The problem is growing faster than it seems
The number of cyberattacks on Russian businesses almost doubled over the past year, with tens of thousands of incidents in the first months of the year alone. All industries are hit: logistics, manufacturing, retail, IT. Most owners read about this in the news and think it will not affect them. Yet the vast majority of modern attacks go beyond stealing a couple of files: they aim to stop the company's entire IT infrastructure.
Why “we have an IT guy” is a trap
IT and security specialists solve technical tasks: they update software, keep antivirus running, and restore files and servers. This work is necessary. It answers the question “how do we fix the system?” It does not answer the question “what happens to the company's money while the system is down?”
In most companies nobody asks the question “what will happen to incoming revenue if everything stops tomorrow morning?” Yet this is the direct responsibility of the owner and the CEO. Technical support does not own it.
Cash flow is what takes the hit, more than the servers
Imagine an ordinary morning when employees cannot open a single file. A customer calls, and the manager cannot find their order. The accountant cannot issue an invoice because the accounting system is unavailable. The courier has left, and the route has disappeared along with the database. Each of these situations is more than an “IT problem”. It means direct loss of revenue, contract penalties and damage to reputation.
Real resilience starts with three answers, and antivirus gives none of them: which process will stop first, what that costs in roubles, and whether the team has a plan for the first two hours after a disruption.
What an owner should do: four steps
This does not need a big budget. It needs a different way of looking at risk.
- Calculate the cost of one day of downtime. Be specific: lost revenue, payroll, contract penalties. Once there is a figure, decisions are made differently.
- Find the points where risk is concentrated. One server, one supplier, one sales channel, one key employee. Wherever “everything depends on one thing”, that is what breaks first.
- Make a business continuity plan (BCP). Write short step-by-step instructions for each scenario: who does what, by when, and what replaces the failed link. A thick rulebook is not needed.
- Test the team and the plan in exercises. Simulate a server failure or loss of access to the office. Only a live exercise shows what really works and what has stayed on paper. And review the plan regularly: the business changes, and so do the risks.
Prevention costs several times less than recovery after an attack. The same tasks can be solved in advance: understand your vulnerabilities, build resilience and train the team to act in a crisis.
Frequently asked questions
If we have a good IT department, why deal with business continuity separately?
The IT department restores equipment and data. Business continuity makes sure the company keeps selling, meeting its obligations and getting paid while recovery is under way. These are different tasks and different areas of responsibility.
Where do you start if there is no budget for a big project?
With three things: calculate the cost of one day of downtime for a key process, list the points where risk is concentrated, and write a short action plan for the first hours after a disruption. You can do this yourselves or in a single consultation.
How can we quickly see how vulnerable we are?
Take the free resilience assessment. Its 13 questions show your level of preparedness, the main risks and the first steps.
Where to start with business continuity
13 questions and 5 minutes will show your readiness level. Then there are two paths: work it out yourself through the programme, or build the system with us.
