When an outage starts, a business rarely has time to design a recovery process from scratch. Staff need to know what matters first, who can make decisions and how to keep customers informed while systems are restored. A short, maintained runbook turns a general continuity plan into practical instructions.
Start with the services the business cannot operate without
List the systems that support daily work, such as email, websites, shared files, phones, point-of-sale systems, accounting, booking tools and customer records. Record the owner, supplier, support contact and business impact if each service is unavailable. Put the most time-sensitive services at the top of the recovery order.
Document recovery access safely
A runbook should explain where approved recovery credentials, backup codes and supplier details are stored without placing secrets in an open document. Use a password manager or another controlled location, restrict access to authorised people and test that the right person can retrieve the information during an incident.
Separate backups from everyday systems
Cloud synchronisation and local copies are not automatically independent backups. Keep protected copies that cannot be casually changed or deleted by the same account used for ordinary work. Record the backup location, retention period and the steps for restoring a sample file or service.
Define communication when normal tools fail
Write down an alternative contact method for staff, suppliers and important customers. Include who approves external updates and how the business will avoid sharing unverified information. A simple phone list and escalation order can be more useful than a long policy during the first hour of an outage.
Test the runbook, not just the backup
Run a short exercise each quarter. Choose one realistic scenario, such as a locked account, failed network device or unavailable cloud service. Ask someone to follow the instructions without relying on informal knowledge. Record missing permissions, unclear ownership, outdated contacts and the time needed to restore a sample service.
Review suppliers and dependencies
Many business systems depend on a small number of providers, administrators or network connections. Keep current support details, contract references, warranty information and escalation paths. Review the list when staff, suppliers or major systems change.
Sources
- business.gov.au: Cyber security for business
- Office of the Australian Information Commissioner: Privacy guidance
Leave a comment