? Are there any legal requirements on how long you need to keep certain data? For example, your financial accounts.
• Where your data is stored. It's easier to backup a central file store than files stored on lots of different computers.
• Facilities and equipment. You also need a way to access your backups. Make sure contingency systems are compatible with your files.

Whichever backup system you choose, it's important to keep backups in a different place to the main copy of the data. Test your backups regularly ? many businesses neglect this step, only to discover their backups are useless when they have a real emergency.

The National Cyber Security Centre has created top tips on how you can back up and restore your data, sources of free data storage and a free, handy infographic on backing up your data.

Many companies now use cloud services to backup their data rather than creating backup copies of their data locally. This sees your business pay a fee each month for a service that backs your data up over the internet. There are several benefits to this. All your data is centralised, so you can access it from anywhere. Your data is stored offsite, so it is safe and can still be accessed even if your premises are not and you only pay for what you use.