BUSINESS CONTINUITY & IT RESILIENCE
Could Your Business Keep Going If Your IT Couldn’t?
Cyber attacks, power failures, hardware problems and human error don’t have to become business disasters. The difference is often how well prepared you are to recover.
For most businesses, technology has quietly become the backbone of almost everything they do.
Emails. Customer records. Finance systems. Documents. Microsoft 365. Applications. Phones. Websites. Databases. Remote working.
When those systems are available, we rarely think about them.
When they aren’t, things can grind to a halt surprisingly quickly.
That’s why business continuity and resilience should no longer be regarded simply as an IT issue. They’re business issues involving your people, customers, reputation, finances and ability to keep operating.
“If something went badly wrong with our technology tomorrow morning, how quickly could we get the business working again?”
Business resilience is about more than backups
Business continuity is essentially an organisation’s ability to continue delivering its important services during disruption. IT resilience is a major part of that.
But resilience isn’t simply having a backup. A resilient organisation considers what happens if:
- a server or storage system fails;
- important files are accidentally deleted;
- ransomware encrypts systems or data;
- Microsoft 365 accounts are compromised;
- a critical technology supplier experiences an outage;
- internet connectivity is lost;
- an office becomes inaccessible;
- hardware is damaged by fire, flood or a power problem;
- staff can’t access the systems they need to work.
The goal isn’t to pretend these things will never happen. It’s to make sure one problem doesn’t become a business disaster.
The UK Risk in Numbers
The scale of the issue becomes clearer when you look at the figures.
of UK businesses identified a cyber breach or attack in the previous 12 months.
UK businesses are represented by that Government estimate.
of large businesses reported a breach or attack.
Source: UK Government Cyber Security Breaches Survey 2025/26.
The risk is real, whatever size your business is
The UK Government’s Cyber Security Breaches Survey 2025/26 found that 43% of businesses had identified a cyber security breach or attack during the preceding 12 months, equivalent to approximately 612,000 UK businesses.
The figure increased to 65% among medium businesses and 69% among large businesses.
Importantly, the Government also points out that the survey only captures incidents organisations were able to identify and willing to report. The true prevalence may therefore be higher.
Relying on “it probably won’t happen to us” isn’t much of a business continuity strategy.
When technology stops, the cost isn’t just an IT bill
One of the clearest recent examples came from Marks & Spencer.
Following its major 2025 cyber incident, M&S initially estimated an impact of around £300 million on Group operating profit for the 2025/26 financial year before mitigation.
The business experienced disruption to online shopping, together with operational issues and additional waste and logistics costs as manual processes were required.
M&S’s initial estimate for the impact of its 2025 cyber incident on Group operating profit before mitigation.
Of course, most UK SMEs aren’t operating on the scale of M&S.
But the incident demonstrates something every business can learn from: a technology incident can very quickly become an operational and financial one.
“We’ve got backups.”
That’s reassuring to hear.
But there’s an important follow-up question: can you actually restore them?
A backup strategy needs to consider far more than whether copies of files exist somewhere.
Five questions to ask about your backups
What is actually being backed up?
Are all critical systems, applications and data included?
Where are those backups stored?
Could the same incident affect your original data and its backup?
How frequently are backups taken?
How much recent work could you realistically afford to lose?
How quickly could information be restored?
Having the data somewhere isn’t enough if recovery takes too long.
When was recovery last tested?
A successful backup notification isn’t the same thing as a successful restore.
RPO and RTO: two acronyms actually worth knowing
Business continuity planning doesn’t have to drown you in technical terminology, but two concepts are particularly useful.
RPO
Recovery Point Objective
How much recent data could your organisation reasonably afford to lose?
RTO
Recovery Time Objective
How long could an important system be unavailable before the disruption became unacceptable?
These discussions move backup and disaster recovery away from being purely technical conversations and make them about what the business actually needs.
Behind the cloud is a very real data centre
Cloud computing can make technology seem almost intangible.
It isn’t.
Ultimately, digital services depend upon physical infrastructure: data centres containing servers, storage, networking equipment, connectivity, power and cooling.
Their importance is now recognised at national level.
Critical National Infrastructure
UK data centres are now considered critical infrastructure.
In September 2024, the UK Government designated data centres as part of the country’s Critical National Infrastructure, reflecting their importance to the economy and public services.
The Government says data centres underpin services ranging from patient records and emails to product data and financial systems.
Its 2026 data-centre policy material says the UK data economy represented 6.9% of GDP in 2022, while 28% of UK businesses and 62% of large businesses rely on data-centre services.
It is difficult to think of much modern business activity that doesn’t ultimately depend upon digital infrastructure somewhere.
But even data centres can experience disruption
Putting something in a data centre or cloud environment doesn’t automatically remove risk.
The Government points to a striking example from the July 2022 heatwave, when two separate data centres serving an NHS trust failed.
The incident affected most clinical IT systems at three hospitals and associated community services and led to £1.4 million in unplanned technology costs.
Government estimate of lost customer productivity from UK data-centre outages in 2019.
Unplanned technology costs associated with the 2022 NHS trust data-centre failures cited by Government.
The resilience of your suppliers is part of your resilience too
Data location, infrastructure and the resilience arrangements behind a service are therefore worth understanding.
Using UK-based data centres can form part of an organisation’s wider approach to data location, supplier management and continuity.
But the words “UK data centre” shouldn’t themselves be treated as a guarantee.
Businesses should understand the resilience arrangements supporting the services they’re buying, including redundancy, connectivity, backup arrangements, security, disaster recovery and supplier dependencies.
The UK’s Cyber Security and Resilience reforms further demonstrate the growing importance being placed on the sector. Qualifying data centres are being brought within the relevant regulatory framework as essential services, with Ofcom identified as operational regulator.
Cloud doesn’t automatically mean backed up
“Our information is in the cloud, so we’re covered.”
Cloud storage, service availability and backup aren’t necessarily the same thing. Businesses still need to understand what information requires protection and how it would be recovered following deletion, corruption, compromise or disruption.
Instead of simply asking “Is our data in the cloud?”, ask:
“If our data disappeared or became inaccessible tomorrow, what would we actually do?”
One copy isn’t resilience
A good resilience strategy aims to avoid single points of failure.
Depending on the business and its requirements, backup planning may need to consider multiple copies, separation between production information and backups, geographically independent systems, protected backup copies, retention, access security, monitoring and recovery testing.
Good resilience isn’t about buying the most technology.
It’s about putting the right protection around the systems and information your business depends upon.
Cyber resilience is now business resilience
Traditional disaster recovery often focused on failed hardware. The modern picture is considerably wider.
Cyber incidents can affect identities, endpoints, cloud applications, servers, data and suppliers.
The UK’s National Cyber Security Centre has described cyber security as a matter of “business survival” and has encouraged senior leaders to make cyber risk a board-level priority.
The NCSC also reported that highly significant incidents handled by its Incident Management team were up 50% in the year to September 2025.
CHANGE THE QUESTION
Instead of:
“How do we stop anything bad from ever happening?”
Ask:
“How do we reduce the likelihood, limit the impact and recover effectively?”
Your people and processes matter too
Some of the strongest continuity plans aren’t complicated. They simply answer important questions before an emergency happens.
Your Business Continuity Checklist
Can your business confidently answer these questions?
☐ What would stop us trading if we lost access to it?
☐ What data can we absolutely not afford to lose?
☐ Is everything important genuinely backed up?
☐ How quickly could we restore critical systems?
☐ When did we last test a recovery?
☐ What happens if a key technology supplier fails?
☐ How would employees communicate if email was unavailable?
☐ Who makes decisions during a serious incident?
☐ How would customers be kept informed?
☐ Who is authorised to start the recovery process?
Don’t wait for a disaster to test the plan
Businesses change constantly.
People join and leave. Applications are replaced. New cloud platforms are introduced. Suppliers change. More information is created.
A continuity plan that looked good when it was written might no longer reflect the way the organisation actually operates.
That’s why recovery arrangements need to be reviewed and tested.
Think of it like a fire drill. The best time to discover your recovery plan doesn’t work isn’t while the business is already offline.
Resilience isn’t about expecting the worst
Business continuity can sound unnecessarily gloomy.
It shouldn’t.
Done properly, resilience is about confidence.
Confidence that faulty hardware won’t stop the company.
Confidence that someone deleting the wrong information doesn’t mean it is gone forever.
Confidence that a cyber incident can be contained and recovered from.
Confidence that your employees know what to do.
And confidence that if something unexpected happens on Monday morning, there’s a plan for Tuesday.
BESPOKE IT SOLUTIONS
How resilient is your business?
At Bespoke IT Solutions, we believe resilience should start with understanding your business, not simply selling you another piece of technology.
That means looking at the complete picture: your infrastructure, cloud services, Microsoft 365 environment, cyber security, backups, connectivity, suppliers and recovery requirements.
We can help you understand what you already have, identify potential gaps and build a practical resilience strategy around the way your organisation actually works.
Let’s find out before you need to.
Talk to Bespoke IT Solutions
Protect the data. Prepare for disruption.
Keep the business moving.
Sources & Further Reading
- UK Government, Cyber Security Breaches Survey 2025/26, published 30 April 2026.
- UK Government, Cyber Security and Resilience (Network and Information Systems) Bill: Data Centres, updated 30 June 2026.
- House of Commons Library, Data centres: planning policy, sustainability, and resilience, 27 May 2026.
- National Cyber Security Centre, Cyber security is business survival.
- Reporting and company disclosures concerning the 2025 Marks & Spencer cyber incident.
