The short answer
Business continuity and emergency planning means deciding ahead of time how your business keeps running through a hack, an injury, a storm or the owner being out. A short written plan turns a crisis into a list of steps, which saves money, customers and stress when trouble hits.
Key Points
The three things to take away.
- 1
Lock down devices and accounts
Turn on two-step login for email, banking, payroll, your website, Google Business Profile and social accounts. Use a password manager so every account has a long, unique password.
Keep a list of every business account, who has access and which email it is tied to. Make sure the business, not a past employee or web designer, owns your domain and main accounts. Set a screen lock and remote wipe on every phone and laptop. Install updates promptly, since many attacks use old software holes.
- Turn on two-step login everywhere
- Use a password manager for all accounts
- Confirm the business owns its domain
- Set screen locks and remote wipe on devices
- 2
Monthly security and backups
Set a monthly routine to check security and backups. Confirm backups ran, and test restoring one file so you know they work. Keep at least one backup copy separate from your main systems so ransomware cannot reach it.
Review who has access to each account and remove anyone who no longer needs it. Install pending updates on computers, phones and your website. Check bank and card accounts for charges you do not recognize. Put the routine on the calendar so it happens every month.
- Test restoring one file each month
- Keep one backup separate from main systems
- Remove access people no longer need
- Install updates on devices and website
- 3
Cyber, data and fraud plans
Write down what to do if you are hacked, lose customer data or fall for a payment scam. List who to call first, such as your IT help, bank, insurance agent and attorney. Know how to freeze accounts and change passwords fast.
Train staff to confirm any request to change bank details or send money by calling a known number, never the one in the email. Every state has its own data breach notice rules, so ask your attorney what applies. Report cybercrime to the FBI at IC3.gov.
- Write a short hack and fraud response plan
- List who to call first
- Verify payment changes by phone
- Ask your attorney about breach notice rules
- 4
Injury and vehicle crashes
Write what to do if someone is hurt on a job or a work vehicle crashes. First get medical help and make the scene safe. Then take photos, collect names and contact details, and fill out an incident report the same day.
Know how to report to your workers' comp carrier and your auto insurer, and how fast they need to hear from you. Some serious workplace injuries must be reported to OSHA quickly, so learn the rules. Keep insurance cards and the plan in every truck.
- Get help and make the scene safe first
- Fill out an incident report the same day
- Notify your insurers right away
- Keep the plan and insurance cards in each truck
- 5
Weather and closures
Decide ahead of time how you handle storms, fires, floods, smoke, power outages and road closures in your area. Set who makes the call to close, how crews and customers get told, and how jobs get rescheduled.
Keep customer and crew contact lists where you can reach them from a phone. Update your Google Business Profile hours and website banner when you close. Protect equipment and materials before a known storm. Check that your insurance covers the risks most common where you work.
- Name who decides to close for weather
- Keep contact lists on your phone
- Update Google hours and your website
- Review insurance for local weather risks
- 6
Platform lockouts
Plan for losing access to an account you depend on, such as Google Business Profile, Facebook, your email, payment processor or field service software. Lockouts happen from hacks, billing problems or a platform flagging your account.
Save recovery codes and backup login methods in a safe place. Add a second trusted owner or admin to key accounts. Export customer lists, invoices and reviews on a schedule. Your own website and email list are the assets you control, so keep them current and owned by the business.
- Save recovery codes for every key account
- Add a second trusted admin to each
- Export customer and invoice data regularly
- Keep your website and email list in your name
- 7
Run without the owner
Set things up so the business can run for a few weeks if you are sick, injured or away. Write down where accounts, passwords, contracts and procedures live, and who can make decisions in your place.
Give a trusted person the access they would need, such as bank signing authority or admin rights, and talk with your attorney about a power of attorney. Cross-train staff so no single person holds key knowledge. Test it by taking a few days off and seeing what breaks.
- Write where everything important lives
- Name who decides when you are out
- Ask your attorney about power of attorney
- Take a few days off as a test
Mistakes to avoid
- Letting a web designer or ex-employee own the domain or Google account.
- Never testing whether backups can actually be restored.
- Sending money because an email asked to change bank details.
Common questions
What is a business continuity plan?
It is a short written plan for keeping your business running through things like a hack, a storm, an injury or the owner being out. It lists who does what and who to call. Small businesses can keep it to a few pages.
What should I do if my business email gets hacked?
Change the password and turn on two-step login right away, then check for forwarding rules the hacker may have added. Warn customers and vendors not to trust payment requests from that account. Call your bank if money may be at risk and report it at IC3.gov.
How can I protect my Google Business Profile from being lost?
Make sure the business owns it and add a second trusted owner or manager. Turn on two-step login for the Google account. Keep recovery options current.
How do I plan for running the business if I get hurt?
Write down where your accounts and documents are and who can make decisions. Give that person the access they need ahead of time. Ask your attorney about a power of attorney and check your disability insurance.
General information only, not legal, tax or financial advice. See the Disclaimer.