Most businesses prepare for emergencies by buying insurance, backing up a few files, and assuming somebody will figure out the rest. That is not a continuity plan. That is optimism with paperwork.
The companies that recover fastest from a disruption are not the ones that predicted it. They are the ones that already decided what happens next. Here is what the data says about small business disruption, what a recent cyberattack at Boston Scientific teaches owners of much smaller companies, and a five-question business continuity plan you can build without a 40-page binder.
Why small businesses need a continuity plan: what the data says
One in four small businesses never reopen after a major disaster
The U.S. Small Business Administration says roughly 25% of small businesses do not reopen after a major disaster. Its guidance is straightforward: assess your risks, create an accessible response plan, protect critical records, identify backup suppliers, and practice the plan before you need it.
Recovery is not something you improvise after the water is already coming through the ceiling. The owners who get back up fastest made their decisions before the emergency, not during it.
Your biggest disruption may never touch your building
Verizon's 2026 Data Breach Investigations Report found that 48% of breaches now involve ransomware and 31% begin with exploitation of software vulnerabilities. Its small business analysis covered more than 7,000 confirmed small business data breaches.
A disaster does not need smoke, floodwater, or a hurricane warning. Your building can be perfectly intact while your company loses access to the systems it needs to manufacture, invoice, communicate, schedule, and get paid.
Even large companies lose operations when one system goes down
Boston Scientific disclosed that an August 25 cybersecurity incident disrupted manufacturing, order processing, and shipping globally. The company restored those operations, but said the disruption was likely to materially affect its third quarter and full year 2026 results.
If a company with dedicated cybersecurity teams, outside experts, and enormous resources can have operations interrupted, "we have an IT guy" is not a continuity strategy.
The emergency is not the problem. The scramble is.
Most owners think about business risk in terms of prevention. Prevent the fire. Prevent the cyberattack. Prevent the key employee from leaving. Prevent the server from failing.
Prevention matters. But if your whole risk strategy is built on it, you have a problem, because eventually something gets through:
- A storm closes the building.
- Your CRM goes down.
- A supplier misses a critical delivery.
- Your payroll person gets sick the morning payroll has to run.
The operational question is not whether you can prevent every disruption. You can't. The question is whether the business knows how to operate when the normal way of operating suddenly disappears.
Most contingency plans quietly run through the owner
In a lot of small businesses, the real emergency plan is the owner. Critical information lives in their head, important decisions wait for their approval, and the team instinctively looks to them when something goes wrong.
That dependence is easy to overlook on a normal day. A real disruption exposes it fast, especially when the owner is unavailable, overwhelmed, or dealing with the emergency personally.
The verdict: what the Boston Scientific outage teaches small business owners
The situation: Boston Scientific identified a cybersecurity incident on August 25 that took certain IT systems offline and disrupted manufacturing, order processing, and shipping. By September 9, the company reported that core operations had been restored and products were moving through its distribution network at or above normal levels. It also warned the disruption was expected to have a material impact on its third quarter and full year financial results.
My verdict: The most important part of this story is how far the disruption traveled once critical systems became unavailable. What began as a cybersecurity incident interfered with the company's ability to manufacture, process orders, and ship, and eventually created consequences big enough to affect its financial outlook.
Operational disruptions rarely stay inside the department where they start. A technology problem becomes a customer service problem, then a production problem, then a cash flow problem, and finally a financial performance problem when the company has no effective way to keep critical work moving.
Why most people read it wrong: Cyber incidents get discussed as technology problems, which leads owners to assume responsibility begins and ends with whoever manages their IT. That misses the bigger operational risk: employees suddenly losing access to the systems they need to do essential work.
Once an outage hits production, scheduling, customer communication, order fulfillment, invoicing, or payroll, you are dealing with a business continuity problem. Technology may have caused the disruption, but your operating systems determine how well the business functions while the technology is down.
Your version: You probably don't run global manufacturing plants. But your critical dependencies are likely concentrated in surprisingly few places:
- Access to QuickBooks
- An estimator who understands how every job is priced
- A primary supplier for an essential material
- One employee who knows how to process payroll
- An owner who still approves most consequential decisions
Those dependencies fade into the background while everything works, which makes them easy to underestimate. A disruption reveals exactly how much of the business depends on one person, system, vendor, or piece of equipment staying available. The scale is different, but the lesson is the same at almost any size: know where your critical dependencies are and how essential work continues when one of them disappears.
How to build a small business continuity plan: 5 questions
Forget the 40-page emergency binder for a minute. Start with five questions.
- What are the five activities that absolutely must continue for us to serve customers and protect cash?
- What person, system, vendor, or piece of equipment can stop each one?
- If that dependency disappeared tomorrow morning, what is our temporary workaround?
- Who has authority to activate that workaround without waiting for the owner?
- When did we last test whether the workaround actually works?
That last question is where plans become real.
An untested plan is just a document
A continuity plan only becomes useful once you know the alternatives inside it actually work.
- Backups: Having data backed up provides little protection if nobody has tested whether it can be restored fast enough to keep the business running.
- Secondary suppliers: Listing a backup vendor means little if you have never confirmed their capacity, lead times, pricing, or ability to deliver during a disruption.
- Emergency procedures: A procedure employees have read but never practiced under realistic conditions will not hold up under pressure.
Effective business continuity takes more than documenting what you intend to do. The alternatives need to be tested, employees need to understand their responsibilities, and the people closest to the situation need enough authority to make decisions when normal systems are unavailable. Testing before an emergency also exposes weaknesses while there is still time to fix them, instead of discovering them when the business is already under pressure.
This week's move: run a 10:17 drill
Choose one process your business cannot afford to lose for more than a day. It might be scheduling, payroll, estimating, customer communication, order fulfillment, or another function that directly affects your ability to operate and generate revenue.
Bring the people responsible for that process together and ask one question:
"It is 10:17 tomorrow morning and this system, person, or resource is suddenly unavailable. How do we keep the business moving?"
Pay attention to how specific the answers are. Your team should know:
- Who takes ownership
- What alternative process they will use
- What information they need
- Who has decision-making authority
- How customers or employees will be affected
Any part of the answer that depends on "we would figure it out" needs more work. Once you have an alternative, test it. A continuity plan should give your team enough clarity to keep essential work moving without waiting for the owner to invent the response in the middle of the disruption.
The goal is not to anticipate every emergency. It is to build an organization that can absorb a disruption, make good decisions under pressure, and keep operating when the plan for a normal day no longer applies.
Related reading: customer concentration is another single point of failure, so read What Happens If Your Biggest Client Walks? If your workaround depends on people knowing who owns what, start with Is Hiring Actually Fixing Your Problem? And if decisions stall every time the owner is out, see The Interest You're Paying on Every Decision You Won't Make.
Order The Brown Box
The Brown Box: How to Fix What's Broken in Your Business Before It Breaks You is out now. Reduce Risks is a core stage of its TURNAROUND method because the risks that hurt most are usually the ones you already saw coming and tolerated too long: key person dependency, undocumented processes, vendor exposure, and cash flow vulnerabilities. The book walks through how to find them and decide which ones deserve attention first. Order now on Amazon or learn more about the book.
Already read it? A two-line review on Amazon does more for the book than almost anything else.
Want help mapping the dependencies in your business? Get in touch.