In most small and mid-sized companies, the "emergency plan" lives in one person's head. Usually it's the same IT person who knows every server by name, has the ISP's number in their phone, and remembers where the key to the server cabinet is. As long as that person picks up the phone, everything works. The moment they don't pick up, the company suddenly has a very serious problem.
It's not paranoia, it's plain probability. Within two years every company runs into something from the list: a server fails, a fibre line is cut, a key employee gets sick, ransomware enters the network, the power goes out for six hours. These aren't movie scenarios. These are Tuesdays in SMEs.
A "Business Continuity Plan" sounds corporate. It doesn't have to look that way.
A continuity plan isn't a 200-page report
Some consulting firms sell "BCP development" as a multi-month project with a wagonload of documents. Most SMEs don't need anything like that. What they need is one A4 page with three things on it:
- what we do when X breaks,
- who calls whom, and in what order,
- where the passwords, keys and contacts needed to start are kept.
That page is printed out and kept in a few places — reception, the safe, the owner's home — because if the network goes down, access to the file on SharePoint goes down with it. That detail sounds trivial until you're trying to recover a password from a password manager that can't be opened without internet.
Five scenarios you need an answer to
You don't have to imagine every possible failure. You just need a written answer to five:
- No internet in the office. Do we have a backup line (LTE, a second link from a different ISP)? Who plugs it in? How long can we operate without the network before customers start calling angrily?
- A critical server has failed. Where is the hardware documentation? Who has a current contact for the server vendor and licence provider? Which functions can be temporarily switched to the cloud or a second machine?
- Ransomware or a serious security incident. Who do we notify in the first hour (CSIRT, insurer, lawyer, customers under contract)? What do we disconnect from the network immediately? Where do we restore from?
- The key IT person is unreachable for a week. Does anyone else in the company know where the passwords to the ERP, hosting and domain are? Does the IT person have a real, trained backup?
- A power outage or physical damage to the office (fire, flood, evacuation). Can the team work remotely on a moment's notice? Do they actually have laptops and remote access? Has anyone tested recently that the VPN actually works from outside?
Each of these five situations happens statistically more often than people want to believe. The plan for each should fit in a few sentences.
At one of our clients — a 35-person wholesaler of industrial parts near Poznań — the RAID controller in the server running Comarch Optima and the warehouse system died on a Friday afternoon. The main IT person was at a wedding and not answering his phone. Nobody else in the company knew where the backups were, who to call at the server vendor, or whether any plan B existed at all. On Monday morning the company was still offline; recovery took four business days and cost roughly 80,000 PLN in delayed shipments and contractual penalties with two larger customers. A one-page plan — who calls whom, in what order, with which numbers at hand — would have cut that outage from days to hours.
The one-page plan — what's on it
Concretely, that single page should contain:
- Critical systems — named individually: ERP (Comarch Optima, enova365, Subiekt), email, point-of-sale, warehouse system, access control. Without the list, you don't know what to save first.
- Emergency contacts — name, mobile number, role. ISP, ERP vendor, server maintenance firm, IT person and their deputy, accountant, lawyer, insurer. With mobile numbers, not just office landlines — at 5 p.m. on a Friday nobody picks up the office line.
- Where passwords and keys live — not the passwords themselves (those are in the manager), but "where to look": which manager, who has the master password, where the physical key to the server cabinet is, who knows the after-hours alarm PIN.
- A short runbook for the three most common scenarios — in "if X, then do Y" form. Three to five steps, not a manual. The goal: an accountant with five years at the company should be able to execute the first three moves without calling anyone.
- Who has authority to make financial decisions during a crisis — for example, approving an emergency server service callout on Sunday for 8,000 PLN, or buying a replacement device on the company card.
That's all. One A4 page, double-sided print — for an SME, that's usually enough.
A "what if it disappears…" drill
A plan that has never been tested is as much of a myth as a backup that has never been restored. Twice a year it's worth running a short tabletop exercise in the company.
Pick a scenario. For example: "for the next two hours we're pretending the internet and the ERP server are down". Physically switch off the router (or declare it switched off — the point is the simulation, not paralysing the business). Watch what the team does. Who knows what to do? Who runs to ask the boss? Does anyone reach for the printed plan, or hunt around for it on drives?
After two hours bring the team together for fifteen minutes and write down: what worked, what didn't, where the chaos was, what was missing from the plan. Update the page. Repeat in six months with a different scenario.
This costs nothing except two hours twice a year. Most companies that do this regularly lose hours instead of days in a real crisis.
What next
If your company doesn't have such a page, don't panic — but take it as a signal. Start with twenty minutes and a notebook: who calls whom, where the passwords are, what we do when the ERP goes down. The rest can be filled in later. The crucial thing is that someone other than one person knows where to even find the document.
If you don't know where to start in the context of your business, we help SMEs break this down across two or three half-hour conversations. No 200-page report at the end. The first call is free.
A business continuity plan isn't a document for the shelf. It's a page you can read at 3 a.m., the night the server has just died.