Skip to content
Business resilience does not always look like a disaster-recovery exercise.
More often, it looks like an employee being unexpectedly absent, a laptop failing before an important meeting, broadband dropping out, a cloud application becoming unavailable or the office being inaccessible for a day.
A resilient business is not one where nothing ever goes wrong. It is one that can keep doing the important work when something does.
Start with the work that needs to continue
Resilience planning can become complicated very quickly if it begins with every possible failure.
A simpler starting point is asking what the business must still be able to do.
Can clients contact us? Can we access important records? Can somebody else pick up a piece of work? Can we communicate with employees? Can we invoice, make payments or meet an important deadline?
Then ask what each activity depends on.
That may reveal a person, identity, laptop, application, internet connection, dataset or supplier that has quietly become essential.
Build alternatives around the dependency
The answer is not always expensive duplication.
A failed laptop might be manageable because another device can be prepared quickly. An unavailable colleague may be less disruptive if information and access are shared appropriately. A broadband outage might be handled through mobile connectivity. An inaccessible office may matter very little if people can work effectively elsewhere.
Sometimes the alternative is technical. Sometimes it is simply a documented process, another authorised person or knowing who to call.
The important thing is that the alternative exists before it is needed.
Resilience needs ownership
Even a good fallback can fail if nobody knows when to use it.
Who decides that the office should switch to another connection? Who contacts the application provider? Who tells clients about a delay? Where are supplier details kept if the normal system cannot be reached?
Current NCSC guidance similarly emphasises identifying critical systems, assigning responsibilities and planning how essential operations will continue. Its more recent recovery guidance uses the idea of restoring minimum viable operations before everything necessarily returns to normal.
That is a useful way for a small business to think about resilience too.
Test the ordinary failures
A backup connection that has never been used is an assumption. So is a backup nobody has restored, a replacement laptop nobody has prepared or an emergency contact list stored inside the system that has failed.
Testing does not need to be dramatic.
Try working from the backup connection. Restore a document. Prepare a spare device. Ask what would happen if the person who normally handles a process was unavailable tomorrow.
The goal is not zero disruption at any cost.
The goal is to make ordinary disruption smaller, shorter and easier to manage.
For a small business, good resilience means knowing what really matters, understanding what it depends on and having proportionate alternatives when one of those dependencies is unavailable.
That is resilience as part of everyday business management—not something kept in a folder for emergencies.