A business is one connected system, far more than a set of servers
Resilience does not start with backup data centres. A business should be seen as one living system, in which logistics, pick-up points, cash flows, partners and IT are connected into one whole. This is the system we aim to protect and restore.
Risks are not sorted into “external” and “internal” as in a textbook. Each one is matched to a specific business model. A failure at the tills, lost contact with a carrier, a leak of customer data, a supplier’s sudden exit: each risk is tested against one question. Where would the blow hurt cash flow the most?
Hidden reserves you may not know about
During the analysis you almost always find reserves that were never documented: alternative logistics routes, backup channels for contacting customers and partners, duplicate capacity in the network, key experts able to manage a crisis. They become the basis for step-by-step recovery procedures that work in real life, not only on paper.
Putting numbers on it: BIA, RTO and RPO in plain language
The main advantage of a systematic approach is that the result can be measured. Three basic indicators:
- BIA (business impact analysis) is an assessment of each critical process: how important it is and how long the company can survive without it.
- RTO is the maximum acceptable downtime of a function: how quickly it must be restored to keep losses acceptable.
- RPO is the acceptable amount of data loss: how long a period of data can be lost without critical consequences.
Once these values are set and tested, the company has a measurable, verifiable picture of its readiness instead of a feeling.
A 10-minute self-check tool
Try it right now. Take a sheet of paper and write down three processes the business cannot survive a single day without. Next to each, write what could stop it within an hour. If you do not know how to restore even one of them quickly, that is a risk zone you need to work on.
Have you tried to estimate how much money the business would lose in one day of downtime of its key processes?
Testing in exercises
Every indicator and plan must be tested. Tabletop exercises and stress tests (simulating a server failure, a blocked office, the loss of a supplier) show what really works and what stayed on paper. This is the only way resilience turns from a declaration into a proven capability.
Key resilience metrics
| Metric | What it shows | Benchmark for SMEs |
|---|---|---|
| RTO | How quickly the process must be restored | Critical processes: hours; others: days |
| RPO | How much data you can afford to lose | From 15 minutes to 24 hours, depending on the process |
| MTPD | The maximum tolerable period of downtime, after which the damage is irreversible | Set in the BIA for each process |
| Cost of one hour of downtime | The financial cost of each hour of stoppage | Calculated in advance (calculation method) |
| Date of the last exercise | Whether the plan has been tested in practice | At least once a year |
Frequently asked questions
What is the difference between RTO and RPO?
RTO is how quickly a process must be restored (it is about downtime). RPO is how much data you can afford to lose (it is about the data rollback point). The first answers “how fast will we be back”, the second answers “how much data can we afford to lose”.
Why do you need a BIA if it is already clear what matters?
A BIA turns intuition into numbers: it ranks processes by criticality and cost of downtime. This lets you invest in protection where it really pays off, instead of spending “a little everywhere”.
Can you run exercises without big costs?
Yes. The basic format is a tabletop exercise: the team sits at a table and works through a disruption scenario, each person in their role. It is inexpensive and already reveals most of the gaps in the plan.
Check your recovery numbers
The assessment shows where the recovery times the business needs do not match what the technology can deliver. After that, either your specialist calculates these numbers, or we do.
