In this guide · 8 sections
- 01Business continuity vs disaster recovery vs incident response
- 02Step 1: list critical processes and how long each can stop
- 03Step 2: backups and restore times that match the plan
- 04Step 3: spare internet, devices and access
- 05Step 4: contacts and where to keep the plan
- 06Step 5: test the plan with a 30-minute exercise
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
List your critical processes, set how long each can be down (recovery time) and how much data you can lose (recovery point), then write a manual fallback, a tested restore plan, spare internet and devices, and an offline contact sheet. Test it once a year.
Business continuity vs disaster recovery vs incident response
The three terms overlap, and small firms often need only one document that covers all of them. Still, knowing the difference helps you avoid gaps.
| Plan | Question it answers | Example |
|---|---|---|
| Business continuity plan (BCP) | How do we keep serving customers while systems are down? | Take orders on paper and PayNow QR while the POS is offline |
| Disaster recovery (DR) | How do we restore the IT systems and data? | Restore the accounting file from last night's backup to a spare laptop |
| Incident response plan (IRP) | How do we contain and report an attack or breach? | Isolate infected PCs, call the bank, assess PDPA notification |
For larger organisations, the formal standard is ISO 22301 for business continuity management systems, which Enterprise Singapore lists among the standards eligible for EDG support. A 10-person firm does not need certification; it needs a short plan people can follow. Our incident response plan guide covers the IRP side.
Step 1: list critical processes and how long each can stop
Start with the business, not the technology. Ask what the firm must keep doing for customers, staff and regulators, then which systems each process depends on.
For each process, set two numbers. The recovery time objective (RTO) is how long it can be down before real harm. The recovery point objective (RPO) is how much recent data you can afford to lose, such as one day of entries.
| Critical process | Systems it depends on | Max downtime (RTO) | Max data loss (RPO) | Manual fallback |
|---|---|---|---|---|
| Taking customer payments | POS, payment gateway, internet | 2 hours | None | Static PayNow QR, card terminal on 4G, paper receipts |
| Answering customer email | Microsoft 365 or Google Workspace | 4 hours | None | Phone and WhatsApp Business with a holding message |
| Invoicing and payroll | Xero or QuickBooks, bank | 3 days | 1 day | Delay non-urgent runs; payroll from last month's figures |
| Client files and records | SharePoint, Google Drive, NAS | 1 day | 1 day | Work from the latest restored copy |
| Appointments or bookings | Booking system, website | 4 hours | None | Printed day sheet emailed each evening |
Step 2: backups and restore times that match the plan
Backups only count if you can restore within your RTO. Cloud services keep deleted items for a while, but that is not the same as a backup. Microsoft says SharePoint keeps deleted items in recycle bins for 93 days, and Google says files in Drive trash are deleted after 30 days. Neither helps if ransomware encrypts files in place or an admin account is taken over.
Backup check for your continuity plan
CSA's Cyber Essentials mark includes Backup as one of its measure areas, so this work also counts towards certification. Our guide on backing up Microsoft 365 and Google Workspace explains the options.
Step 3: spare internet, devices and access
Many outages are not attacks at all: a fibre cut, a dead router, a stolen laptop or an expired domain. Plan for the boring failures as well.
- Internet: a 4G or 5G router or phone hotspot that can run the POS and a couple of laptops; know which staff phones have tethering allowed
- Devices: one spare laptop kept updated, or a clear process to buy and set up a replacement in a day
- Access: at least two people who can sign in as admin to email, the domain, the bank and accounting, with MFA on separate devices
- Power: a small UPS for the router and the device running the POS or phone system
- Domain and website: auto-renew on with a valid card, and expiry alerts sent to two people
If staff can work from home, check that the main systems are reachable from outside the office without a VPN that only one person knows how to fix.
Step 4: contacts and where to keep the plan
A plan stored only in SharePoint is no use when SharePoint is down. Keep a printed copy in the office and a PDF on two people's phones.
| Contact | Why you need it |
|---|---|
| Internet provider fault line and account number | Report outages and ask for a technician |
| IT support provider and after-hours number | Restore systems and devices |
| Bank fraud hotline | Stop suspicious payments quickly |
| CSA Cyber Incident Helpline, 6890 9555 | Weekday triage for cyber incidents (CSA, 14 Oct 2026) |
| Police (online report for scams and hacking) | Report crime; your bank and insurer may ask for the report number |
| Cyber insurer claims line, policy number | Some policies need notice before you hire responders |
| Key suppliers and landlord | Delivery changes, building access, power |
Our guide to the Cyber Incident Helpline explains what it covers and its hours.
Step 5: test the plan with a 30-minute exercise
A tabletop exercise means sitting the team down, describing a realistic outage, and walking through what each person would do. It costs nothing but time and shows where the plan is wrong.
Repeat once a year and after any big change, such as a new accounting system, an office move or a new IT provider.
Do it yourself or get help?
Most small firms can write a usable continuity plan themselves with the template above: one table of processes, a backup check, a spare-kit list and a contact sheet. The part that often needs help is backups, because a restore that has never been tested is a guess.
If you want it done for you, our Backup & Ransomware Recovery (S$290) sets up off-site backups for your website, email and cloud files and proves a restore works. The Incident & Ransomware Response Plan (S$390) writes the incident plan and contact sheet, with restore steps matched to your backups and a tabletop pack. For ongoing support costs, see our IT support cost guide.
Frequently asked questions
It is not legally required for most SMEs, but it is worth a few hours. Customers, insurers and larger clients increasingly ask how you would cope with an outage or attack. A short plan listing critical processes, fallbacks, backups and contacts lets you answer that and reduces the time you lose when something fails.
The recovery time objective is how long a process or system can be down before it causes real harm, such as four hours for email. The recovery point objective is how much recent data you can afford to lose, such as one day of accounting entries. Your backup frequency and restore speed must meet both.
No. Microsoft 365 and Google Workspace keep deleted items for a limited time, 93 days in SharePoint recycle bins and 30 days in Google Drive trash, but they do not protect you if files are encrypted in place, an account is taken over or data is deleted deliberately. A separate backup does.
At least once a year, and after major changes such as a new accounting system, office move or IT provider. A 30-minute tabletop exercise is enough for most small firms. Also test a real backup restore every six months so you know how long recovery actually takes.
Somewhere you can reach when your main systems are down. Keep a printed copy in the office and a PDF on at least two people's phones, plus a copy in your normal file storage. Update all copies when contacts or systems change, and note the review date on the first page.