It’s 9am, and your team has arrived for the day – but nobody can access shared files. Or your email is down, or the system you use to manage orders won’t load.
And while IT team investigates what’s going on, your team wants to know what they can do. They’re on deadline after all…
In this scenario, how much work could your team get through?
For businesses of all sizes, even a short outage disrupts service. So, a useful way to answer the question above is to work through the scenario – pick a system and imagine it remains out of use all day.
What would stop first?
To start, list the activities that depend on that system. Without it, can you take orders, arrange deliveries or contact suppliers and customers? For a charity, could you coordinate your volunteers or provide support safely without access to beneficiary records?
Prioritise your operations – which activities can wait and which need an alternative arrangement immediately? It more important that are able to contact stakeholders and deliver critical services than it is to schedule an internal meeting, for example.
To that end, the NCSC recommends identifying the information and processes that are essential to keeping your organisation running because that gives a basis for what needs attention first.
Who makes the decisions?
Somebody within the organisation needs to coordinate the operational response. Who tells staff what has happened? Who decides whether appointments should be rescheduled or services revised? Who decides how and what to communicate with third parties?
The decision-maker need not be a specific person – there just needs to be process and a policy in place to determine who is responsible during a crisis. That process and policy should also document the responsibilities and actions that are critical to keeping the organisational operational and restoring normal operations.
What can continue?
Even with a critical function out of action, some work can continue. Document what those elements of the business are and what they require. Teams may, for example, need contact numbers, basic order details or customer data. Any temporary process should protect confidential information and explain how records will be transferred back after. Include in your plan a way to account for lost information and duplicated work.
Have a comms plan
If your email is down, how will you communicate? Who will you communicate with first? And what will you tell them? Consider how much information you need to tell partners, stakeholder and suppliers.
The first people to speak to are your staff. Be clear on what is happening, deal in facts and avoid speculation. Be really clear about what you want from your staff. Once you’ve spoken to your staff, speak to your users, clients and external stakeholders. Again, deal in fact.
Test your recovery
If you have a response plan for scenarios like this, test it by playing out an incident. If you don’t have a response plan, put one together using the advice in this article, and in this eBook <link>.
This test is a dress rehearsal and an opportunity to find what works and what doesn’t, how your organisation copes without critical function and the mitigations you can take. The aim of the test exercise is to minimise gaps and to reduce the pressure in the event of an outage or cyber-attack.
You won’t fill every gap, they’re unavoidable. But, to make your plan and your response effective you have to be honest about what you find during the exercise and about how your organisation performs.