For many UK SMEs, compliance begins with a certificate and ends with a folder of policies. That approach is understandable, but it misses the commercial question:
Can the business continue operating when a critical system, supplier, site or member of staff is unavailable?
That is the real test of resilience.
A credible Disaster Recovery strategy connects compliance, core business systems, infrastructure, people and cost control. It defines what must be restored, how quickly it must be restored and who is responsible for making that happen.
For a growing business, this means looking beyond backups. It means examining Microsoft Dynamics 365 Business Central, legacy platforms such as IBM i Management, cloud services, communications, suppliers and the people who understand the environment.
The starting point should be strategic advice from a Fractal IT Director: an independent technology leader who can align risk, investment and execution. Managed IT Services, Network Solutions, Helpdesk Support and Voice and Connectivity then sit underneath that strategy as practical execution services.
Disaster Recovery starts with business impact
A backup is a copy of data. Disaster Recovery is the ability to restore business operations.
The difference becomes obvious during an incident. A company may have daily backups, but still be unable to answer basic questions:
- Which systems must be restored first?
- How long can finance operate without the ERP?
- Can orders be processed manually?
- Who has authority to declare an incident?
- How will staff, customers and suppliers be contacted?
- How will recovery be verified?
- What happens if the primary administrator is unavailable?
A sensible Disaster Recovery programme begins with a Business Impact Analysis. Each important system should be assessed according to operational importance, regulatory exposure, dependency and financial impact.
Two measures are essential:
- Recovery Time Objective (RTO): the maximum acceptable time before a system or service is restored.
- Recovery Point Objective (RPO): the maximum acceptable amount of data that may be lost, measured in time.
For example, an SME might decide that its finance system requires an RTO of one business day and an RPO of four hours. That is not a universal technical standard. It is a commercial decision based on the cost of disruption.
A practical recovery comparison
| Scenario | What the business has | Likely outcome | Strategic response |
|---|---|---|---|
| Untested backup | Copies exist, but restoration has not been demonstrated | Recovery time and data integrity are unknown | Schedule and evidence restore testing |
| Tested backup | A recent backup has been restored successfully | Greater confidence, but dependencies may remain | Test full service recovery and integrations |
| Documented recovery plan | Roles, priorities and procedures are defined | Faster, more controlled decision-making | Review after every exercise or incident |
| Manual fallback | Staff know how to continue essential work temporarily | Reduced operational paralysis | Document forms, approvals and reconciliation |
| Incident response process | Escalation, communications and containment are agreed | Less confusion during a high-pressure event | Exercise with leadership and key suppliers |
Untested backups are an assumption. Tested recovery is evidence.
ISO 27001 and Cyber Essentials: sequence them sensibly
ISO 27001 and Cyber Essentials are related, but they are not interchangeable.
Cyber Essentials is a government-backed baseline focused on five technical control areas:
- Firewalls
- Secure configuration
- Security update management
- User access control
- Malware protection
Cyber Essentials is valuable because it establishes a clear minimum standard and helps organisations address common internet-based threats. Cyber Essentials Plus adds independent technical testing.
However, the current Cyber Essentials requirements make an important distinction: backing up data is strongly recommended, but it is not itself a technical requirement for certification. Nor does the scheme replace a full incident response or business continuity programme.
That is where ISO 27001 becomes relevant.
ISO 27001 provides a management system for identifying information risks, assigning ownership, selecting controls, monitoring effectiveness and continually improving security. For an SME, it can provide the governance needed to make Disaster Recovery, supplier management, access control and incident response repeatable rather than dependent on individual goodwill.
The sensible sequence
For most UK SMEs, the practical sequence is:
- Establish scope, ownership and a realistic technology risk register.
- Use Cyber Essentials to strengthen the basic technical controls.
- Define critical systems, RTOs, RPOs and recovery dependencies.
- Build and test Disaster Recovery and incident response procedures.
- Develop the wider ISO 27001 Information Security Management System.
- Use audit findings and recovery exercises to improve the operating model.
This does not mean every organisation must complete Cyber Essentials before starting ISO 27001. Some businesses will run both workstreams together. The principle is simply to avoid building an elaborate management system around weak technical foundations.
Business Central should be treated as a continuity concern
Microsoft Dynamics 365 Business Central can connect finance, purchasing, inventory, sales, warehouse operations and reporting in one platform. Microsoft describes Business Central as an ERP platform for small and midsize businesses, with integration across Microsoft 365 and support for multiple operational functions.
That centralisation creates value, but it also creates dependency.
If Business Central becomes unavailable, the impact may extend beyond the finance team. Order processing, stock visibility, purchasing, invoicing, reporting and customer service may all be affected.
Before committing to a full ERP programme, a fixed-scope Dynamics 365 Jump Start assessment can reduce risk. The objective is not to push software or create an unnecessarily large programme. It is to establish whether Business Central is commercially and operationally suitable before the business commits significant budget.
A useful assessment should examine:
- Current finance, sales, purchasing and operational processes
- Manual workarounds and duplicated data entry
- Reporting and management information requirements
- Data quality, ownership and migration complexity
- Integrations with payroll, ecommerce, warehouse or specialist systems
- User roles, access controls and segregation of duties
- Continuity requirements for invoicing, orders and month-end
- Implementation scope, assumptions, dependencies and likely costs
- Cutover, testing, training and rollback considerations
The output should be a clear decision: proceed, reshape the scope, delay, or do not proceed.
That is strategic consultancy. It is considerably more useful than starting with a product demonstration and discovering six months later that the business case was built on optimism.
IBM i continuity is also a people issue
Many organisations continue to rely on IBM i and Power Systems because these platforms remain dependable and deeply embedded in critical processes. Their age does not make them irrelevant. In some businesses, they are among the most important systems in the estate.
The continuity risk is often not the platform itself. It is the concentration of knowledge around one or two individuals.
A senior administrator may understand:
- The recovery sequence
- Unusual operational dependencies
- Legacy interfaces
- Batch schedules
- Security settings
- Data hand-offs
- Which warnings matter and which do not
- How to restart operations after a failed job or outage
If that knowledge exists only in someone’s memory, the business has a key-person risk.
Specialist IBM i Management should therefore include more than system monitoring. It should address succession, documentation, privileged access, recovery testing, supplier escalation and the platform’s place in the future architecture.
A practical continuity review should ask:
- Can another suitably authorised person recover the system?
- Are recovery procedures documented and current?
- Are interfaces and dependencies mapped?
- Are administrator credentials controlled and available through an agreed process?
- Has recovery been tested without relying on the usual expert?
- Is the organisation planning to retain, modernise or replace the platform?
Replacing a stable legacy system without understanding its role can create more risk than retaining it. Strategic advice must come before infrastructure activity.
Fund resilience through Technology Expense Management
Resilience work is often postponed because it appears to be an additional cost. That is a weak assumption.
A disciplined Technology Expense Management review can often identify savings that fund the work.
The review should cover:
- Unused or duplicated software licences
- Telecoms and mobile contracts
- Cloud storage and compute consumption
- SaaS subscriptions that no longer have an owner
- Backup and security tools with overlapping capability
- Hardware maintenance and support agreements
- Renewal dates and automatic price increases
- Connectivity services inherited from previous office arrangements
The objective is not indiscriminate cost-cutting. Cheap technology can be expensive when it fails at the wrong moment.
The objective is to move spending towards measurable business outcomes. Recovered telecoms, cloud and SaaS waste can help fund immutable backups, recovery testing, documentation, security improvements and specialist consultancy.
This is where an independent IT Director adds value. Suppliers can execute defined services, but someone must challenge whether the total technology estate is still proportionate to the business.
Build continuity around manual fallback and incident response
Technology is only one part of continuity.
During a major incident, staff may need to work from paper forms, spreadsheets, personal contact lists or temporary communication channels. These arrangements should not be invented during a crisis.
Manual fallback procedures should define:
- Which activities continue first
- Who can approve transactions
- How orders, payments or appointments are recorded
- How data is reconciled when systems return
- Which customers and suppliers must be contacted
- How sensitive information is protected during temporary workarounds
Incident response should define the first decisions, not just the technical recovery steps. It should include containment, escalation, evidence preservation, internal communications, external communications and post-incident review.
Cloud Solutions, Network Solutions, Voice and Connectivity and Helpdesk Support all contribute to this operating model. They should be designed as bolt-ons to an agreed strategy, not as disconnected services purchased in isolation.
A five-step action plan for UK SMEs
-
Map the business-critical estate
Include Business Central, IBM i, Microsoft 365, cloud platforms, connectivity, telephony, endpoints, third-party services and key integrations. -
Agree RTOs and RPOs with business owners
Do not let technical suppliers set recovery targets without understanding operational and financial impact. -
Test recovery, not just backup jobs
Record restoration times, data integrity, dependencies, access requirements and lessons learned. -
Sequence Cyber Essentials and ISO 27001 proportionately
Establish the technical baseline, then build governance, risk management, incident response and continuity controls around the organisation’s real needs. -
Use Technology Expense Management to fund improvement
Remove waste from telecoms, cloud and SaaS contracts, then redirect the savings towards resilience and risk reduction.
The strategic conclusion
Compliance is useful when it improves the way the business operates. A certificate cannot process an order, restore an ERP system or replace the knowledge of a departing administrator.
Disaster Recovery must therefore be treated as a board-level business capability. It should connect compliance, systems, people, suppliers and commercial priorities.
The Fractal IT Director provides that strategic layer. Specialist channel partners can deliver technical depth, while Managed IT Services provide dependable day-to-day execution. The model is simple:
Strategy defines the outcome. Testing proves resilience. Managed services keep the design working.
For wider group services, the Evestaff gateway provides a route to the broader organisation.
SEO tags: Cloud Solutions, Disaster Recovery, Dynamics 365 Jump Start, Helpdesk Support, IBM i Management, Managed IT Services, Network Solutions, Technology Expense Management, Voice and Connectivity, ISO 27001 UK SME, Cyber Essentials, Cyber Essentials Plus, Business Central continuity, RTO and RPO, incident response, business continuity planning, ERP consultancy, IBM i continuity, IT strategy, Fractal IT Director
Join The Discussion