When the Lights Go Out: Building a Business Continuity Plan That Holds Up Under Pressure

It is easy to treat business continuity planning as a task for larger enterprises with dedicated IT departments. Many Australian small and medium-sized businesses operate under the assumption that serious outages are unlikely, or that they will simply improvise when something goes wrong. Recent events have demonstrated, with considerable force, that this approach carries significant risk.

The 2023 Optus network outage — which left millions of Australians without mobile and internet services for the better part of a day — disrupted EFTPOS terminals, VoIP phone systems, and cloud-dependent operations across the country. For businesses without contingency measures in place, the financial and reputational damage was immediate. Restaurants could not process card payments. Logistics companies lost visibility over their fleets. Professional services firms were unable to reach clients or access critical documents.

The lesson was not that outages are rare and catastrophic events. It was that they are periodic, largely unpredictable, and entirely manageable — provided you have prepared in advance.

Understanding What You Are Actually Protecting

Before drafting a single policy document or purchasing backup hardware, it is worth taking stock of what your business genuinely depends upon to function. This exercise, often called a Business Impact Analysis (BIA), is the foundation of any credible continuity plan.

Start by identifying your critical systems and services. For most Australian SMBs, this will include:

• Internet connectivity and telecommunications
• Point-of-sale or payment processing systems
• Cloud-based applications (accounting software, CRM platforms, project management tools)
• Email and internal communications
• Access to customer data and records
• Any industry-specific software (practice management systems, inventory platforms, etc.)

For each of these, ask two questions: How long can your business operate without this system before revenue or service delivery is materially affected? And what is the realistic cost — in lost sales, staff downtime, or contractual penalties — of each additional hour of unavailability?

These figures will guide your investment decisions. A business processing $50,000 per day in online transactions has a very different recovery time objective than a consultancy that can operate on email and a notepad for 24 hours.

The Telecommunications Dependency Problem

Australian businesses face a particular vulnerability that is worth addressing directly: many organisations have consolidated their voice, data, and payment infrastructure onto a single telecommunications provider. When that provider experiences a fault — as major carriers have demonstrated they can and will — everything fails simultaneously.

A pragmatic mitigation strategy involves deliberate redundancy at the connectivity layer:

Dual-carrier internet connections. Sourcing your primary broadband and your failover connection from different carriers (for example, NBN through one provider and a 4G/5G LTE backup through a separate mobile network operator) ensures that a single carrier outage does not sever your internet access entirely. Modern business-grade routers can be configured to failover automatically, often within seconds of detecting a primary link failure.

Separate mobile networks for critical communications. If your business relies on mobile phones for staff coordination or customer contact, consider issuing or encouraging the use of SIM cards across two different networks. During the Optus outage, businesses whose staff carried Telstra or Vodafone devices as a secondary option maintained communication capability when Optus customers were unreachable.

Offline payment processing capability. Speak with your payment terminal provider about manual imprinter backup options or offline transaction modes. While these are not suitable for all environments, they can bridge a short outage gap for retail and hospitality operators.

Data Backup: The 3-2-1 Rule, Applied Locally

Data loss remains one of the most damaging and, critically, one of the most preventable consequences of an IT outage or incident. The 3-2-1 backup principle is an industry standard for good reason: maintain three copies of your data, stored on two different media types, with one copy held offsite.

For Australian SMBs, a practical implementation might look like this:

1. Primary copy: Live data on your local server or workstations.
2. Secondary copy: A local network-attached storage (NAS) device or external hard drive, updated daily via automated backup software.
3. Offsite copy: A cloud backup service — Australian-hosted options such as Macquarie Cloud Services or AWS Sydney region instances are worth considering for businesses with data sovereignty obligations under Australian privacy law.

Cloud backup alone is not sufficient if your internet connection is the source of the outage. Equally, a local-only backup strategy leaves you exposed to physical events such as fire, flood, or theft — all genuine risks across different parts of Australia.

Ensure that backups are tested regularly. A backup that has never been restored is a backup whose reliability is unknown. Schedule quarterly restoration tests as a non-negotiable item on your IT calendar.

Drafting Your Incident Response Checklist

When an outage occurs, clarity of process is more valuable than technical sophistication. Businesses that recover quickly are typically those whose staff know exactly what to do in the first 30 minutes — before panic sets in and before management has had time to convene a meeting.

Your incident response checklist does not need to be lengthy. It needs to be accessible, unambiguous, and rehearsed. A basic structure for most SMBs might include:

Immediate steps (0–15 minutes)

• Identify the scope of the failure (single device, local network, internet, or provider-wide)
• Check your carrier's service status page and social channels for reported outages
• Notify staff of the situation and activate any pre-agreed manual workarounds
• Contact your IT support provider if the issue appears to be infrastructure-related

Short-term actions (15 minutes – 2 hours)

• Activate failover connectivity if available
• Communicate with customers if service delivery is affected
• Document the timeline and symptoms of the incident for later review

Recovery and review (post-incident)

• Confirm full system restoration before standing down manual workarounds
• Conduct a brief post-incident review to identify gaps in your response
• Update your continuity plan based on findings

Making the Plan Stick

A business continuity plan that lives in a folder on a shared drive and is reviewed once every three years is not a plan — it is a document. The difference between the two is whether your staff have actually read it, whether it reflects your current systems and suppliers, and whether it has ever been tested under simulated conditions.

For Australian SMBs without dedicated IT staff, partnering with a managed service provider who can assist with continuity planning, backup monitoring, and incident response is often the most cost-effective path. The investment in preparation is consistently lower than the cost of an unmanaged outage.

The Optus outage, the CrowdStrike-related disruptions, and various regional NBN faults in recent years are not anomalies. They are reminders that infrastructure failure is a routine operational risk, not an exceptional one. The businesses that navigated those events with minimal disruption had one thing in common: they had planned for them before they happened.