A backup is not a business continuity plan.
It is one component of a wider resilience strategy. A backup may preserve data, but it does not guarantee that your people can work, your systems can communicate, your suppliers can respond or your customers can continue receiving service after a serious incident.
For UK SMEs, that distinction matters. Ransomware, cloud outages, failed hardware, supplier disruption and human error can all interrupt operations. A business may have a successful nightly backup and still be unable to process orders, access finance systems, answer customers or pay staff.
This post is a practical follow-on to earlier discussions about audit readiness and core systems. The focus here is different: how to connect cyber security, recovery planning, business systems and cost control into one usable programme.
1. Compliance should produce working controls, not paperwork
ISO 27001 and Cyber Essentials are often treated as certificates to obtain and display. That approach misses their practical value.
Cyber Essentials provides a baseline of protection against common online threats. The framework focuses on five technical areas:
- Firewalls
- Secure configuration
- Security update management
- User access control
- Malware protection
The National Cyber Security Centre’s Cyber Essentials guidance makes clear that the scheme is intended for organisations of all sizes. For an SME, it provides a structured way to address weaknesses that attackers routinely exploit.
However, Cyber Essentials is not a complete Disaster Recovery plan. It does not, by itself, define how quickly your finance system must be restored, how customer communications will continue or how you will operate during a prolonged outage.
ISO 27001 takes a wider, risk-based approach. It provides a framework for an information security management system, including:
- Defined information security risks
- Ownership and accountability
- Documented policies and procedures
- Control selection and implementation
- Monitoring and continual improvement
- Evidence that controls operate in practice
The important point is that neither framework should be approached as a tick-box exercise. A consultancy-led programme should connect the standard to the real business: its critical services, customers, legal obligations, suppliers and technology dependencies.
That means asking practical questions.
Which systems would stop revenue generation if unavailable? Which users have privileged access? What happens if your main office is inaccessible? How would you prove to an auditor, customer or insurer that recovery procedures have been tested?
Compliance should answer those questions with evidence, not just documentation.
2. Disaster Recovery begins with business impact
Backup protects recoverable information. Disaster Recovery restores the technology and services required to operate.
Business continuity is broader still. It includes people, premises, suppliers, communications, manual workarounds and customer-facing processes.
A useful recovery programme starts with a business-impact assessment. Each critical service should have its own recovery expectations:
- Recovery Time Objective (RTO): how quickly the service must be restored
- Recovery Point Objective (RPO): how much data loss, measured in time, the business can tolerate
These are not interchangeable.
If an accounts system has an RPO of 24 hours, a nightly backup may be sufficient from a data-loss perspective. If its RTO is two hours, however, restoring from a slow archive may not be acceptable. The recovery architecture must support both objectives.
The same principle applies to a CRM, warehouse system, payroll platform or customer portal. A single organisation-wide target such as “restore everything within one day” is rarely useful.
Map the dependencies
Recovery objectives are only credible when dependencies are understood. A system may rely on:
- Identity and privileged access
- Internet connectivity and Network Solutions
- DNS and domain services
- Cloud platforms and SaaS applications
- Integrations and scheduled jobs
- Specialist hardware
- Suppliers and third-party support
- Key employees with operational knowledge
- Voice and Connectivity services for customer contact
A recovery plan that restores an application but overlooks authentication, networking or a critical integration is not a recovery plan. It is an optimistic document.
The NCSC recommends that organisations keep backups recent, separate from production systems and regularly tested. For ransomware resilience, SMEs should also consider restricted access, immutable or offline copies where appropriate, encryption, retention controls and monitoring for failed backups.
Most importantly, perform restore tests. A successful backup job is not proof that recovery will work.
Evidence should include:
- The date and scope of each test
- Systems and data restored
- Time taken against the RTO
- Data recovered against the RPO
- Issues discovered
- Corrective actions and owners
- Sign-off from an accountable business leader
This evidence supports auditors and insurers, but its primary value is operational. It tells management whether the business can actually recover.
3. Business systems need recovery plans of their own
A modern Microsoft environment may include Cloud Solutions, Microsoft 365, line-of-business applications and Microsoft Dynamics 365 Business Central. Cloud hosting reduces some infrastructure responsibilities, but it does not remove the need for business continuity planning.
Business Central should have a defined service entry in the recovery plan. That should include its integrations, extensions, reporting, exports, user access, data dependencies and post-recovery validation.
Dynamics 365 Jump Start without runaway scope
A Dynamics 365 Jump Start can provide a fixed-scope route into Business Central for an SME that needs momentum and commercial control.
A sensible fixed-scope engagement should state clearly:
- Which companies, users and modules are included
- Configuration assumptions
- Data volumes and migration history
- Integrations and reports
- Customer responsibilities
- Training and testing
- Acceptance criteria
- Cutover and rollback arrangements
- Support and hypercare after go-live
- What is explicitly outside scope
Fixed scope is useful because it controls uncertainty. It does not make implementation risk disappear.
Before go-live, the project should include data cleansing, sandbox migration, user acceptance testing and a rehearsed cutover. Opening balances, interfaces, permissions and critical reports should be validated. Where practical, the previous system should remain available in read-only form during the transition.
A Business Central implementation is not complete merely because users can log in. It is complete when the business understands how to operate, recover and continue using the service.
IBM i remains a critical workload
Many UK SMEs still rely on IBM i applications for finance, manufacturing, distribution, logistics or operational processing. These platforms may be stable, but stability is not the same as resilience.
IBM i recovery planning should cover:
- Operating system and programme-level maintenance
- User profiles and privileged authority
- Capacity and performance monitoring
- Backup and restore procedures
- High-availability requirements
- Audit journalling and security review
- Batch jobs and interfaces
- Printing, EDI and file transfers
- Network routes and authentication
- Supplier and specialist support
- Recovery runbooks and exercises
For organisations with critical IBM i workloads, specialist IBM i management services should be aligned to the same RTO and RPO discipline used for newer cloud systems.
The strategic question is not whether IBM i is old or new. It is whether the workload remains important, understood and recoverable.
4. Technology Expense Management can fund resilience
Security and continuity programmes often stall because management sees them as additional cost. That is where Technology Expense Management (TEM) becomes strategically valuable.
TEM is not simply a hunt for cheaper licences. It is a structured review of the full technology estate, including:
- Software licences and subscriptions
- Cloud consumption
- Telecoms and Voice and Connectivity contracts
- Hardware and maintenance
- Backup and security platforms
- Specialist support agreements
- Renewal dates and cancellation terms
- Duplicate or dormant services
- Supplier commitments and exit costs
Start by reconciling invoices, contracts, users and entitlements. Identify unused licences, duplicate tools, automatic renewals and services that no longer match the business.
Then protect the expenditure that supports recovery. Cutting backup retention, monitoring, security updates, specialist support or recovery capacity without reassessing business impact is false economy.
The objective is not to reduce technology spend indiscriminately. It is to redirect avoidable spend towards priorities such as Cyber Essentials remediation, ISO 27001 governance, recovery testing, identity protection and critical system improvements.
This is where a consultancy-first approach adds value. Managed IT Services, Helpdesk Support, Network Solutions and infrastructure execution can support the strategy, but they should not replace it. The first question should be what the business needs to achieve; the technology estate should then be designed and managed accordingly.
A practical action list for UK SMEs
Use the following checklist as a starting point:
- List the services that would materially affect revenue, customers, payroll or compliance if unavailable.
- Assign an RTO and RPO to each critical service.
- Map dependencies, including people, suppliers, connectivity, identity and integrations.
- Review backup separation, retention, access controls and monitoring.
- Test restoration and record the results as evidence.
- Assess Cyber Essentials controls and identify gaps.
- Decide whether ISO 27001-aligned governance or certification is proportionate to your risks and customer expectations.
- Document recovery plans for Business Central, IBM i and other core systems.
- Review licences, subscriptions, telecoms and support contracts through Technology Expense Management.
- Reinvest verified savings into resilience work and review the plan after major business or technology changes.
Backup is essential. It is also only the beginning.
Business continuity comes from understanding what must continue, how quickly it must return, what it depends on and whether the organisation has tested the answer. For many SMEs, the most effective route is to combine compliance expertise, Disaster Recovery planning, business systems consultancy and disciplined cost management under one strategic programme.
If you want to assess your current position, prioritise investment and build a practical plan for compliance and resilience, speak to the consultancy team through evestaff.co.uk.
SEO tags: Disaster Recovery, Dynamics 365 Jump Start, IBM i Management, Technology Expense Management, ISO 27001, Cyber Essentials, Business Continuity, Microsoft Dynamics 365 Business Central, Cloud Solutions, Managed IT Services, Helpdesk Support, Network Solutions, Voice and Connectivity, UK SME IT consultancy
Join The Discussion