The best way to ensure business continuity

Table of Contents

• What is business continuity and why does it matter?
• Risk assessment and analysis of potential disruptions
• Business Impact Analysis (BIA) and prioritisation of critical operations
• Business continuity plan step by step
• Data backup for businesses and data recovery
  • How often to back up and how to test recovery
• Response plan for cyber attacks and system failures
• How your business starts today
• Frequently Asked Questions

Data backup and business continuity: where do you start?

Last updated: 7 November 2026

What is business continuity and why does it matter?

Business continuity is a company's ability to keep essential operations running when disruptions occur, whether it's a server failure, a cyber attack, or a power outage.

When systems stop, sales, dispatch, and customer communication often stop too. The costs then quickly mount, both in lost revenue and in the time staff spend trying to get things back up and running. Therefore, business continuity is not just a technical task but a management one.

Companies that have defined which operations cannot stop and how quickly they need to be back up and running respond much more purposefully when something fails. This is the foundation for everything that follows in this guide.

Risk assessment and analysis of potential disruptions

A risk assessment answers the question of what could stop operations, how likely it is, and how badly it would affect the company. Start by listing the main threats in a table, where each threat is assigned a rating for likelihood and impact on a scale of one to five. Multiply the ratings together to get a risk level and rank the threats accordingly. Threats with high ratings in both factors should be prioritised in the plan and budget.

Categorise the threats into three groups to ensure none are forgotten:

1. Technical threats: server failures, disk failures, ransomware, cyber attacks, network equipment failures, and update errors.
2. Non-technical threats: power outages, water damage, fire, theft, human error, and key staff illness.
3. External threats: supplier failures, network and telecommunications failures, transport issues, and regulatory changes.

For each threat, record which systems and processes it affects, who owns the threat, and what preventative action is already in place. This makes the risk assessment a living document that can be updated, not a one-off exercise.

Practical example: a company with 25 employees that lists 15 threats often finds that three or four of them carry the majority of the risk. This makes allocating resources much clearer than trying to defend against everything at once.

Caution: A common mistake is to only assess threats that have already occurred. Also consider what would happen if a key employee were absent for two weeks, if a service provider ceased operations, or if a power outage lasted for a full working day. These scenarios often reveal the biggest risks.

Icelandic context: here in the country, it must be borne in mind that earthquakes, volcanic eruptions and storms can cause power and communication disruptions in one place but have chain effects on the countryside. Companies relying on a single internet connection or a single data centre should assess this particularly. It is also worth considering whether suppliers and service providers have their own business continuity plan, as a failure on their part can halt your operations even if nothing has gone wrong with yours.

Record the results in a simple document with columns for threat, likelihood, consequences, risk level, system impact, owner, and action. Review the assessment at least annually and when new systems, suppliers, or staff enter the operation.

Business Impact Analysis (BIA) and prioritisation of critical operations

Business Impact Analysis (BIA) measures the cost of each disruption. For each critical service, define two values: RTO, which is the maximum time within which the service must be operational again, and RPO, which is the maximum data loss the company can tolerate, measured in time.

Example: if the order system cannot be down for more than four hours (RTO) and cannot lose more than one hour of data (RPO), then backup and recovery must meet those figures. Accounting that can wait two days does not require the same treatment.

Prioritise operations according to these values. At the top are services with the shortest allowable downtime and the greatest financial damage. This order determines the sequence in which systems are restored.

Business continuity plan step by step

Once the risk assessment and BIA are available, it is time to write the plan itself. It must be short, clear, and accessible to those who are to execute it under pressure.

Follow these steps:

1. Define responsibility. Specify who makes the decision to activate the plan and who communicates with staff and customers.
2. Record workflows for each critical service. Each requires steps that can be followed without knowing everything about the system.
3. Specify alternative routes. Including backup systems, manual processes, and supplier contacts.
4. Define communication channels. Who receives information, when, and on what channel.
5. Test the plan. A tabletop exercise with key personnel for an hour often reveals gaps that a paper analysis misses.
6. Review regularly. Changes in systems and staff make the plan quickly obsolete.

Data backup for businesses and data recovery

Backup is often the first and most important defence in business continuity. When data is lost without a backup, there is no way back, no matter how good the plan is otherwise.

Follow the 3-2-1 rule recommended by many experts: three copies of data, on two different media, with one copy off-site. This reduces the risk of fire, theft, or cyber-attack destroying all backups at once.

Backups are only useful if the data can be recovered. Therefore, you need to specify what data is backed up, where it is stored, and how quickly it can be retrieved.

How often to back up and how to test recovery

The frequency of backups is determined by the RPO (Recovery Point Objective) value. If the company cannot tolerate more than an hour of data loss, backups must be made at least hourly for critical data. For data that changes infrequently, daily backups are sufficient.

A backup that has never been tested is not reliable. Test the recovery of critical business data regularly and confirm that the backups and processes work before a failure occurs. Test recovery regularly, for example, by restoring a selected document or database to a test environment and checking if it opens and contains the correct information. Make this a regular practice, not just when something has gone wrong.

The following table summarises three basic rules for data backup.

Rule	What it entails	Example
The 3-2-1 rule	Three copies of the data	Three copies
Different media	Backups on two different media	Two media
Offsite	One copy stored offsite	One copy offsite

Response plan for cyber attacks and system failures

Cyberattacks, especially ransomware, are one of the most common causes of prolonged operational downtime for small and medium-sized businesses. A response plan must specify exactly what staff do in the first few hours, who makes decisions, and how communication is handled. It should be printed and accessible offline, as it may not be possible to open it on a computer when the systems are down.

The first few hours are crucial. Follow this timeline:

1. Isolate infected systems. Take it offline by disabling the wired or wireless connection, but do not turn it off until evidence has been secured, if possible.
2. Notify the responsible party. The incident response lead convenes key personnel and assesses whether to activate the plan.
3. Stop the spread. Check if other systems show the same symptoms and isolate them. Do not restart systems until it is clear how the attack entered.
4. Assess the impact on critical operations. Use the BIA (Business Impact Analysis) results to determine which services need to be restarted first and whether manual processes can be used in the meantime.
5. Restore from clean backups. Restoring from a tested backup is usually a safer approach than trying to clean an infected system. See step-by-step instructions for restoring systems after a cyberattack and their prioritisation.
6. Document the incident. Keep records of times, actions, and decisions for analysis and to meet insurance requirements, if applicable.

Warning: Common mistakes include restarting systems before understanding how the attack occurred. The infection can then return immediately, and lost time can be worse than waiting. Another common mistake is destroying evidence by cleaning systems or installing a new operating system without first backing up the current state.

Communication is part of the response. Decide in advance who speaks to staff, customers, and suppliers, on which channel, and when. If personal data may have been compromised in the attack, the reporting obligation to the Data Protection Authority must be assessed, and those affected informed without undue delay. Contact the police in case of a crime or if assistance is requested for an investigation (The Icelandic Police). Clear communication reduces uncertainty and protects reputation while the problem is being resolved.

Finally: test the response plan with a tabletop exercise where key personnel review a ransomware scenario for an hour. Such an exercise often reveals gaps that a paper analysis misses, such as who has the actual authority to shut down systems or who contacts the media.

How your business starts today

Start with three steps that take less than a day: list your ten most important services, check if backups exist for them and when they were last tested, and designate one person responsible for business continuity. Learn about business continuity services for an overview of what assistance is available.

If internal IT knowledge is limited, it may be wise to engage an external party to review the risk assessment. See which endpoint security solutions reduce the risk of ransomware and downtime in daily operations. Contact nexIT to discuss what suits your company.

---

Frequently Asked Questions

What is business continuity?

Business continuity is a company's ability to keep essential operations running or to restart them quickly after a disruption, for example, due to system failure, cyber-attack, power outage, or other emergency. It is based on risk assessment, prioritisation of essential operations, response plans, and regular exercises. The goal is to minimise financial damage and temporary disruption of customer service. Business continuity thus covers both technology and people, processes, and communication.

How does a company prepare a business continuity plan?

It begins by analysing which operations are most important and what happens if they stop for a day, three days, or a week. Then, maximum downtime (RTO) and maximum data loss (RPO) targets are defined for each critical system. The plan should describe roles, communication channels with staff, customers, and authorities, and backup routes. The plan is reviewed annually and tested with tabletop exercises.

How does data backup help ensure business continuity?

Data backup is the foundation for recovery after a failure or cyber-attack. Without a valid backup, a company can lose accounting records, contracts, and business information, making it take a long time to get operations back up and running. A good system follows the 3-2-1 rule: three copies, on two different media, and one off-site or in the cloud. Backups are separated from the main system so that a cyber-attack cannot reach them.

How often should a company's data be backed up?

The frequency depends on how much data loss the company can tolerate. If the maximum data loss (RPO) is one hour, backups are needed every hour, but many small businesses are fine with daily backups that run outside of working hours. Critical systems may require more frequent backups. Also note that a backup is worthless unless recovery has been regularly tested.

How do you test if backup and recovery work?

Test recovery regularly, for example, once a month, by restoring selected data to a test environment and checking if it opens and is intact. Record how long the recovery took and compare it to the target maximum downtime. An annual full test where the entire system is restored provides the most reliable result.